Privacy Policy

• Accounts are optional and only exist on the faucet. You sign in with Google, Discord or NanChat; we never get your email or a password. Gift cards never use an account.
• We don't use advertising or tracking cookies, and we don't sell or rent data. The only analytics are anonymous and cookieless.
• Gift card codes are created and used only in your browser. They are never sent to us, so we can't see, store or recover them.
• To keep the faucet from being drained by bots, we process your IP address and the Nano address you submit, and keep short-lived records that expire on their own.
• We count visits and usage anonymously (for example “the Gift Cards page was viewed 40 times today”). These counts can't be traced back to you.
• Anything sent on the Nano network is public by design, as on any blockchain.

To send you Nano and stop abuse, we process:

• The Nano address you submit, to send the payout, to apply the per-address cooldown, and to check it against our abuse protections.
• Your IP address, to apply cooldowns per visitor and per network range, to count failed or suspicious attempts, to apply temporary blocks, and to check whether the connection comes from a data center, VPN, proxy or Tor (these connections can't claim).
• Basic browser information sent with every web request, such as your browser's user agent and language. It confirms the request comes from a normal browser on this site. Each claim session is tied to a one-way hash of your IP address and browser, so it can't be reused elsewhere.
• Security check results: the answer to the slide puzzle is checked on our server and deleted after one use, and your browser completes a small proof-of-work calculation that we verify.

We also read the public transaction history on the Nano network of the address you submit and of wallets that sent Nano to it or received Nano from it. This lets us spot networks of throwaway wallets funded or emptied by the same owner. For successful claims we keep a record of these wallet links, and wallets found to be part of abuse may be blocked from claiming.

You can use the faucet without an account. If you choose to sign in with Google, Discord or NanChat, you get a bonus on claims, a saved wallet address, a nickname and a claim streak. For that we keep:

• A one-way code derived from your Google or Discord user ID, so we recognise you next time. We can't turn it back into your ID. We only ask Google for your basic profile and Discord for your username — never your email, contacts, servers or messages.
• Your display name from Google (first name) or Discord, and the web address of your Google or Discord profile picture, shown in the header and on your account page.
• A profile picture you upload, if you choose to. Your browser crops and shrinks it before sending it, which also removes hidden photo data such as location. We keep it until you remove or change it, or delete your account. Anyone can see it wherever your name is shown.
• Your saved wallet address, if you save one. With NanChat, you sign a one-time login message in the NanChat app, which proves you own your Nano wallet; we keep that wallet address as your account's address. Signing a login message can't move any Nano.
• Your nickname, if you choose one, and when you last changed it.
• Claim statistics: number of claims, total and bonus Nano received, your streak and the time of your last claim.
• Which Nano addresses your account has claimed to, because the bonus for an address goes only to the first account that claims to it, and which faucet payouts were yours (kept 45 days), so Recent Activity can mark bonus claims.
• Sign-in sessions: a random code in an httpOnly cookie; we store only a one-way hash of it, so it can be signed out.

Recent Activity. Faucet payouts are public on the Nano network anyway. Claims that got the account bonus show a small “+%” marker there, which doesn't say who made them. If you have an account, your nickname (or name) and picture appear next to your claims there, so anyone can see which wallet address is yours. This is on by default, and you're told about it when you sign in. You can turn it off at any time with “Show me in Recent Activity” on your account page; it then disappears within about a minute.

An account never changes the security checks described above; they run the same for everyone. Profile pictures are loaded by our server and shown from our own address, so your browser never contacts Google or Discord for them. You can delete your account at any time on the account page, which removes everything listed here straight away.

The Starboard is a public message board. Posting, replying, liking and reporting need an account; boosting a post doesn't. When you use it we keep:

• Your posts and replies, with the time and, for a post, an optional link. They are public, shown with your nickname (or name) and profile picture, whatever your Recent Activity setting is.
• Your likes and reports, so each account counts once. Only like totals are shown; who liked or reported something isn't shown to anyone except the site operator for reports.
• Boost payments: which post was boosted, by which account (or none, if you boosted without signing in), the one-time Nano address it was paid to and the amounts, for 90 days. The payment itself is public on the Nano network, like any Nano transaction.
• View counts: a plain number per post that goes up each time the post is shown on screen (on the Starboard or the faucet page). Nothing about who saw it is kept.
• A one-way code of your IP address, for up to an hour (up to 6 hours for Featured purchases), to limit how many posts, views and payments one connection can start.

You can delete your own posts and replies at any time. Deleting your account removes them from the board straight away. The site operator can hide posts and stop accounts from posting. After each boost payment is started, Upstash QStash calls our site back a few times so the boost turns on even if you close the page; it only receives the payment's random ID.

Nano gift cards are non-custodial. When you create one, your browser generates a new gift wallet and its code. The code is the only key to that wallet, and it never leaves your device. Gift links carry the code after the # in the address, the part browsers never send to any server. The page also removes the code from your address bar after reading it.

While you're paying for a new gift card, the unfinished gift, including its code, is saved in your browser's local storage, so closing the page doesn't lose the Nano. It stays only on your device and is deleted when you press Finish. Clearing your browser data before then removes it permanently.

To check balances and send transactions, the page talks to the Nano network through our server. Our server only sees the gift wallet's public address and transactions already signed in your browser, both of which become public on the Nano network anyway. It also uses your IP address to limit how many requests one visitor can make in 10 minutes.

We keep no record of gift cards: no codes, no list of who created or redeemed them, and no link between a gift and a person. That's also why we can't recover a lost code. The only thing counted is an anonymous daily total of gift cards created and redeemed and the amounts involved (see “Anonymous usage statistics” below).

Nano is a public ledger. Every transaction, including faucet payouts and gift card payments and claims, can be seen by anyone on the network along with the addresses and amounts involved. We have no control over that and can't remove anything from it.

The faucet page shows a Recent Activity list of recent payouts with a shortened address, the amount and the time. It also shows running totals of claims and Nano sent, which contain no personal information.

To see how the site is used, we keep simple daily counts that only the site operator can view. We count:

• page views per page;
• an estimate of unique visitors per day;
• successful faucet claims and refused claims, by reason (for example “cooldown”);
• gift cards created and redeemed, and the amounts involved.

These are totals only. We don't store IP addresses or set cookies for this, and nothing in them identifies a visitor. To estimate unique visitors, your IP address and browser information are turned into a one-way code using a random key that changes every day and is deleted after two days. Only a combined estimate is kept, which can't be turned back into an IP address or linked to you. Requests from the same connection are rate limited using a short-lived one-way code that expires after 10 minutes.

We also use Vercel Web Analytics and Vercel Speed Insights, from our hosting provider. They count page visits and measure how fast pages load, without cookies. Vercel uses your IP address and browser information only to tell visits apart within a day, turned into a one-way code that is discarded after 24 hours; it doesn't store the IP address. We only ever send it the page address itself — never anything after “?” or “#”, so gift card codes in links are never included — and the private admin page isn't measured.

If you use the Bug report / Feedback form, we receive what you type, the optional contact detail you choose to add (for example an X handle or email), and the page you were on. It's posted to a private channel in our Discord server so we can read and reply to it. We don't attach your IP address or any other identifier.

To stop spam, the form is limited to a few messages per visitor, counted with a short-lived one-way code (not your IP address) that expires after a day. Please don't include gift card codes, wallet seeds or private keys in a message.

We don't set advertising or tracking cookies. If you sign in, we set one sign-in cookie (ns_acct), plus a short-lived cookie during sign-in that protects it from being forged. The site also keeps a few small things in your browser, and none of them are sent to us:

• A flag in session storage so the “new” highlight on the Gift Cards button plays only once per visit.
• An unfinished gift card in local storage, as described above, until you press Finish.
• The time your next faucet claim becomes available, so the page can show a countdown. It is cleared once that time has passed. Cooldowns themselves are still enforced by our servers.
• Whether you asked to be notified when your next claim is ready.
• The last announcement you closed, so it doesn't show again.

If you choose “Notify me” without an account, your browser asks for permission to show notifications from this site, and the reminder is shown by your own browser while a NanoSpace tab is open. Calendar reminders are created on your device or in your own calendar account.

Claim reminders (signed-in accounts only). If you turn on claim reminders, your browser gives us a push address for that device, created by your browser's push service (Google, Apple, Mozilla or Microsoft), plus keys that encrypt the message. We store these with your account, for up to 5 devices. After each claim we schedule one reminder with Upstash QStash, which only receives your account's random ID and a one-time code, and calls our site back when your next claim is ready. We then send a single “your claim is ready” notification and nothing else. You can turn it off on your account page or in your browser settings; the device's push address is deleted when you turn it off, when you delete your account, when the push service says it's no longer valid, or after 90 days without a claim.

If the Cloudflare Turnstile check is shown, Cloudflare may use its own cookies or storage to tell people and bots apart, under Cloudflare's privacy policy.

Running the site involves these providers, each of which handles data under its own privacy policy:

• Vercel hosts the site. Like any web host, it handles every request and keeps server logs, which can include IP addresses and the Nano addresses involved in refused claims, for a limited time. It also provides the cookieless Web Analytics and Speed Insights described above.
• Upstash provides the database that holds the cooldowns, limits and abuse records described on this page, and the scheduling service (QStash) that times claim reminders and checks Starboard boost payments.
• Google, Apple, Mozilla or Microsoft deliver claim reminders to your device, depending on your browser, if you turned them on.
• Nanswap provides the Nano node that sends transactions and answers balance and history questions.
• Discord receives the messages you send through the Bug report / Feedback form, and handles sign-in if you choose “Continue with Discord”.
• NanChat handles sign-in if you choose “Continue with NanChat”: its app sends us your wallet address and the signed login message.
• Google handles sign-in if you choose “Continue with Google”.
• Cloudflare Turnstile provides an additional bot check on the faucet when it's shown.
• Team Cymru answers a lookup containing your IP address, used to tell home and mobile connections apart from data centers and VPNs.
• The Tor Project publishes the list of Tor exit addresses we download. Nothing about you is sent to it.

Transaction links open nanexplorer.com, an independent block explorer, only when you click them.

Records expire automatically. With our default settings:

• Claim cooldowns for an IP address, network range and Nano address: 24 hours.
• Counts of failed or suspicious attempts: 15 minutes. Temporary blocks: 6 hours.
• Network type checks for an IP address (home, mobile or data center): up to 7 days.
• Successful-claim records, wallet links and blocked wallets: up to 45 days.
• Puzzle answers and one-time session tokens: minutes, deleted after a single use.
• Gift card request limits and statistics rate limits: 10 minutes.
• Anonymous daily usage statistics: about 13 months. The daily key used to estimate unique visitors: 2 days.
• Running totals of claims and Nano sent: kept indefinitely, as they contain no personal data.
• Accounts: until you delete them. Sign-in sessions: 30 days. Which account owns a Nano address: 60 days after its last claim. New-account limits per connection: 24 hours. Claim-reminder devices: until you turn them off, or 90 days after your last claim.

Server logs are kept according to our hosting provider's retention. We may shorten or extend these periods when needed to protect the service, and we'll update this page if we do.

We use the information above only to run the faucet and gift cards, keep them secure, and stop fraud and abuse. We don't sell it, rent it, use it for advertising or build profiles of visitors.

We share it only with the providers listed above, as needed to run the site, or if we're required to by law.

Using the faucet or gift cards is optional. You can clear this site's storage in your browser settings at any time; finish or save any unfinished gift card first. If you have an account, you can sign out or delete it on the account page. Without an account, we usually can't connect stored records to a specific person. Records expire on the schedule above without you having to ask.

Nothing recorded on the Nano network can be changed or deleted by us or anyone else.

Nano Space isn't intended for children, and we don't knowingly collect information about them.

We'll update this policy when the site changes. The date at the top shows when it last changed, and the version on this page is always the current one.