Privacy policy
Last updated 12 November 2026 (measuring our ads on X added, section 5a)
- You can play and create a wallet without an account. Your practice balance stays in your own browser.
- For the TOP 100, we keep your practice pops (which coin, the prices, the times) under a random player name, or a name you pick. That name is public on the TOP 100. We never show your Google name there.
- Signing in is optional. If you sign in with Google, we receive your name, email address, profile picture and Google account ID.
- A wallet you never link reaches us not at all. If you link it to your account, we store its public address and nothing else about it.
- We never receive or store your 12 secret words or your wallet's private key.
- Came through a friend's link? A small cookie remembers their code for 90 days, so they get their share.
- No ads in the game, no third-party analytics. We count visits ourselves, from our own server logs, as anonymous daily totals. We do not sell your data.
- One exception, only if you arrive by tapping one of our ads on X: we tell X that its ad led to a visit. X's script runs in a sealed frame and cannot see the game or your wallet (section 5a).
1. Who we are
popnpump.com ("Popnpump", "we", "us") is run by @popnpump.
@popnpump is the controller of the personal data described here. For anything about your data, write to privacy@popnpump.com.
2. What we collect and why
| What | When | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Server logs: IP address, time, the address requested, browser and device type (user agent), the referring page | Every visit | To run the site, keep it secure, stop abuse and fix errors, and to count visits as anonymous daily totals (a one-way code of your address and browser whose key changes every day and is deleted after two days; only the totals are kept) | Legitimate interests (Art. 6(1)(f)) | About 14 days, then deleted |
| Your Google account: account ID, email address, name, profile picture link and a copy of the picture (shown only to you, as your account icon); when you first and last signed in | When you sign in with Google | To create your account and keep you signed in | Performance of our agreement with you (Art. 6(1)(b)) | Until you delete your account |
| The public address of each wallet you link to your account, and when it was linked and unlinked | Only when you choose to link a wallet | To connect your wallet to your account | Performance of our agreement with you (Art. 6(1)(b)) | Until you delete your account |
A referral cookie (pnp_ref): only the code of the link you came through |
When you open popnpump.com through someone's link | So the person who invited you gets their share of our fee | Legitimate interests (Art. 6(1)(f)) | 90 days |
| Your wallet's public address and which link it came through; the SOL added to it and the trades made with it | When you make or restore a wallet after opening someone's link | To pay the person who invited you, and to show them their numbers | Legitimate interests (Art. 6(1)(f)) | As long as the referral pays, until you ask us to delete it |
| Your affiliate details: your link's code, the wallet you are paid to, your earnings, visits through your link | When you choose "Get my link" | To run the affiliate program and pay you | Performance of our agreement with you (Art. 6(1)(b)) | Until you delete your account |
The TOP 100: a player cookie (pnp_p, a random ID), your player name (a random one like FizzyOtter42, or the one you
pick), and each practice pop you make: the coin, its price when you jumped in and popped, and the times. If you are signed in, your
Google account ID is attached so your name follows you to a new device; your Google name and email are never used for it |
When you play | To rank everyone's best pop fairly: our server prices every pop itself. Your player name and best pop are public on the TOP 100 | Legitimate interests (Art. 6(1)(f)) | The cookie 365 days; the name and pops until you ask us to delete them |
| The Background BOT: your wallet's public address, the addresses of your BOT wallet (a Swig smart wallet on Solana), the BOT settings you choose to run there, the trade size, the $2 payment's transaction, and every trade our server makes from your BOT wallet (coin, SOL in and out, times, why it sold) | When you choose "Get Background BOT" and while it runs | To trade from your BOT wallet on your BOT's rules while you are away, and to show you its results | Performance of our agreement with you (Art. 6(1)(b)) | Until you turn it off and ask us to delete it; the trades themselves are public on the blockchain |
A sign-in cookie (pnp_s) |
When you sign in | To keep you signed in; it holds your account ID and an expiry time, signed so it cannot be forged | Strictly necessary for the service you asked for | 180 days, or until you sign out |
| Error reports: what went wrong in the game on your device (the error message and where in the page's code it happened), what you were doing at that moment (for example the coin and the step of a trade, and the trade's own reference), the page's version, your browser and device type, the time, and two one-way codes made from your IP address and your player cookie that only group one player's reports together. On an error with real money, also your wallet's public address. Never your 12 words or your keys | Only when something goes wrong in the game | To find and fix errors quickly, above all with real trades, and to keep the service working and secure | Legitimate interests (Art. 6(1)(f)) | 30 days, then deleted |
An ad click ID from X, kept on your device (pop_xclid) and sent to X together with what any web request carries:
your IP address and browser and device details (such as language, time zone and screen size). We do not store it on our servers |
Only when you reach popnpump.com by tapping one of our ads on X, and on your visits in the 30 days after | To see which of our ads on X bring players (section 5a) | Legitimate interests (Art. 6(1)(f)); you can switch it off (section 5a) | 30 days on your device; X keeps what it receives under its own policy |
We do not use your data for profiling, and we make no automated decisions about you. The only advertising use is measuring our own ads on X (section 5a).
3. Your 12 secret words and your private key
Your wallet is created inside your own browser. The 12 secret words (your recovery phrase) are shown to you once and are never sent to us and never stored, not on our servers and not in your browser. We cannot see them, recover them or show them to you again. Only your paper copy exists.
If you restore a wallet, you type your 12 words into popnpump.com's restore screen. They are checked and turned into your wallet's key inside your browser; they are not sent to us and not stored, and the boxes are cleared as soon as the wallet is restored.
We will never ask you for your 12 words by email, chat or phone. Anyone who does, or any other website that asks for them, is trying to steal your wallet.
If you choose to link a wallet to your account, your browser signs a short message with the wallet's key to prove the wallet is yours. We check that signature and keep only the public address. You can unlink it, or create a new wallet with new words, at any time.
4. What stays on your device
Some things are kept in your browser's own storage and are never sent to us (error reports excepted, as said below):
- Your practice session: practice balance, green and red count, your green streak, your recent tickets (
pop_session). - Small settings: whether you have seen the help (
pop_seen) and whether sound is on (pop_sound). - Error reports waiting to be sent (
pop_errq): when something goes wrong, the report waits here until it reaches our server (within about 20 seconds), then it is removed from your device. See "Error reports" in section 2. - Your wallet's public address (
pop_wallet_addr), so the game knows which wallet this device uses. - An ad click ID (
pop_xclid), only if you came through one of our ads on X. It is kept for 30 days and is sent to X, not to us (section 5a). - Your wallet's signing key, if you created a wallet on this device. It is stored as a protected browser key that can sign for you but cannot be read out, by us or by any script.
You can remove all of this by clearing this site's data in your browser. If you clear it, the signing key is gone from this device and you will need your 12 words to use your wallet here again.
5. Cookies
We set at most three cookies. pnp_p when you play: a random player ID for the TOP 100, so your pops and name stay
yours. pnp_s only when you sign in: it keeps you signed in. pnp_ref only when you open
popnpump.com through someone's link: it holds that link's code for 90 days, so the person who invited you gets their share. It is not used
for anything else and tracks nothing on other sites. We set no analytics or advertising cookies. Our fonts are served from our own server.
When you click "Sign in with Google", Google's sign-in window loads from Google, and Google may use its own cookies under Google's privacy policy. If you never sign in, nothing on popnpump.com loads from Google. Your profile picture is shown from our own copy, so the game page never loads it from Google.
5a. Our ads on X
We advertise Popnpump on X (x.com). When you reach popnpump.com by tapping one of those ads, X adds an ad click ID to the link. Only then do we tell X that its ad led to a visit, so we can see which ads work:
- The game keeps the click ID in your browser's storage (
pop_xclid) for 30 days and takes it out of the address bar. - On each visit in those 30 days, a small sealed frame loads X's measuring script. X receives the click ID, your IP address and browser and device details (such as language, time zone and screen size), and can connect the visit with the X account that tapped the ad.
- The frame is sealed off from the game. X's script cannot see the game, your wallet, your 12 words, your account or our cookies. We tell X only that the visit happened.
- If you did not come through one of our ads on X, nothing on popnpump.com loads from X.
- To switch it off: turn on Global Privacy Control or Do Not Track in your browser. We then keep no click ID and load nothing from X. Clearing this site's data removes a click ID that is already there.
X handles what it receives under X's privacy policy.
6. Who else is involved
- Hetzner Online GmbH (Germany) hosts our servers. Your data is stored on servers in Germany, and our backups in Hetzner's storage in Finland (EU).
- Google provides the sign-in. When you sign in, Google confirms your identity to us and learns that you signed in to Popnpump. Google may process this data in the United States under the EU–US Data Privacy Framework.
- X Corp. (United States) measures our ads on X, only for visitors who came through one of those ads (section 5a).
- The Solana blockchain. A wallet address and anything done with it on the blockchain are public, permanent and visible to anyone. This is how blockchains work and is outside our control. We cannot change or delete anything on a blockchain.
We do not sell, rent or trade your personal data. We disclose it to authorities only when the law requires us to.
6a. Invite & earn (affiliates)
If you invite people with your link, you see for each person who signed up through it: the date, a shortened wallet address, the SOL they added, the SOL they traded and what you earned. You never see their name, email or full wallet address from us. Your share of our fee is paid by the Solana network straight to the wallet you choose, as part of each trade. Payments on the blockchain are public.
6b. The Background BOT
If you get the Background BOT, your wallet makes a BOT wallet (a Swig smart wallet on Solana) and gives our server permission to trade from it. Our server can then move the SOL you put in the BOT wallet (at most 1 SOL); it cannot touch your own wallet. Only your wallet can take the SOL back or turn the BOT wallet off, at any time, without us. Trading meme coins is very risky: a BOT can lose money.
7. International transfers
Our servers are in Germany. We keep the data we hold to the minimum described above.
8. Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format (data portability). To use any of these rights, write to privacy@popnpump.com from the email address of your account. We answer within one month.
Deleting your account removes your email, name, picture link and our copy of the picture, Google account ID and every wallet address you linked from our database at once, and from our backups within 30 days (we keep backup copies for 30 days, then delete them). Your wallet itself keeps working with your 12 words; it is yours, not ours.
You can also complain to a data protection authority, for example the one in the EU country where you live (in Denmark: Datatilsynet).
9. Security
All traffic is encrypted (HTTPS). The sign-in cookie cannot be read by scripts on the page and is signed so it cannot be forged. Access to our servers is restricted. We keep as little data as we can: the safest data is data we never have.
10. Children
Popnpump is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has signed up, write to us and we will delete the account.
11. Changes
If we change this policy, we update the date at the top. If a change matters for how we use your data, we will say so on the site before it applies.