Privacy Policy

Who this covers

This policy describes how the FCUKPNL website and Telegram bot process information when you use fcukpnl.com or the FCUKPNL Telegram bot. FCUKPNL is the name of the product and service; it is not a registered company. Questions: fcukpnl@gmail.com.

FCUKPNL is an on-chain analytics and entertainment tool. It does not create user accounts, does not connect a wallet, and does not ask for seed phrases or private keys.

What we do not collect

The current implementation does not request, accept, or store:

• seed phrases or mnemonic words
• private keys
• wallet connection, transaction signing, or token approvals
• passwords or account profiles
• payment details

The website does not set first-party tracking cookies, and it does not write Autopsy results to browser localStorage or sessionStorage. There is no cookie-consent banner because this implementation does not use tracking cookies. To tell a first visit from a later one, the browser may store one localStorage flag, fcukpnl.visited, with the value 1. That flag is not a wallet address, an Autopsy result, or a cross-site identifier. Do not paste secrets into the Autopsy field. A seed phrase is not a Solana public address, and the lookup path is built for public keys only.

Website Autopsy

When you submit the Autopsy form, the browser sends a public Solana wallet address to our servers over HTTPS (POST /api/wallet and POST /api/wallet/transactions).

On the server we then:

• look up public account information (including SOL balance when available) through the public Solana RPC at api.mainnet-beta.solana.com
• fetch public transaction history for that address from Helius, which we use as an infrastructure and on-chain data provider
• compute P&L, behavior, Trader Identity, and roast output from that public history
• return the result to your browser for that session

Autopsy API responses are sent with cache-control headers that tell browsers and CDNs not to store them as reusable public cache. The website does not implement a logged-in history of wallets you have analyzed.

Short-lived technical caches

To avoid repeating the same infrastructure calls immediately, the server may keep a short-lived analysis cache keyed by public wallet address (on the order of about 30 seconds for a balance lookup and about 60 seconds for a transaction analysis). A public wallet report page may keep a separate snapshot of that same analysis for about 15 minutes so a shared link does not repeat the lookup on every open. Those caches are performance caches, not an account or profile store. They are not a permanent Autopsy archive.

IP addresses and rate limiting

Wallet API routes apply server-side rate limits so a single client or wallet cannot exhaust shared analysis capacity. For that purpose we read a client IP from request headers (X-Forwarded-For or X-Real-IP) and pass it, together with the submitted public wallet address, to Upstash Redis rate-limit counters.

Those counters exist to enforce limits (for example, per-IP and per-wallet windows on the order of minutes, and a daily Helius page budget). Opening a public report at /wallet/<address> uses the same per-IP limit and the same daily analysis budget. Repeat opens of a report already in the snapshot cache do not apply the interactive per-wallet transaction limit. The counters are not used in this codebase to build marketing profiles, and Upstash rate-limit analytics is turned off in the current configuration.

Telegram bot

If you use the FCUKPNL Telegram bot, Telegram delivers bot updates to our webhook. We process Telegram user identifiers, chat identifiers, message text you send the bot (including public wallet addresses), and callback actions needed to run commands.

When the bot is fully configured, the current implementation may:

• run the same public-wallet analysis path used by the website (including Helius)
• rate-limit Telegram user IDs in Upstash Redis (separate from website IP limits)
• store a watchlist of public wallet addresses you choose to watch, together with your Telegram user ID and a created timestamp, in Supabase, until you remove them
• keep a short-lived “watch pending” flag in Redis (about 15 minutes) while you add a wallet

Telegram is a third-party platform. Telegram’s own handling of your account and messages is governed by Telegram, not by this policy.

Website analytics

FCUKPNL uses Vercel Web Analytics through the official @vercel/analytics package in the site layout. It records anonymous page views on public website routes and anonymous product events for the public funnel: landing, return visits, wallet lookup start and outcome, whether a Trader Identity was assigned, share actions, and Telegram or Due Diligence clicks. Those events use only coarse categories such as result status, failure category, whether an identity was assigned, analysis state, share method, and platform. The current implementation does not send wallet addresses, transaction signatures, seed phrases, private keys, P&L, Trader Identity text, roast text, or Autopsy results to analytics. If a page URL is a public wallet path, analytics stores that path as /wallet with the address removed.

Autopsy looks up a public address with a POST to our wallet APIs. The address is not placed in the page URL, so page-view analytics sees routes such as the home page, FAQ, Privacy, and Terms — not the wallet you submitted.

Vercel documents this product as cookieless. Visitors are identified with a hash created from the incoming request. That hash is discarded after 24 hours and is not used to follow you across other websites. Data points may include the page URL, referrer, coarse geolocation (for example country, region, and city), device type, operating system, and browser. Aggregated page-view statistics are processed by Vercel as the host for fcukpnl.com. This is not Google Analytics, Meta Pixel, session recording, fingerprinting, or advertising.

Infrastructure providers

Depending on the feature, public wallet addresses and related request data may be processed by:

• Helius — transaction history used for Autopsy
• public Solana RPC — account lookup
• Upstash Redis — rate limiting and short-lived Telegram watch-pending flags
• Supabase — Telegram watchlists only, when that feature is configured
• the cloud host that serves fcukpnl.com — TLS termination, request routing, and operational logs
• Vercel Web Analytics — anonymous website page views and anonymous product events, as described above

Those providers process data according to their own terms. This codebase does not implement Google Analytics, Meta Pixel, advertising pixels, session recording, or other third-party marketing trackers.

Sharing from your device

Trader Identity share cards, copy actions, and “Share on X” links run in your browser. Share text and images are generated on your device and can include a link to https://fcukpnl.com/wallet/<address>. Anyone who opens that URL, including a social-preview crawler, receives the same public-wallet autopsy the site already shows for that address. Due Diligence stays off that page. The current website does not upload share images to an FCUKPNL media store. If you post to X or another app, that platform receives whatever you share.

Retention

What this implementation actually keeps:

• Autopsy results in your browser until you leave or run another lookup — not as a server-side user history
• short analysis caches measured in seconds
• rate-limit counters measured in minutes, plus a daily analysis-capacity counter
• Telegram watchlist rows until you remove them (if the watchlist is configured)
• Telegram watch-pending Redis keys for about 15 minutes
• a localStorage flag that only records that this browser has opened the site before
• aggregated, anonymous website page views and product events processed by Vercel Web Analytics

We do not claim that hosting, CDN, RPC, Helius, Upstash, Supabase, Telegram, or Vercel retain nothing. Those operators may keep security, access, and analytics logs under their own policies. This project does not implement a separate long-term Autopsy user database.

Requests and changes

There is no in-product account settings page. For a deletion or access request that relates to a Telegram watchlist or other data we can actually locate, contact fcukpnl@gmail.com. We will only be able to act on data this implementation stores and that we can reasonably identify.

We may update this page when the product changes. The date at the top is the current version. Continuing to use FCUKPNL after an update means you are using the service under the posted policy.