LEGAL
Privacy Policy
Effective Date: March 23, 2026
Last updated October 2026
The Undesirables LLC · Wyoming, USA
1. Overview
The Undesirables LLC ("we," "us," "our") respects your privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding that data when you interact with our website (the-undesirables.com), mint or hold our NFTs, use our soul.md files, or chat with the characters in Soul Chat.
2. Data We Collect
We collect minimal data necessary to verify NFT ownership and deliver the soul.md experience:
- Wallet Addresses: When you connect your wallet to our site, we temporarily process your Ethereum wallet address to verify on-chain ownership of Undesirable NFTs. We do not store wallet addresses in a database.
- Server Logs: Our hosting provider (Vercel) may automatically collect standard server log data including IP addresses, browser type, referring URLs, and access timestamps. This data is retained by Vercel per their own privacy policy and is not actively used by The Undesirables LLC for profiling or tracking.
We no longer run giveaways or accept giveaway entries. Entries collected for past campaigns in March–April 2026 are no longer used.
We do not collect:
- Names, email addresses, or phone numbers
- Biometric data (Illinois BIPA does not apply)
- Private keys or seed phrases — ever
- Transaction history beyond what is publicly available on the Ethereum blockchain
- Cookies for tracking or advertising purposes
3. How We Use Your Data
- Ownership Verification: Wallet addresses are used solely to verify that you hold an Undesirable NFT before granting access to soul.md files.
- Soul Chat: Your messages are used only to answer you: to look up data for the reply and to write it. See section 5c.
- Security & Fraud Prevention: Server logs may be reviewed to detect and prevent bot abuse or denial-of-service attempts.
We do not sell, rent, or share your data with third parties for marketing or advertising purposes.
4. Data Retention
- Wallet Addresses (Verification): Processed in real-time during your session and not stored persistently.
- Soul Chat: We do not save your messages. Section 5c lists the counters we keep, which expire on their own, and when a message can appear in server logs.
- Server Logs: Retained per Vercel's data retention policy (typically 30 days).
5. Third-Party Services
We use the following third-party services that may process data:
- Vercel: Website hosting and serverless functions. See Vercel's Privacy Policy.
- Groq: Writes the characters' replies in Soul Chat (section 5c).
- Alchemy: Ethereum data lookups, such as the NFT ownership check before a soul.md download and collection floor prices in Soul Chat.
- CoinGecko: Crypto prices in Soul Chat. In Vessel, a coin name you mention is sent to CoinGecko to look up its price.
- Ethereum Blockchain: All NFT transactions are recorded on the public Ethereum blockchain. Blockchain data is permanent and immutable by design.
We do not use Google Analytics, Facebook Pixel, or any third-party tracking or advertising scripts.
5b. TCG Oracle App & MCP Server
The following applies specifically to our TCG Oracle mobile and desktop application and the Undesirables MCP Server:
- Bring Your Own Key (BYOK): The app requires users to provide their own API keys for AI inference (e.g., Groq, OpenRouter, OpenAI). These keys are stored exclusively on your local device using secure storage and are never transmitted to The Undesirables LLC or any third party.
- Camera Access: The app requests camera access solely to scan and photograph trading cards for the AI grading pipeline. All image processing occurs on your device. Card images are never uploaded to our servers or any third-party service.
- Card Market Data: The app fetches publicly available card pricing and catalog data from third-party APIs (Pokémon TCG API, Scryfall, YGOProDeck, OPTCG API). These requests go directly from your device to those services. We do not act as an intermediary or log these requests.
- Vault Data: Your card collection ("Vault") is stored locally on your device using AsyncStorage. This data never leaves your device.
- MCP Server: The Undesirables MCP Server runs entirely on your local machine. It does not phone home, transmit telemetry, or send diagnostic data. All 34 tools execute locally with zero cloud dependency.
- Zero Telemetry: Neither the TCG Oracle app nor the MCP Server collects usage analytics, crash reports, device identifiers, or any form of telemetry. There are no hidden network calls.
5c. Soul Chat (18+)
- No account: You don't need an account or a wallet to chat.
- 18+ confirmation: When you confirm you are 18 or older, that choice is stored only in your browser. Each message then carries a flag saying you confirmed; our server checks it and does not store it.
- Your messages: Messages you send are processed by Groq to write the character's reply. Each request sends Groq the character's instructions and the latest messages of your conversation (up to 16). Groq handles them under its own privacy policy.
- Vessel: The chat in Vessel (/vessel) looks up data for your question before the character replies. Your message goes to our server as part of the request's web address, so it can appear in our hosting provider's request logs. Some words from it, such as a card name, may be sent to our price oracle (oracle.the-undesirables.com), where they can also appear in request logs, and a coin name may be sent to CoinGecko. Lookup results are cached in server memory, not saved in a database.
- Ethereum addresses: If a message contains an Ethereum address (0x…), our server may send up to two of them to Alchemy to look up a collection's name and floor price. Only the addresses are sent, not the rest of your message.
- What we store: We do not save your messages or the replies. Our server keeps only a spam-limit counter keyed to your IP address, which expires after 5 minutes; a site-wide count of messages per day, which expires after about a day; and anonymous totals (for example, replies per day and replies per character per week) that hold no IP address and no message text and expire after 90 days. Our hosting provider's standard server logs (section 2) also apply.
- In your browser: The conversation exists only in the open page. It is gone when you close or reload the page.
- Don't share personal information in the chat, such as your name, address, phone number, passwords or seed phrases. The characters are AI, not people.
6. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Deletion: Request deletion of your personal data. Note that we cannot delete data recorded on the public Ethereum blockchain, as it is immutable by design.
- Right to Opt Out: You may decline to connect your wallet. Access to the website content (excluding soul.md downloads) does not require any data sharing.
To exercise any of these rights, contact us at @sailorpepe_eth on 𝕏.
7. International & Regional Compliance
GDPR (EU/EEA): Wallet addresses, when combined with IP addresses or browser data, may constitute pseudonymous personal data under GDPR. Our legal basis for processing this data is legitimate interest — specifically, verifying cryptographic ownership of digital assets to deliver the purchased service. We process only the minimum data necessary and do not retain it beyond the session.
CCPA/CPRA (California): We do not sell personal information. California residents may request disclosure of the categories of personal information collected by contacting us.
8. Children's Privacy
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete that information.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective Date" at the top of this page. Your continued use of our services after the updated Effective Date constitutes your acceptance of the revised Privacy Policy.