Privacy policy — senderbot.app
Last updated 2026-10-281. Who is responsible
senderbot.app is an unofficial community project. It launches tokens on Sender, but it is not operated, endorsed or commissioned by Sender.
2. What we process, and why
Visiting the site
Our host, Vercel, processes your IP address, browser details and the pages requested in order to deliver the site and keep it secure. We also count requests per IP address in memory, briefly, to slow down abuse. Legal basis: our legitimate interest in running a secure site (Art. 6(1)(f) GDPR).
Signing in with X or Telegram
Sign-in and your wallet are provided by Privy. Your chosen provider shares its user ID and username with Privy and us. You can link X and Telegram to the same Privy account and wallet. Privy creates an embedded Ethereum wallet for you; its keys are held by Privy, not by us. We store the IDs and usernames of your linked X and Telegram accounts, Privy user ID, wallet ID, wallet address and whether you have enabled the bot. We read your wallet's ETH balance through an Ethereum node provider to show it to you. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).
Commands you send in Telegram
Telegram sends us the command, your immutable Telegram user ID, and the chat, message, topic or guest-query identifiers needed to process it and reply. We store command and launch state to prevent duplicate execution. A photo you attach to a launch is retrieved from Telegram and uploaded to Sender when the launch can proceed. We do not publish Telegram user, chat or message identifiers, or automatically attach a linked social account to the token metadata. Anyone in the chat can see messages you send there and the bot's replies. Legal basis: Art. 6(1)(b) GDPR.
Commands you post on X
When you post a command mentioning @senderxbot, we receive the post's ID, text, conversation ID and your X user ID through the X API, store them with the command's status, and reply to your post on X. A token you launch is sent to Sender's public API with its name, symbol, description and your X username, which Sender publishes on the token's page. Legal basis: Art. 6(1)(b) GDPR.
The blockchain
Launch transactions are recorded on Ethereum mainnet. They are public, permanent, and linked to your wallet address; nobody, including us, can change or delete them.
Our public launch history
Our public launch history shows each launched token's name, symbol, pairing, time, transaction and market cap, together with the X username of the account that launched it and a link to the post on X that launched it. Both are already public through that post. It does not show your X user ID, Privy IDs or wallet address. Launches requested in Telegram show public token details without a launcher identity or a link to the source chat. Legal basis: our legitimate interest in showing who launched a token, so that others can judge it (Art. 6(1)(f) GDPR). You can object to this at any time (Art. 21 GDPR).
3. Who receives data
- Vercel Inc., USA — hosting.
- Privy — sign-in and embedded wallets. Privy's pages are protected by Cloudflare.
- Neon — our database.
- X Corp. — sign-in and the posts you send to the bot.
- Telegram — sign-in, commands and replies in Telegram chats.
- An Ethereum node provider — wallet balances and transactions.
- WalletConnect (Reown) — Privy's sign-in window contacts its API when it loads.
- Sender — token details when you launch a token.
Some of these providers are in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. We do not sell data, and we do not use it for advertising, profiling or training AI models.
4. Cookies and browser storage
We set no cookies and store nothing in your browser until you choose to sign in. When you click "Sign in", Privy's sign-in loads and the following are stored. All of them are needed for sign-in and your wallet to work; none are used for tracking or advertising, so no consent is required (§ 25(2) TDDDG).
| Name | Type | Set by | Purpose |
|---|---|---|---|
| privy:* | Local storage | Privy | Your sign-in session, device identifier and wallet connection. The session entries are removed when you sign out. |
| __cf_bm, _cfuvid, cf_clearance | Cookies on privy.io | Cloudflare, for Privy | Bot and abuse protection of the sign-in service. Up to one year. |
| WALLET_CONNECT_V2_INDEXED_DB | IndexedDB | WalletConnect, via Privy | Wallet connection state kept by Privy's sign-in library. |
| base-acc-sdk, base-acc-sdk.store | IndexedDB, local storage | Coinbase Base SDK, via Privy | Wallet connection state kept by Privy's sign-in library. |
This site itself stores nothing in your browser. You can delete all of the above at any time in your browser's settings; you will then be signed out.
5. How long we keep data
We keep your account data while you use the service, and command and launch records for as long as needed to make sure no command runs twice and to answer questions about a launch. Ask us to delete your data at any time at the address above; on-chain transactions cannot be deleted. Our host keeps its logs for a short period of its own.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw the bot's access to your wallet at any time by unticking bot access on the start page. You may also complain to a data protection supervisory authority.