WTH

Privacy

Last updated 3 October 2026

What the Hook is a public protocol site. The dashboard reads on-chain events and a shared snapshot of those events. It is not a custodian, a broker, or a place that asks for a seed phrase.

What we do not collect

• We do not ask for, store, or transmit seed phrases, private keys, or recovery phrases.
• We do not take custody of tokens. A connected wallet signs on the reader's device.
• We do not sell reader data.

What the site stores on the device

The theme preference is stored in the browser as wth-theme. Clearing site data removes it. A wallet connection, when the reader chooses one, lives in the wallet extension or app — not in our database.

wth-seen holds the month this browser first opened the site and the last day, week, month, quarter and year it was counted in. It is how we count unique readers over long periods without an identifier: the browser says “first time this month” once, and nothing that names it is sent. It holds no ID, no wallet address and no IP.

What the pages fetch

Public pages load our own origin, Google Fonts, DexScreener (token metadata and images), and the Robinhood Chain block explorer. The dashboard reads a server-side snapshot of public chain data. The optional /api/rpc relay forwards read-only Ethereum JSON-RPC methods. It does not send writes. Session replay goes to PostHog through our own origin.

Vercel Analytics and Speed Insights may record anonymised page views and performance on this host. They are not used to identify a wallet.

Anonymous usage counts

On top of page views we count a few steps in aggregate: the first visit in a period, opening the hook dialog, connecting a wallet (which wallet app, not which address), a zap confirmed, landed or failed (with the contract's error name), an invite pool opened, the calculator used, a dashboard that loaded stale, the utm_ campaign tag of the link a reader arrived on, and which off-site host a link leads to. No address, transaction hash or typed text is sent. The counts go to Vercel Web Analytics and to PostHog, both in aggregate. PostHog does not remember the browser on the next visit.

Session replay and heatmaps

To find where the site confuses people, we record how a page is used: clicks, scrolling, mouse movement and what the page showed, and play it back later. PostHog records it for us and stores it in the US. Every text field is masked, and the connected wallet address and balance are left out of the recording. Network requests keep only their address and timing, never their contents. Nothing is saved in cookies or on the device, so a recording ends when the tab closes, and a later visit is not linked to it.

When a page throws, we also send the error name, message and stack, so the same visit can be replayed. Wallet addresses, long hashes and email addresses are removed before it is sent. Console logs are not sent.

Zap diagnostics also go to PostHog: the token symbol, deposit and quote amounts, pool fee and range, the step that failed, and the contract's error name and numeric limits. They help us reproduce failed deposits and link to the same tab's recording. They contain no wallet address, transaction hash or wallet request contents. Server diagnostics record quote and RPC failures without request contents or credentials.

A browser that sends Global Privacy Control is neither counted nor recorded, and its errors and zap diagnostics are not sent. You can also turn all of that off here; that removes wth-seen and stops the recording. Anonymous page views and performance are unaffected.

Contact

Questions: info@whatthehook.io · whatthehookv4@gmail.com. Security reports also go there — see security.txt.