Cookie notice
Cookie notice
1. In brief
This site sets seven cookies and keeps nine values in your browser’s local storage. Every one of them is listed by name in section 4, with what it holds, how long it lasts and where in our code it is written.
six of the cookies are strictly necessary and are not a choice: they are what signing in, connecting an X account, your own alert switches, and the record of this very choice consist of. Everything else — the referral cookie, your interface preferences, and reading measurement on the blog — is written only if you allow it, and nothing is written before you answer.
There is no advertising cookie, no third-party cookie and no cross-site tracking of any kind. Nothing but this site sets a cookie here.
The sections below are the binding text; this one is for orientation.
2. Your choices, and how they are asked for
We apply the strictest rule to everybody, wherever you are. That means prior opt-in: nothing outside the strictly necessary category is written to your device, and no reading is measured, until you have said yes to that category. Not answering is a no. Dismissing the notice without pressing anything writes nothing.
Refusing is one press, in the same place, on the same button as accepting. Nothing is pre-ticked. There is no “legitimate interest” switch left on behind a second screen, and no category that re-enables itself.
You can change any of it at any time from Cookies & storage in the footer of every page. Reopening it shows what is currently in force — not a fresh banner — and switching a category off deletes what it had already stored rather than only stopping future writes.
We record your choice in a cookie named hood_consent on your own device, together with the date and the version of this notice you chose against. We do not keep a copy of it on our servers — see section 2 of the privacy notice for why. The record lasts 180 days, after which you are asked again, and you are also asked again if what a category covers changes.
3. The four categories
| Category | What it is for | Items | Your choice |
|---|---|---|---|
| Strictly necessary | Signing in, finishing an X connection safely, your own alert switches, and this consent record itself. | 11 | Always on |
| Referral attribution | Remembering the referral code of the person whose link you followed, so they are credited if you sign in later. Their identifier, not yours. | 1 | Off unless you allow it |
| Interface preferences | Remembering your quick-buy amount, and whether you left the projects list on grid or table and at which row density. | 4 | Off unless you allow it |
| Reading measurement | On blog articles only: how long you spend reading one, how far down you get, and whether you leave within a few seconds — used to rank articles by demand and choose which one the blog index features. | 0 | Off unless you allow it |
The strictly necessary category is not a choice because each item in it does something you asked this site to do. Each one does something you asked this site to do. Without them you cannot stay signed in, an X connection cannot be completed safely, and this page cannot remember what you chose here. Under the ePrivacy rules and the UK equivalent, storage of that kind is exempt from consent.
Reading measurement shows zero items and still requires your consent. It stores nothing on your device at all — what is consented to there is the measuring itself, not a cookie. Section 5 says exactly what it measures.
4. Everything stored, by name
Every cookie and stored value this site writes. The same list the preferences dialog shows, read from the same place in our code, so the two cannot disagree.
| Name | Kind | Category | What it holds | Lifetime | Set by |
|---|---|---|---|---|---|
| hood_session | Cookie | Strictly necessary | Keeps you signed in after you sign a message with your wallet. | 30 days, or immediately when you sign out | Our server · HttpOnly |
| hood_x_state | Cookie | Strictly necessary | The value X returns and we compare, so nobody else can finish your X connection. | 10 minutes, or the moment the connection finishes | Our server · HttpOnly |
| hood_x_verifier | Cookie | Strictly necessary | The secret half of the PKCE exchange for an X connection. Never leaves our server. | 10 minutes, or the moment the connection finishes | Our server · HttpOnly |
| hood_x_return | Cookie | Strictly necessary | Which page to return you to after the X round trip. | 10 minutes, or the moment the connection finishes | Our server · HttpOnly |
| hood_account_prefs | Cookie | Strictly necessary | The two alert switches, exactly as you set them on your account page. It IS the switches — refusing it would leave a control that does nothing. | 1 year, or immediately when you erase your profile | Our server · HttpOnly |
| hood_consent | Cookie | Strictly necessary | What you chose here, when, and which version of the notice you chose it against. | 180 days, then this asks again | Page script · readable by script |
| hood_ref | Cookie | Referral attribution | The referral code of whoever's link you followed, so they are credited if you sign in. Set only if you arrive through one. | 30 days | Page script · readable by script |
| hood:wallet-disconnected | Local storage | Strictly necessary | That you pressed Disconnect. Without it your wallet extension reports you connected again on the next load, and the menu says something untrue. | Until you clear site data, or connect again | Page script |
| thehood:launch-draft:v1:<chain>:<factory> | Local storage | Strictly necessary | A launch you were filling in and have not sent, so a reload does not lose it. Offered back, never applied, until you press Restore or Start fresh. | Until the launch confirms, or you press Start fresh | Page script |
| thehood.quickbuy.eth | Local storage | Interface preferences | The quick-buy amount you last typed, so it survives a reload. | Until you clear site data | Page script |
| thehood.view | Local storage | Interface preferences | Whether you left the projects list on grid or table. | Until you clear site data | Page script |
| thehood.density | Local storage | Interface preferences | How many rows the projects list shows at a time. | Until you clear site data | Page script |
| thehood.displayCurrency | Local storage | Interface preferences | The currency you chose to see amounts in — USD, ETH, each amount's own currency, or a listed raise currency. | Until you clear site data | Page script |
| thehood.admin-notes.collapsed | Local storage | Strictly necessary | Which branches of the admin notes tree you left collapsed. Written only inside the signed-in admin panel. | Until you clear site data | Page script |
| thehood.admin-note-draft.<id> | Local storage | Strictly necessary | An unsaved admin note, so a closed tab does not lose what you were writing. Written only inside the signed-in admin panel. | Until the note is saved | Page script |
| thehood.guides.progress.v1 | Local storage | Strictly necessary | Which steps of an admin guide you have ticked off. Written only inside the signed-in admin panel. | Until you clear site data | Page script |
All seven cookies are first-party — set by this site, readable by no other site. five are marked HttpOnly, meaning no script on the page can read them, including a script somebody managed to inject. The two that are not are hood_consent and hood_ref, and neither can be: both are written by page code, which by definition can read what it writes. Nothing in either is a credential — the worst a forged referral value achieves is naming a referrer who does not exist, which is refused by name where it is used, and a forged consent value can only refuse things.
Local storage is related to cookies but is not one: it is never attached to a network request, so it is never transmitted anywhere. The three admin-panel entries exist only for signed-in members of our own admin panel and hold the working state of a tool they opened — an unsaved draft, a collapsed tree, a position in a guide. They are listed here for completeness rather than because a visitor will ever have one.
5. Reading measurement on the blog
If — and only if — you allow the Reading measurement category, then on a blog article we measure three things while you read it:
- Engaged time — how long the article is visible and you are doing something (scrolling, moving the pointer, typing). A tab left open in the background accrues nothing.
- How far you read — the deepest point of the article your screen reached.
- Whether you left almost immediately — a few seconds, without scrolling.
One message is sent when you leave the article. It contains the article’s name and those three measurements, and no identifier of any kind — no cookie, no account, no device fingerprint, nothing that links this article to the next one you read.
What we keep is a daily total per article, not a record of you. Your reading is added into counters for that article and that calendar day — how many sessions, how many fell into each time band, how many reached the end, how many left at once — and the individual measurement is not stored. There is no row anywhere with your reading on it, so there is nothing about your reading for anyone to look up, export or delete. What it is used for is ranking articles by demand, which decides which one the blog page features.
If you do not allow this category, none of it happens: no timer starts, no listener is attached, and no message is sent. Our server independently refuses a message that arrives without your consent, so a tab left open from before you changed your mind cannot report anything either.
Not running yet As of 21-09-2026, this measurement is built but switched off. The blog’s tracker is held behind a gate that has not yet been joined to the consent mechanism on this page, so allowing the category today measures nothing. When it is joined, this notice is revised and you are asked again — an earlier yes does not carry over into a measurement that was not running when you gave it.
6. Global Privacy Control, and US opt-out rights
We honour the Global Privacy Control signal. If your browser or extension sends one, we treat it as a refusal of every optional category — referral attribution, interface preferences and reading measurement — immediately, without asking. In California a GPC signal is a legally binding opt-out of the sale and sharing of personal information; we apply it everywhere and to every optional category rather than only to the ones a statute names.
You can see that we received it: open Cookies & storage in the footer and the Global Privacy Control row says Detected · honoured. If you had previously allowed something and then arrived with the signal on, the signal wins, the dialog says so and names what it switched off, and what was stored is deleted. You can still deliberately switch a category back on in that dialog — a specific choice you make there, with the signal shown as detected, is treated as your later and more specific instruction.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as the US state privacy statutes define those terms. Our rights and requests process is in section 8 of the privacy notice.
7. Tracking — what we do not do
- We run no third-party analytics — no Google Analytics, Plausible, Fathom, Vercel Analytics or hosted equivalent. The reading measurement in section 5 is our own code writing to our own database, and nothing about it leaves this site.
- We do not load advertising, retargeting or conversion pixels.
- We do not embed social widgets, chat widgets or session-replay tools. The Report a problem button is not one of those: it is our own code, it records nothing until you start it, it never captures your screen or your keystrokes, and it stores nothing on your device. See section 3 of the privacy notice.
- We do not fetch fonts, scripts or stylesheets from a third-party CDN. The interface uses the fonts already on your machine, so no request leaks your origin to a font host.
- We do not fingerprint you, and nothing we store or measure identifies you across sites, across visits, or from one article to the next.
- We do not use a consent management platform. The mechanism described on this page is our own code in this application; no third party is told what you chose, and nothing about your choice leaves your device.
8. Storage this site does not control
Your wallet extension keeps its own data — which sites it has authorised, which accounts, its own settings — under its own origin. This site cannot read it and does not set it. Manage that in the wallet, and revoke this site’s connection there if you want it gone.
Loading a project’s artwork fetches it from an IPFS gateway. The gateway may set its own cookies on its own domain, as any third-party host can, under its own policy.
9. Removing what is stored
Cookies & storage in the footer is the direct route: switching a category off deletes what it stored, on the spot. That reaches the referral cookie and the interface preferences.
To remove everything including the strictly necessary cookies, clear site data for thehood.markets in your browser’s settings, or use a private window. That also clears the record of your consent choice, so you will be asked again on your next visit — which is how you can confirm it worked.
Removing the referral cookie before you do anything else means the person whose link you followed is not credited. That is the whole of what it changes: nothing you own, owe or hold depends on it, and nothing else on this site behaves differently without it.
10. Changes to this notice
Adding anything that tracks you would be a material change. This page, the privacy notice and the on-site notice would all be updated before it took effect. Where a change alters what a category covers, your existing choice stops standing and you are asked again rather than carried over — the version recorded with your choice is what makes that possible.
11. Contact
The Hood’s contracts are immutable, audited by Claude Fable 5. Nothing on this site is financial, investment, legal or tax advice.