Privacy
What this course collects, why it collects it, who else handles it, and how to get a copy or have it deleted. Written in plain language and checked against the code that runs the product.
Who runs this
The Tokenomics.net Data Room Course is operated by Moonbound Consulting, LLC, an Illinois limited liability company doing business as Tokenomics.net. In this policy, that is “we” and “us.”
- Email: tony@tokenomics.net
- Mailing address:
333 W. Wacker Dr.
Suite 2600
Chicago, IL 60606
The short version
The course is free and there is no payment information involved. To take it you give us an email address, and we record how far through the course you have got. Everything beyond that is something you choose to do: claim a certificate, put a name on it, publish a founder data room, or paste us a link to a post you made. None of it is sold, and none of it goes to an advertising network.
What we collect
Held in our database for as long as your account exists:
- Your email address. You give it at sign-in. It is the only thing the course requires.
- Your progress. Which lessons you have opened and completed, how far into a lesson video you got in seconds, which course assets you have opened, and which page of a PDF you were last on. This is what makes the resume button work.
- Your consent record. Your email address, the version of the terms you accepted, whether you opted in to course email, when you first accepted and when you last confirmed.
- Your challenge and sharing state. Whether you followed us, whether you shared, which platform you picked, and the link to the post if you paste one back to us. A link you submit is read by our team.
- Your certificate, if you claim one. The credential id, whether it is public or private, the date it was issued and claimed, how many modules you finished, and the display name you chose. We also keep the history of any changes you make to that name.
- Your founder data room, if you publish one. Covered in its own section below.
What we do not collect
- No password. The product has no password field and stores no password for your account.
- No payment details. The course is free and there is no checkout.
- No name or photograph unless you type one in yourself, on a certificate or in a founder data room.
- No advertising or cross-site tracking cookies, and no data sold or shared with an advertising network.
How signing in works
You enter your email address and we send you a six-digit code. The code is valid for ten minutes. We store a hash of it, never the code itself, and the comparison runs in constant time so a wrong guess gives nothing away. Sign-in requests and code attempts are rate limited by email address and by network address, which is what stops somebody working through codes or using the form to mail strangers.
Once you are in, your session lives in our database and your browser holds a session cookie for it. A session lasts up to thirty days.
Cookies and similar storage
The product sets these itself:
- A session cookie once you sign in, so you stay signed in.
- A short-lived signed cookie during sign-in, which carries the attempt from the email form to the code screen. It matches the ten-minute code lifetime.
- An unlock cookie if you enter the password for a password-protected founder data room. It lasts twelve hours and applies to that room.
- Browser storage on your own device for two conveniences: remembering that you already accepted the terms on that device, and remembering that you have already opened your first lesson or asset in this browsing session. Neither leaves your browser.
Google Analytics sets its own cookies, and playing a lesson video sets YouTube cookies. Both are covered below.
Email is sent through Resend. There are three kinds:
- Sign-in codes. Sent because you asked for one. These carry no unsubscribe link, because turning them off would lock you out of your own account.
- A one-time welcome email the first time you sign in. It carries a one-click unsubscribe link and our postal address, the same as our course email.
- Course email. When you accept at sign-in you agree to receive email from us about the course, and your address is added to our course mailing list at Resend. Every one of those carries a one-click unsubscribe link, and it takes effect immediately.
Unsubscribing from course email does not close your account or stop your sign-in codes.
Analytics
The course uses Google Analytics 4. It records page views and a defined list of product events: sign-in requests and failures, lesson views and completions, module completions, asset opens, downloads and failed downloads, searches within the course, share and follow clicks, challenge milestones, certificate claims, verification-page views and downloads, and clicks on the discovery-call link.
Every event in the product goes through one module, and that module is the enforcement, not a promise in a policy. It never sends:
- your email address, raw or hashed;
- a user id or a session id;
- a certificate id, because the verification page shows a name beside it;
- anything you typed: no search text, no share text, no lesson titles, no names.
The certificate verification page reports itself to Google Analytics under a masked path, never its real address, so the page a named person is on is not sent either. Searches report only whether there were results and how many, never the query.
Founder data rooms
A student can build and publish a founder data room: a page about their own project, under a slug they choose, on this site. It is public by design. Some of it is meant to be found by search engines, and a published page can be indexed once it meets a minimum bar of content and age.
What you put in it, all of it supplied by you:
- Project name, a one-line description, an intro, a logo and a website link.
- Up to seven document slots, each holding a title, a summary, a date and a link, plus up to two supporting links, and up to six appendix links.
- Funding stage and token details: ticker, chain, total supply and launch status.
- Social links, and an optional contact email address or contact URL that appears on the page.
- Up to six team members, each with a name, title, short bio, photograph, social links and an optional contact email address.
Photographs and logos. Images upload to Vercel Blob as private objects. They are never served from a public storage URL and can only be reached through this site, which re-checks the page rule on every request. Every image is re-encoded when you upload it, which drops the original file’s embedded metadata, including EXIF and any GPS coordinates a phone put in it.
Documents are links, not uploads. You host them. We check on a schedule that each link still resolves and record the result, so a broken document can be flagged back to you.
An optional room password. If you set one, it is encrypted before it is stored and is never held in plain text. Unlock attempts are logged with the room slug and whether the attempt succeeded, together with the network address when the request arrives through our own proxy.
Reports. Anyone can report a published page. We record the reason, any detail written, the reporter’s email address if they give one, and a hashed network address. Moderation decisions are recorded with a reason and the operator who made them, and are kept on the page’s record.
Certificates
Finishing the course lets you claim a certificate. A private certificate carries no name. If you make it public, it gets a page at a public web address that shows the display name you chose, the credential id, the date and a QR code that resolves back to that same address. That page is meant to be shared and is open to search engines.
You can change the name on it, and you can revoke it at any time, which makes it private and stops it being indexed. A revoked certificate and an id that never existed look identical to a stranger, so nobody can use the page to test whether a given person holds one.
Who else handles your data
These are the companies genuinely in the path, and what each one sees:
- Neon hosts the Postgres database, which holds everything in the sections above.
- Vercel hosts the application and its server logs, and Vercel Blob stores the course files and the images uploaded to founder pages.
- Upstash holds the rate-limit counters. The keys carry a hashed email address or a network address, never a readable email address.
- Resend sends the email and holds your address on the course mailing list.
- Google Analytics receives the events described above, with no personal identifier attached.
- YouTube serves the lesson videos. Playing one loads a YouTube player, which sets YouTube cookies and lets YouTube see your network address.
- Google Drive and Google Docs host some of the course templates as copyable documents. Opening one sends you to Google, where Google’s own terms and privacy policy apply to what you do there.
We do not sell your data, and we do not share it with anyone outside this list except where the law requires it.
Where your data is processed
Every company above is based in the United States, and your data is processed there and potentially in other countries those companies operate in. If you are outside the United States, using the course means your data is handled there.
How long we keep it
We would rather state this exactly than round it into a promise we do not keep:
- Your account, email address, progress and certificate are kept indefinitely. There is no automatic expiry today. They are deleted when you ask us to delete them.
- A founder page you delete is held for thirty days so you can undo it. After that the undo is gone and the uploaded images are deleted permanently.
- A photograph you upload but never save onto a team member is deleted after a day.
- A slug stays reserved for twelve months after a page using it is deleted, so the address cannot immediately be taken by someone else.
- Sessions expire after thirty days. Sign-in codes expire after ten minutes. Rate-limit counters expire on their own windows, which run from ten minutes to an hour.
- Moderation records are kept on a page that was reported or removed, including after removal, because an operator reviewing a decision needs the evidence for it.
Your choices
- Change or remove the name printed on your certificate, at any time.
- Revoke a public certificate, which makes it private again.
- Unpublish or delete your founder data room, with thirty days to change your mind.
- Unsubscribe from course email using the link in any of them.
- Ask us for a copy of what we hold on you, or ask us to delete it, by emailing tony@tokenomics.net. There is no self-serve delete button in the product yet, so email is the way to do it, and we will confirm when it is done.
Privacy law and your rights
We handle a request for access or deletion the same way whoever you are and wherever you are, so you do not need to establish that a particular law covers you before asking.
On whether specific regimes apply to us, we would rather be accurate than reassuring. We have not established that this product falls under the UK or EU GDPR, which would turn on whether we offer the course to people there in a targeted way or monitor their behavior there. We have not established that it falls under the California Consumer Privacy Act, which turns on revenue and data-volume thresholds. We are not claiming either one applies, and we are not claiming it does not. If you want to know where you stand, ask us and we will tell you what we know.
Age
The course is built for founders and is meant for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.
Security
Sign-in codes are stored hashed and compared in constant time. Sign-in, certificate lookups, uploads and room unlocks are all rate limited. Course files and uploaded images are stored as private objects and are only reachable through a request this site authorizes. Room passwords are encrypted at rest. The site runs a content security policy that restricts what code a page may load. No system is perfectly secure, and we are not going to tell you otherwise.
Changes to this policy
We will update this page when the product changes and move the effective date at the top. If a change is significant we will say so where you can see it rather than leaving you to notice.
Contact
Email tony@tokenomics.net with any question about this policy, to ask for a copy of your data, or to have it deleted. The terms of use cover how the course itself works.