Privacy and the rules
WHAT WE KEEP,
AND WHY.
Applying for the list asks for a few things. This page says what they are, what we do with them, who else sees any of it, and the rules the list runs on. There is no analytics, no advertising and nothing sold.
01 — what is collected
WHAT YOU GIVE US.
| What | Why | How it is kept |
|---|---|---|
| Your X account | Sign-in with X tells us your account id and your handle. That is all we ask X for: we do not read your profile, your followers, your posts or your messages, we cannot post for you, and we do not keep the access X gives us. The age of the account is worked out from its id. | The id as a one-way fingerprint; the handle encrypted. |
| Your answers | The two written answers, how you found us, and the handle of whoever sent you if you name one. This is what a reviewer reads. | Encrypted. |
| Your Zcash address | Where your ZWOOD is delivered. It is opened only for someone on the list, only to deliver, and every opening is recorded with who opened it. | Encrypted. |
| The tasks you ticked | Follow, like, repost, comment, and the two optional ones. They are taken at your word; nothing checks them with X. | As ticked. |
| GitHub, if you link it | Optional. Your GitHub account id and login, to show a reviewer that the account is yours. | The id as a one-way fingerprint; the login encrypted. |
| Your network address | To limit how often one network can try, and to tell a reviewer when many applications came from one network in an hour. | The limits are held in memory for an hour. What is stored is a keyed fingerprint of the network, not the address. |
| How the form was filled in | How long it took, how many characters were typed against how long the answers are, and how many corrections were made. Not what was typed, and not the keys. It becomes a hint for the reviewer; on its own it refuses nobody. | Only the hint is stored. |
| What reviewers decide | Each decision, who made it and any note they wrote. | As written. |
Your status page shows you your own application: your handle, your record code, whether you are on the list, the delivery address and changes to it, and your nomination. It does not show your answers back or anything a reviewer wrote.
02 — in your browser
COOKIES, AND ONLY THESE.
Every cookie here is for signing in and keeping your place in the form. None of them tracks you across other sites, and none is readable by the page's scripts.
| Name | What it holds | For how long |
|---|---|---|
| zw_xpending | The unfinished sign-in with X, encrypted. | 10 minutes |
| zw_xid | Who you signed in as (id and handle), encrypted. | 1 hour |
| zw_xtasks | The tasks you ticked, encrypted. | 30 days |
| zacc | Your status-page session: a fingerprint of your X id and your handle, signed so it cannot be altered. | 12 hours |
| zw_ghpending | The unfinished GitHub link, encrypted. | 10 minutes |
| zw_gh | Your linked GitHub account, encrypted. | 30 days |
Signing out clears the sign-in cookies; unlinking GitHub clears its two. The page also remembers the sound setting and whether you have seen the intro, in your browser's own storage. Cloudflare, which carries the site and runs the check that you are a person, may set cookies of its own for that check.
03 — who else sees it
THREE OTHERS, FOR ONE THING EACH.
| Who | What for | What they receive |
|---|---|---|
| Cloudflare | Carries the site; checks that the form is sent by a person (Turnstile); stores the encrypted copy that protects the applications from a failed disk. | Your requests as they pass; for the check, its token and your network address; for the copy, the stored records, encrypted where this page says encrypted. |
| X | Sign-in. | The sign-in itself, on X's own page. |
| GitHub | Only if you link it. | The link itself, on GitHub's own page. |
The fonts, the pictures and every script are served from this site. Nothing on these pages loads from an advertiser, an analytics service or a font service.
04 — how long
FOR THE LIST, AND THE ROUND.
Applications are kept for as long as the list and the round it leads to are running. The record is written once and added to, never edited, so that no decision can be changed without a trace; if you want your application withdrawn, ask @zwoodnft on X and it is taken out of the list. The server's own logs (the address a request came from, the page, the answer, the country) are kept for two weeks for security, and do not include what was sent.
05 — the rules of the list
HOW THE LIST WORKS.
- Applying costs nothing and asks for nothing to be bought.
- One application per person, on an X account at least ninety days old. A second application from the same X account, GitHub account or address is refused.
- People decide. Reviewers read every application and decide who is on the list. The only automatic refusals are the ones above and a failed check that you are a person.
- A place is tied to the X account that applied. It is not transferable and cannot be sold.
- Nominations. A member placed on the list by review may name one person, once. The name is locked when it is given. If that person applies, they are on the list; if the member who named them loses their place, so does the person they named.
- A place can be taken back for duplicate accounts, automated applications or answers that are not the applicant's own.
- The list decides who can take part in the round; it is not a promise of a ZWOOD, or of a return. Nothing on this site is financial advice.
- The list closes in stages: open, then closed with extra time for people who were nominated, then locked, after which nothing changes. Each stage is announced on @zwoodnft.
Questions go to @zwoodnft on X.
back into the trees