PRIVACY POLICY

MAD LABS is operated by David Milovanovic, Switzerland. Contact: alpha@madlabs.world.

MAD LABS is an unofficial Mad Lads community experiment. It is not affiliated with, or endorsed by, Mad Lads or Backpack.

• MAD LABS reads public Solana blockchain data. It never asks for transactions, token transfers, spending permissions, private keys or seed phrases.
• You can use MAD LABS without an account. Your Lab then lives only in your browser.
• If you verify a wallet, a small set of MY LAB data is stored on our server so you can recover it on other devices — and you can export or delete it at any time.
• No analytics, no tracking, no advertising, no profiling.

When you enter a wallet address or open a Lad, our server asks Solana data providers (Shyft and Helius) for public on-chain information: which Mad Lads a wallet holds, their metadata and traits, and public transfer and sale history. Wallet addresses and token addresses are public identifiers on the Solana blockchain. To limit provider requests, our server caches these public results for a while.

Passports, Squads and Clashes are computed from that public data. They are entertainment, not an assessment of any person, and not financial advice.

Verifying is optional. To prove you control a wallet, your wallet asks you to sign a message — using Sign In With Solana where your wallet supports it, otherwise a plain signed message. The message names this site (madlabs.world), your wallet address, a one-time random value and a short validity window.

Signing a message is not a transaction: it cannot move funds and grants no permissions. Our server only checks the signature against your public address. We do not store the signature or the message.

MAD LABS uses two technically necessary cookies, both only for verification, and no other cookies:

• madlab_chal — holds the one-time verification challenge for about 2 minutes while you sign (HttpOnly, Secure, SameSite=Strict, only sent to /api/auth). It is removed after every attempt.
• madlab_session — keeps you verified for up to 7 days. It contains your wallet address and an expiry, protected against tampering (HttpOnly, Secure, SameSite=Strict). DISCONNECT removes it.

Because there are no analytics, advertising or tracking cookies, MAD LABS does not show a cookie banner.

MY LAB is local-first. Without any server involvement, your browser keeps: the Lads you have discovered (IndexedDB database madlab-lab), recent wallet scans and recent experiments, your theme choice, a note whether cloud sync is enabled for your verified wallet, and a note that this browser has verified before (localStorage). You can remove all MY LAB data in this browser with CLEAR LAB DATA on MY LAB, or by clearing site data in your browser.

After you verify, MY LAB can keep a copy of your Lab on our server so it follows you to other browsers and devices. Lab history that already exists in a browser is only uploaded after you choose to add it. The server stores exactly:

• your wallet address, and when your Lab record was created and last updated;
• for each discovered Lad: its token address (mint), Lad number, species, class (Lad/Lassie), its short hook line, and when you first and last saw it;
• for each experiment (Clash): the participating token addresses and Lad numbers, the Clash label, the engine version that produced it, and when it happened.

It does not store Madness scores, holding times, ownership history, artwork, raw traits, prices, cost basis or profit/loss, biographies, transaction history, signatures, verification challenges, session cookies, IP addresses, private keys or seed phrases.

This data is kept in a Postgres database operated by Neon in Frankfurt, Germany, until you delete it.

• EXPORT MY LAB DATA on MY LAB downloads everything stored on the server for your verified wallet as a JSON file.
• DELETE MY LAB DATA removes all of it from the server. Your browser keeps its local copy until you clear it; disconnecting does not delete server data.
• Public blockchain records (ownership, transfers, sales) are not created or controlled by MAD LABS and cannot be deleted by us.

• Vercel hosts the site; its servers process your requests (including your IP address in standard request logs). Server functions run in Washington, D.C., USA.
• Neon hosts the MY LAB database (Frankfurt, Germany) — only for verified cloud sync.
• Shyft and Helius provide public Solana data. Our server sends them wallet and token addresses — never your IP address, cookies or MY LAB data.
• Mad Lads artwork is loaded from its public image host (Amazon S3); some images load directly in your browser, so that host sees your IP address like any website you visit.
• Wallet apps (for example Backpack or Phantom) handle signing under their own terms. On mobile, MAD LABS can hand you over to a wallet app's built-in browser.
• X, Tensor and Solscan are only contacted if you click a share or external link; their own policies apply.

Some providers are located outside Switzerland and the EU, in particular in the USA.

To prevent abuse, some endpoints limit how often they can be called. The limiter keeps a shortened one-way hash of your IP address in server memory for about a minute; it is not written to a database.

Depending on the law that applies to you (for example the Swiss Federal Act on Data Protection or the EU GDPR), you can request information about, correction of or deletion of your personal data, object to processing, and complain to a data protection authority. Most MY LAB data you can export and delete yourself; for anything else, contact alpha@madlabs.world.

If MAD LABS starts processing data differently, this page will be updated before the change goes live.