Mesa reads public Robinhood Chain records such as wallet addresses, launches, swaps, hook configuration, fee credits and claims. That information is already public and can be copied or indexed by anyone. Disconnecting a wallet or deleting Mesa profile metadata cannot remove a blockchain record.
We use wallet addresses to render the product and to prove ownership. We do not ask for seed phrases or private keys. A wallet signature can authenticate a Mesa profile or approve a transaction, but Mesa never signs on your behalf.
Never enter a seed phrase or private key into Mesa.
If you create a Mesa profile, we store the display name, bio, avatar reference and wallet address you choose to publish. Public Mesa profile fields are visible to anyone. Private session and provider identifiers are kept out of the public response.
Linking X confirms control of an X account at that moment. Supabase's X provider requests users.read, tweet.read, users.email andoffline.access. X and Supabase Auth process the OAuth authorization, and Supabase Auth stores the linked identity metadata, which can include an email address. Provider access or refresh tokens can be returned in the browser auth session; Supabase documents that it does not intentionally store those provider tokens in the project database.
Mesa copies the stable X account ID, username, display name and avatar URL into the private Mesa profile record. Mesa's server-mediated public Mesa profile response exposes only the linked username and display name; the stable ID, email, avatar URL, exact link time and OAuth credentials stay private. Mesa does not persist provider tokens in its Mesa profile tables, send them to analytics, or use the permission to post.
Unlinking X removes the linked identity from the Mesa auth account and immediately clears the X fields Mesa exposes. A linked account is provenance, not identity verification, KYC, endorsement or a quality guarantee.
V2 Launch Boost and Lock Rewards are source-ready candidates, not deployed features. No complete schema-3 V2 manifest is checked in, so V2 reads and writes remain closed. If released, their contract records will be public and permanent. If V2 is released, anyone could associate a wallet with lock principal, term tier, effective weight, activation and expiry epochs, boosted launch, paid placement score, fee routing, claims, withdrawals and transaction timing. If V2 is released, a creator's Boost would also publicly link the creator wallet to the launch the supported launchpad records for it.
Separately, the superseded V1 contracts and one deployed historical one-MESA lock position are public and permanent. Mesa exposes that exact position for verified recovery-only actions: checkpoint, any actually settled claim and matured withdrawal. There are no new V1 locks, permits, approvals, extensions, Boosts or paid-placement writes. Disconnecting the wallet or deleting offchain profile data cannot erase those records.
The V2 paid Boosted rail uses only the minimum public contract and launch metadata needed to explain placement. If V2 is released, it would not require a legal name or private profile field. If V2 is released, disconnecting a wallet, withdrawing after unlock or asking Mesa to delete offchain profile data would not erase those onchain position and payment records.
Mesa uses Vercel Web Analytics for aggregate page measurement, Vercel Speed Insights for route-level Core Web Vitals, and small allowlisted sets of profile and utility lifecycle events such as started, submitted, completed or failed. Utility events may carry only the surface, disclosed term tier, action stage and a coarse error category. EVM addresses in telemetry URLs are replaced with a generic address marker before an event is sent. We do not attach wallet addresses, balances, signatures, calldata, holdings, Lock Rewards principal, Boost amounts or scores, Mesa profile-form content or OAuth credentials to those events.
If error monitoring or product analytics is expanded, sensitive wallet and RPC payloads must remain scrubbed and session replay must mask Mesa profile inputs by default. This page will be updated before a material change is enabled.
You can disconnect your wallet at any time. Mesa profile owners can edit public metadata, unlink X, and request deletion of offchain Mesa profile data. Security, abuse-prevention and audit records may be retained for the minimum period needed to protect the service.
Onchain transactions, IPFS content, explorer copies and third-party caches are outside Mesa's ability to erase. Before publishing, assume public content may be permanent.
For a privacy or deletion request, contact the official Mesa account at @usemesa_ on X. We may ask you to sign a fresh, domain-bound message to prove control of the relevant wallet before changing its Mesa profile data.
