We collect as little as possible, keep it for as short as possible, and don't sell or share it with anyone — except law enforcement, when legally required or when the content involves CSAM or credible threats of violence, in which case we will forward it.

> we built this place around anonymity. we mean it.

IP Addresses

Your IP address is logged with every post you make. This is a standard moderation tool — it allows administrators to identify and ban bad actors. It is not linked to your wallet address, your JWT session token, or your posting identity in any persistent way. We cannot connect an IP address to a wallet. We don't try to.

Wallet Addresses

Your wallet address is used once at the start of a session to verify that your on-chain balance meets the posting threshold. It is not stored. After verification, a session token is issued and your wallet address is discarded. No record of which wallet address verified at what time is retained.

Session Tokens (JWT)

After successful verification, your browser receives a signed session token stored as a cookie (whale_token). This token encodes your verified tier and an expiry timestamp — nothing else. It expires after 24 hours, at which point your wallet is re-checked. The token is never transmitted to third parties.

Cookies

We set the following cookies:

• whale_token — your 24-hour verification session. Contains tier level and expiry. No personal data.
• captchaid / bypass — anti-spam tokens so you're not challenged on every post. Contain no personal data.

No analytics cookies. No tracking pixels. No third-party cookies.

Post Content

Everything you post is public and stored indefinitely unless deleted by a moderator or by you. Anonymous posts are anonymous — there is no account system linking posts to an identity. Treat public posts as permanent.

WhaleChan operates under Icelandic law. We do not respond to foreign government requests, DMCA takedowns, or informal legal threats from outside Iceland. We will not hand over user data on the basis of a strongly-worded email.

The exceptions are absolute:

• CSAM — any child sexual abuse material posted to WhaleChan will result in an immediate permanent ban. All available data associated with the post will be forwarded to Icelandic authorities and relevant international agencies (NCMEC, IWF) without delay and without notice to the poster.
• Credible threats of violence — specific, credible threats directed at identifiable individuals will be treated the same way. Data will be forwarded to law enforcement.
• Valid Icelandic court orders — we comply with lawful orders from Icelandic courts. We will notify affected users where legally permitted to do so.

> everything else: no.

WhaleChan operates within the European Economic Area. Under GDPR you have the right to:

• Request what personal data we hold about you
• Request deletion of your personal data
• Object to processing
• Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd)

In practice, the only personal data we hold that is linkable to you is your IP address, and only for up to 7 days under normal circumstances. Anonymous posts cannot be linked back to you by us or anyone else — by design.

To exercise your rights, contact us at admin@whalechan.biz.

If this policy changes materially, we'll post an announcement on the site. Continuing to use WhaleChan after a policy change constitutes acceptance of the updated terms. We don't anticipate changing much — this policy was written to be permanent, not to be a moving target.

Last updated: March 2026. Governing law: Iceland. Operator: WhaleChan administration — admin@whalechan.biz.