Essential Cookies

The site uses a server-side session cookie to keep you logged in after wallet signature verification, protect forms and API calls with CSRF checks, and remember temporary selections during claim, edit, and transfer flows.

This cookie is necessary for security and core functionality. It is marked HttpOnly and SameSite=Lax, and is sent over HTTPS in production.

Local Storage

Your browser may store recent editor colors, draft tile artwork, pending purchase recovery data, and the last wallet connection type. This data stays in your browser and helps restore interrupted drawing or wallet flows.

You can clear this data at any time through your browser settings.

Wallets and Blockchain Data

When you connect a wallet, Pixel Mural asks you to sign a login message and stores your wallet address in the server session. Wallet transactions are handled by your wallet provider and the blockchain network.

Tile ownership, transaction data, token metadata, and published mural content may be public on-chain or stored on distributed networks such as IPFS.

Anonymous Temporary Previews

Any visitor can draw on an unclaimed tile and save a temporary preview without a wallet or account. To enable this, the server assigns an anonymous session token stored in the server-side session. Your browser stores the essential session cookie that references this server-side session — the token itself is not stored in your browser. The token identifies which session claimed a tile and enforces the 2-hour edit lock and 24-hour expiry. It does not grant ownership and is not linked to a wallet unless you choose to connect one. No personal data is attached to the token.

Anonymous previews are publicly visible on the mural for up to 24 hours and are automatically removed when they expire or when the tile is purchased. Temporary drawings cannot include links or ownership metadata. The anonymous token is required to use this feature and cannot be opted out of while using anonymous editing.

To limit abuse, anonymous saves are rate-limited using a truncated pseudonymous hash derived from your IP address. The raw IP address is not stored by the anonymous limits system; only the short hash is retained in a short-lived rate-limit counter (approximately one minute) and may appear in security logs for abuse investigation. When a preview expires or is purchased, the preview association and active-cell slot are removed. The anonymous token itself remains in the server-side session until the session expires or you clear the site session data in your browser.

Third-Party Services

The app may interact with wallet providers, WalletConnect, blockchain RPC providers, IPFS gateways, marketplace links such as OpenSea, and URL safety services used to check submitted links. Those services may process data under their own policies when you use the related feature.

Cloudflare Turnstile. The first anonymous save on a new tile may trigger a Turnstile anti-abuse check provided by Cloudflare, Inc. Turnstile avoids a traditional image CAPTCHA but may receive your IP address and browser signals to assess whether the request comes from a human. See Cloudflare's privacy policy for details. The Turnstile challenge widget is only rendered when the backend requests it for a fresh anonymous claim; it is not rendered on other pages, for repeat saves on the same active preview, or for a temporary save made with a connected wallet.

Cookie Consent

Pixel Mural uses only essential cookies and does not set analytics or advertising cookies, so no cookie consent banner is shown. The anonymous session token described above is part of the essential session cookie and is required to use the anonymous preview feature. If non-essential analytics or marketing tools are added later, they will be loaded only after user consent where required.