THE WAITLIST · LAST UPDATED OCT 28, 2026
A little data.
Kept with care.
Here is what you share when you join PokeBloom, and what you stay in control of.
No wallet connection at signup.You connect X and paste a public EVM address. We never request your seed phrase, private key, wallet signature, token approval or payment to join the waitlist.
Your waitlist entry.
The private registration record contains:
- Your verified X account ID and username.
- Your chosen trainer name and pasted public EVM wallet address.
- Registration time, consent version and a random trainer-card identifier.
- Any optional community-task checkboxes you report as completed.
The pasted address is not verified proof of wallet ownership. Task checkboxes are self-reported; they are not verified through the X API.
Your account. Your choice.
Sign-in uses X's own authorization page with OAuth 2.0 and PKCE. The requested scopes are users.read and tweet.read; our server uses the access token to retrieve your profile from X.
The app does not request permission to post, like, follow, send messages, read your email or remain connected offline. Provider access tokens are used on the server and are not stored in waitlist records or returned to your browser.
The community links open X so you can choose what to do yourself. The share button opens a draft; it does not publish anything automatically.
A small cookie at the gate.
A short-lived HttpOnly cookie holds encrypted OAuth state and the PKCE verifier while X redirects you back. It expires after 10 minutes and is cleared after the callback. The server records a used nonce to prevent replay.
After sign-in, a signed HttpOnly session cookie remembers your verified X identity for up to 24 hours. “Disconnect X from this browser” clears that session. You can also revoke the app through X's connected-app settings.
The form may temporarily keep a trainer-name, address and task draft in this tab's session storage so an OAuth redirect does not erase your typing. A successful signup clears that draft.
Private records. Public count.
Entries are stored in private Vercel Blob storage for alpha invitation review and community planning. The public waitlist endpoint returns an aggregate registration count, without publishing names, X identities or wallet addresses.
Your trainer card displays your trainer name, X handle, random card ID and shortened wallet address. You decide whether to download or share it. X and Vercel also process requests under their own service policies.
Ask us to remove it.
Records are retained for invitation review and community planning. To request removal, contact @PokeBloomFarm through the X account used to register. We may confirm account ownership before removing an entry. Do not send a private key or seed phrase.
Joining the list does not guarantee an invitation. Approved-wallet playtests will open later and use a separate wallet sign-in. Your X waitlist session does not grant game access.