Launch a token

Updated September 18, 2026

Privacy policy

hoodlums.wtf has no accounts and never asks for your name, email or phone number. This page covers the little information that does pass through the site. The rules for using it are in the terms of use.

What we don't collect

  • No accounts, passwords, names, emails or phone numbers.
  • No seed phrases, and none of your private keys on our servers. A launch wallet's key never leaves your browser. The only keys we hold belong to the wallets the volume bot creates for its runs, described below.
  • No advertising pixels or cookies.

Visit counts

We count page views with Vercel Web Analytics to see which pages people use. It sets no cookies and doesn't identify you. Each page view records the page address, the site you came from, your approximate location (country, region and city), and your browser, operating system and device type. Visits are grouped using a hash of your request, which Vercel discards after 24 hours.

We also use Umami to count visitors, see which sites send them and see how people use the site. It sets no cookies. Each page view sends Umami the page address and title, the site you came from, your screen size and your language, and Umami works out your approximate location, browser, operating system and device type from the request. It tells returning visitors apart with a one-way hash of your IP address and browser that it resets regularly, and it doesn't store your IP address.

The site also sends Umami an event for each of these, so we can see how people move through it:

  • A button, link or checkbox you click: its label, which part of the page it's in, where a link leads, whether a checkbox is now ticked, and for a few choices, like a pair asset or a volume bot run length, the one you picked.
  • Starting a launch, with its pair asset, whether it's a vamp, has a dev buy or starts the volume bot, and whether it comes from a launch wallet. Then whether it launched, or the error shown if it didn't. The launcher also sends one when it tells you your wallet needs more ETH to launch.
  • Starting a volume bot run, or the error shown if it doesn't start.
  • Creating or importing a launch wallet, and the first time this browser sees one of your launch wallets hold ETH.
  • Opening a referral link, with the referrer's handle, and signing up for referrals.

Wallet addresses, transaction hashes and amounts are masked out of labels, links and errors before they're sent. Umami never sees what you type, your wallet or your keys.

Your wallet address

When you connect a wallet, the site sees its public address. The launcher uses it to check that the wallet can launch, read its balance and prepare your transactions.

To show deploys, our database keeps an index of every Pons V2 deploy on Robinhood Chain, and of every Flap launch on BNB Chain since September 13, 2026, copied from public blockchain data. That includes each deployer's wallet address, so My deploys can look up yours. On Arc it keeps only launches made with hoodlums.wtf.

My deploys also sends your address to our server to look up the creator fees Pons holds for it. That lookup only reads public blockchain data, and we don't store it. Send, on the wallets page, looks up the wallet you send from in the same deploy index, to list the tokens it launched.

When you pay the hoodlums fee and launch, your browser sends the two transaction hashes to our server. The server checks them on-chain, then records the payment (your wallet address, the amount and the time) and the token it paid for. That's how your token appears on Deploys, and how a fee paid without a launch can be refunded.

The volume bot

When you start a volume bot run, our server keeps a record of it: the token, the launch wallet address the run was started from (where its funds go back to), the budget, fee and run length, the run's progress, and the hash, type and amount of every transaction the bot sends for it. Runs, like the transactions themselves, are tied to your wallet address, and the run page shows them to anyone who has its link.

The bot trades from wallets our server creates for each run. Their private keys are encrypted and kept in our database, and only the bot's worker can unlock them. They're never your keys, and we don't need or ask for yours.

Your browser keeps a secret for each run you start, in local storage, so that it can stop the run early. Our server stores only a hash of it.

Referrals

If you sign up for the referral program, our server stores your handle, your referral wallet's address and when you signed up, and shows the handle, the address and what it has earned to anyone who looks the handle up. The wallet's private key stays in your browser, like any launch wallet's. Your browser also remembers your handle in local storage, so the referrals page can show your link.

If you open a referral link, your browser keeps the referrer's handle and wallet address in local storage, with the time you opened it. For 30 days, a launch or volume bot run you pay for sends 20% of its fee to that wallet. For a launch, your browser sends that transaction's hash to our server along with the fee's, and the server checks it on-chain and records the payment: your wallet address, the referrer, the amount and the time. For a volume bot run, the run's record includes the referrer. The Vamp extension copies the referral from hoodlums.wtf, so vamps pay it too.

Logos you upload

When you add a logo, the file passes through our server to Pinata, which publishes it to IPFS, a public file network. We don't keep a copy. The file is public as soon as it uploads, even if you don't finish launching, and once your token launches its logo link is stored on-chain for good.

On Arc through o1, our server also publishes your token's profile to IPFS through Pinata: its name, ticker, description, logo link and social links. On BNB Chain, your logo passes through our server to Flap's upload service together with your token's description, social links and your wallet address, which Flap records as the token's creator. Flap publishes them to IPFS, where they're public as soon as they upload. When you vamp a Flap token, our server fetches the original's logo from an IPFS gateway, Flap's or Pinata's, to publish it with your details. We don't keep a copy.

On Solana, our server publishes your coin's metadata to IPFS through Pinata: its name, ticker, description, logo link and social links. When you vamp a pump.fun or stonk.fun coin, our server reads the original's metadata from Filebase's or Pinata's IPFS gateway, or from the site hosting it.

Public blockchain data

Fee payments and launches are Robinhood Chain, Arc, BNB Chain or Solana transactions. Your wallet address, your token's details and the amounts you pay are public and permanent, and anyone can see them on a block explorer.

Stored in your browser

Your browser keeps a little data in local storage so your wallet reconnects when you come back, the wallet list remembers the one you used last and when you picked it, and you can stop volume bot runs you started. It also lists the launch wallets that have held ETH, so Umami counts each one as funded only once. Clearing your site data removes it.

Launch wallets

If you create or import a launch wallet, its private key is encrypted and saved in this browser: the encrypted key in local storage, and the key that unlocks it in the browser's IndexedDB. It signs your transactions right there and is never sent to our servers, so we can't see, use or recover it. Clearing your site data deletes it.

The Hoodlums Vamp extension

The Chrome extension adds a Vamp button to token cards on axiom.trade, for Robinhood Chain, Arc and BNB Chain tokens and for Solana coins. It has no accounts and no analytics.

  • When you connect it, it copies your wallets from hoodlums.wtf in the same browser — both your launch wallets and your Solana wallets, private keys included — into its own storage, encrypted under a key only that browser has. It keeps that copy in step with the site, deleting any wallet you archive or delete there, and keeps the same wallet selected in both, for each list: whichever you picked last, on the site or in the extension. To tell which was last, each records the time of your pick in this browser. None of this is sent anywhere. Disconnecting in the extension, or uninstalling it, deletes it.
  • On axiom.trade it reads the token card or token page you vamp from: the contract address, which it gets from the page's URL or by pressing the card's own copy button without touching your clipboard, and the ticker the card shows, to check it's the token on screen. It doesn't send what it reads to us or keep a record of the pages you visit.
  • To show balances and vamp, it reads Robinhood Chain, Arc, BNB Chain and Solana and sends your signed transactions through each chain's RPC providers listed below, which can see your IP address and wallet address. Like the launcher, it sends the fee and launch transaction hashes to our server to record the deploy, and asks our server for a transaction's receipt when the RPCs can't answer.
  • When you vamp a BNB Chain token, it asks our server for the original token's metadata and for a ready token address. When you confirm, it sends our server the original's logo address on IPFS, your copy's description and social links, and your wallet address, which our server passes to Flap to publish, as described under Logos you upload.

Services involved

  • Robinhood Chain RPC providers: your browser reads the chain, and sends launch wallet transactions, through whichever of Robinhood Chain's public RPC, PublicNode, Blockmachine and Pocket Network is answering fastest. On pages that show your wallet it checks all four every few seconds, so each can see your IP address, and the one in use sees the wallet addresses it looks up and the transactions it sends.
  • Arc RPC providers: on the Arc launchers and in the Vamp extension, your browser reads Arc, and sends launch wallet transactions, through whichever of Arc's public RPC, QuickNode, dRPC, Blockdaemon and PublicNode is answering fastest. It checks them every few seconds while it makes requests, so each can see your IP address, and the one in use sees the wallet addresses it looks up and the transactions it sends.
  • BNB Chain RPC providers: on the BNB Chain launcher and in the Vamp extension, your browser reads BNB Chain, and sends launch wallet transactions, through whichever of PublicNode, BNB Chain's own RPC, BlockRazor, Blockmachine and 1RPC is answering fastest, with the same checks.
  • Solana RPC providers: on the Solana launcher, the wallets page and in the Vamp extension, your browser reads Solana, simulates launches and sends Solana wallet transactions through PublicNode, or Solana Vibe Station or LeoRPC when it doesn't answer, so the one in use can see your IP address, the wallet addresses it looks up and the transactions it sends. Filebase's IPFS gateway serves the pump.fun coin logos the site displays.
  • Pinata: publishes uploaded logos to IPFS and serves the token logos the site displays, so it can see your IP address when those images load.
  • Flap: publishes BNB Chain launches' logos and metadata to IPFS when our server sends them, and its IPFS gateway serves the Flap token logos the site displays, so it can see your IP address when those images load.
  • Your wallet app handles the connection under its own privacy policy, and so does WalletConnect if you connect through it.
  • Railway: hosts our database of deploys, fee payments and volume bot runs, and runs the volume bot itself, which reads Robinhood Chain and sends the bot's transactions through an RPC provider.
  • Vercel: hosts the site and may keep standard server logs, such as IP addresses, request times and error details, to run and secure it. It also counts page views, as described under Visit counts.
  • Umami: counts visits and events, as described under Visit counts. Your browser sends each page view and event to Umami, so it can see your IP address.
  • YouTube: the video in our launch guide loads nothing from YouTube until you press play. It then plays from youtube-nocookie.com, YouTube's privacy-enhanced mode, which can see your IP address and handles the video under Google's privacy policy.

Contact

Questions about this policy or your data go to @erenyaegart on Telegram. Telegram handles those messages under its own privacy policy.

Changes to this policy

If what the site collects changes, we'll update this page before that change goes live. The date at the top shows the latest version.