YOUR ACCOUNT. YOUR CHOICES.

Third-party inventory

Rebuild review draft. This inventory describes the inspected source, not every resource a host, extension, deployment or separate product could inject. Remaining external dependencies are release-review items.

Local browser libraries

Phaser 3.55.2 runs Dodge the Dip. JSZip 3.10.1 creates local NFT-builder archives. Both now load from this site, with version hashes and license notices retained. Local hosting does not mean the libraries have no security risk.

Fonts and styles still external

Google Fonts: Bungee (400) and Inter (400, 600, 700, 800, 900), served through fonts.googleapis.com and fonts.gstatic.com. Several original branded pages request them on page load. The new privacy, age, terms and help pages use system fonts.

Tailwind browser CDN: cdn.tailwindcss.com remains on the older pages listed below. It executes third-party JavaScript before wallet login. Replace it with a pinned, compiled local stylesheet before release. Do not confuse a styling dependency with permission to add tracking.

Tracking

The two source-installed Google Analytics tags have been removed. No new advertising, session replay, chat recorder or analytics service was added. New optional tracking must not start until its purpose and consent requirements are reviewed, and sensitive input fields must never be captured.

Connected service requests

Wallet signing uses Xaman; wallet and transaction checks use configured XRPL nodes (the funding page names xrplcluster.com and xrpl.ws). Explicit sharing opens X; configured backend notifications may use X or Telegram. The separate Wallet Brain and Funding Bot products require their own inventories. Ordinary outbound links are different from automatically loaded scripts.

LOLcals Pass launch pages

The redesigned home, tokenomics and transparency pages use local styles, local scripts, system fonts and original XRPLOL assets. The muted gameplay preview autoplays when visible unless the device requests reduced motion. There is no analytics or session-replay installation on those pages.

The public token snapshot is collected server-side from XRPL Cluster or Ripple mainnet servers. Indicative XRP/USD pricing is fetched server-side from Coinbase’s public spot endpoint. Your browser receives the shared snapshot from XRPLOL; it does not send a visitor’s wallet to those providers for this display. The shared account bar still uses XRPLOL’s existing session endpoints.

Other pages retain the declarations listed below. Adding common navigation does not remove their existing fonts or scripts. Funding-bot files were not modified in this pass.

Remaining source declarations

This is a per-page list, including repeated families and connection hints. Dynamic requests and hosting behavior still need a browser network review.