Privacy Policy

What we store

• Solana wallet addresses for every match you enter, every slab you wager, and every vault deposit. These are already public on-chain — storing them lets us render your match history and route payouts.
• Transaction signatures for entry, deposit, wager, and payout transactions. Same reasoning.
• Match outcomes + revealed commit-reveal seeds so the result of every match is auditable forever via the public /api/match/[id]/verify endpoint.
• Rate-limit identifiers — typically your IP from x-forwarded-for, hashed before storage — kept transiently in a rolling window so we can throttle abuse.

What we don't store

• No email, phone number, name, KYC documents, or any personal identifier beyond the wallet you connect with.
• No cookies for advertising or cross-site tracking. The tutorial flag and admin-token are stored in your ownbrowser's localStorage / sessionStorage and never sent to us.
• No analytics by default. If we add usage analytics later we'll list the provider here and update the effective date.

Third-party services

• Helius DAS— used to read your wallet's NFT inventory and the treasury's inventory. Your wallet address is the only data we send.
• Upstash Redis — used to store match records, vault positions, and rate-limit counters.
• Solana RPC providers — used to submit and verify on-chain transactions. RPC providers can see your wallet activity by definition of how Solana works.
• Sentry (optional, env-gated) — error monitoring. When enabled, scrubbed error reports include the URL path, error message, and (sometimes) wallet addresses that appeared in route parameters.

Your rights

You can stop using the service at any time by not connecting your wallet. Records of past matches and on-chain transactions cannot be removed because they're also on Solana's public ledger.

Contact

For privacy questions, open a GitHub issue or use the contact channel listed on the home page.