Privacy Policy

1. Who is responsible

This notice covers Dojo Rising, including wallet registration, gameplay and optional feedback.

Contact: support@dojorising.com

2. Data we process

Wallet address and sign-in timestamps; one-time sign-in challenge/message and session records; NFT collection/token identifiers, ownership and delegation verification data, including linked source wallet addresses; chosen profile name and NFT image; game actions, progression, missions, battle/scout reports, rankings and badges; feedback you submit; technical connection and error information needed to operate and protect the service.

Wallet addresses and NFT identifiers can link your profile to public blockchain activity. We do not request your private key or recovery phrase.

3. Why we process it

We use wallet, profile and game data to provide the game you request and check access eligibility (Article 6(1)(b) GDPR). We use security and diagnostic information to prevent abuse, fix failures and keep the service reliable, and optional feedback to improve the test (Article 6(1)(f), our legitimate interests in safe, fair and functional operation). Where a legal duty requires specific processing, Article 6(1)(c) applies.

Providing the data needed for sign-in, eligibility and game state is necessary to participate; feedback is optional. Declining optional feedback does not affect access.

4. Visibility

Other players can see your chosen name, NFT image, season points/rank, badges and game information provided by the rules, such as rival profiles and battle reports. Feedback is available to the operator and authorized support, not published as player content. Public NFT data can make a profile recognizable even when you use a nickname. Downloading a share card does not itself post it to X.

5. Service providers and blockchain

Hosting and database infrastructure is provided through Lovable and its infrastructure providers; the implementation uses Supabase for stored game data. Reown AppKit/WalletConnect supports connecting wallets and may process wallet and network/device information. Ethereum RPC services check public NFT ownership and delegate.xyz registry entries; NFT metadata and images are loaded from Chimpers infrastructure. Image hosts receive normal web request information when images load. Your wallet app is a separate provider with its own privacy notice.

Provider notices: Lovable Privacy, Lovable Subprocessors, Reown Privacy Policy, and WalletConnect Privacy Policy. These providers' notices supplement rather than replace this notice. We do not control or erase public blockchain records.

6. Cookies and device storage

The game uses necessary sign-in cookies: __Host-dojo_wallet_challenge (up to 10 minutes) and __Host-dojo_wallet (up to 7 days). Wallet connection software also uses device storage for connections and preferences. Logging out invalidates the game session. AppKit analytics is disabled in this project's configuration. This does not mean infrastructure providers receive no technical data. The footer's X link is a normal link, not an embedded X feed.

7. Keeping data

Sign-in expiry and cookie expiry are not the same as deletion of database records.

Your profile (wallet address, chosen name, saved NFT image) and your earned badges and favorite badge are kept across seasons so they remain available in later seasons. Each season's final result (rank, points and their breakdown, paths, win/loss counts and badges) is kept as part of your achievement history, together with your dojo's final development state.

Detailed gameplay logs for a season — battle, attack and scout reports and notices, mission and job records, action and resource/score event histories — and season feedback are removed from the game system at the first scheduled daily cleanup after 30 days have passed since that season ended. Point totals are kept only as season summaries. Feedback can no longer be submitted for a season after that point.

This automatic cleanup applies to the game database. Any copy kept separately (for example a manual export) is not removed by it, but remains subject to the same purpose limits, access controls and your access and deletion requests, and is not kept indefinitely. Backup retention by our hosting providers follows their own terms and has not yet been confirmed.

Provider transfer safeguards are still being finalized and have not yet been verified.

8. Your rights

Where applicable, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact the operator using the details above; proof of account control may be needed, never a recovery phrase or private key. You may complain to a data protection supervisory authority, including where you live, work or believe an infringement occurred.

9. Updates

We will update this notice when the service or its processing materially changes. You can also review the Terms of Service.