Privacy Policy
This Privacy Policy explains how AgentFi Realm ("we", "the operators") handles information when you interact with the Service. We aim to minimize data collection to what is strictly required to operate the game.
1. What we collect
- On-chain data — wallet addresses, transaction hashes, contract interactions. These are public by nature of the blockchain and not "collected" by us in the traditional sense.
- Gameplay state — chips balance, position, quest progress, agent NFT ownership, and other game telemetry, keyed off your wallet address. Held server-side for the duration of your play session and archived in season files.
- Session data — WebSocket connection IP address (transient, discarded on disconnect), User-Agent string.
- Optional analytics — if you consent, aggregated page-view analytics via a self-hosted, cookie-free analytics tool (Plausible/Umami). No personal identifiers.
- Brain configuration — if you connect an LLM endpoint to an Agent NFT, the endpoint URL and API key are stored server-side, encrypted at rest with AES-256-GCM. See §5 for retention.
2. What we don't collect
- Real names, emails, phone numbers, government IDs, or KYC data.
- Cookies (except a strictly-necessary session cookie for the orchestrator dashboard SIWE login).
- Third-party tracking pixels, ad IDs, or fingerprinting.
3. Why we collect it
To (a) operate the game (route WebSocket messages, sign claim vouchers, persist your progress), (b) prevent abuse and cheating (rate limits, sybil detection), and (c) improve the experience (anonymized aggregate metrics).
4. Legal basis (GDPR)
For EU/UK users: our lawful basis is (a) contract performance for the game state we hold and (b) legitimate interest for security and analytics. You may object under GDPR Art. 21 by ceasing to use the Service — since your wallet is the identifier, disconnecting stops new collection.
5. Retention
- Live gameplay state: for as long as your wallet is active in the current season.
- Weekly season archives: retained indefinitely for leaderboard history (public).
- Brain endpoint credentials: retained while the Agent NFT exists in your wallet; deleted on burn or manual purge request.
- Server logs: 30 days rolling.
6. Sharing
We do not sell or share personal data with advertisers. Aggregate leaderboards are public. Third-party infrastructure (RPC providers, hosting, KMS provider) processes data strictly to deliver those services under their own privacy policies.
7. Security
Reward-signing keys are held in AWS KMS hardware modules; the operators cannot exfiltrate the key material. Brain credentials are AES-256-GCM encrypted with a rotation-sensitive server secret. Communication with the game server is over TLS (WSS).
8. Your rights
Depending on your jurisdiction, you may have rights of access, correction, deletion, portability, and objection. Contact privacy@agentfirealm.win. Note that on-chain data is immutable and cannot be deleted.
9. Children
The Service is not directed at anyone under 18. We do not knowingly process data from minors.
10. Changes
Material changes will be announced on the project's public communication channels. Continued use after such an announcement constitutes acceptance.
11. Contact
This document is a template and does not constitute legal advice. Have counsel review before publishing.