# Privacy Policy

**Last updated: ‹‹DATE››**

## The short version

Otherworld Reserve (the "Platform") is built around wallets and Internet Identity rather than passwords, so we hold less about you than most sites. Everything we do hold is listed below. We don't sell it, we don't use advertising trackers, and we don't share it with data brokers.

## Who is responsible

‹‹ENTITY››, incorporated in ‹‹JURISDICTION››, registered at ‹‹ADDRESS››. Questions, requests and complaints: ‹‹PRIVACY EMAIL››.

## What we hold, and why

- **How you sign in.** Your Internet Identity principal and/or your Solana wallet address. This *is* your account. Blockchain addresses and their history are public by nature; we didn't make them public and can't make them private.
- **Other app identities you choose to link.** Your HoldemHeroes (poker) principal, and an ICPSwap principal if you type one in, so we can match your activity across those apps.
- **Email, only if you give it.** Used for verification, for things you signed up for (the waitlist, tournaments) and for notices about your account. You can unsubscribe from anything that isn't essential.
- **Mailing address, only if you give it.** Used only to ship a physical prize or Reserve piece you ask us to send.
- **Linked X and Discord accounts, only if you link them.** We store the account id and name so we can verify you and show you consistently. We never get your password or messages.
- **Games, chips and ledger records.** Rounds played, wagers, outcomes, chip purchases, deposits, cash-outs and balances: needed to run the games, pay out, and let you audit your own results.
- **Your Hangout look and presence.** The avatar outfit you save, and when you were last in the Hangout.
- **Things you create or upload.** Builders' Hall rooms and the prompts you give the AI builder; documents you upload to an investigation folder.
- **Technical logs.** Our hosting providers record IP addresses and request details for a limited time. We use them for security and debugging, not profiling.

## What other people can see

- **In the Hangout**, people see your avatar and your display name (your X handle if you linked one, otherwise "Member"). When you're not there, an "away" avatar may stand in for you in your saved look; whether it carries a name is a setting we disclose here: ‹‹AMBIENT NAME SETTING››.
- **From our Discord server**, your Discord server name and picture appear in the Hangout only after you run `/hangout show` or link Discord on your account page. `/hangout hide` stops it at once. Other online members may appear as plain, nameless figures; our bot sends us only a count of them, never who they are.
- **Leaderboards and bounties** show winners by display name.

## Legal basis

Where the GDPR or UK GDPR applies: account, game and ledger records are processed to **perform our contract** with you; security and technical logs rest on our **legitimate interest** in running a safe service; email, linked accounts, mailing address and Discord display rest on your **consent**, which you can withdraw at any time.

## Who we share it with

Only providers that run parts of the service, and only what they need:

| Provider | What it handles |
|---|---|
| Vercel | hosting the site, technical logs, private file storage for investigation documents |
| Neon | the application database |
| Resend | sending email you've asked for |
| Amazon Web Services (Lightsail) | the poker table server, live Hangout presence and our Discord bot |
| Internet Computer (DFINITY network) | the OWX token, chips, poker and identity-link canisters |
| Anthropic | generating Builders' Hall rooms from your prompts |
| Discord and X | verifying the account you choose to link |
| Blockchain RPC and market-data providers | reading chains and metal prices |

We also disclose information where the law requires it.

## How long we keep it

Ledger and game records: while your account exists, because they're the record of your balance and prizes. Email and mailing address: until you remove them or ask us to delete them. Hangout presence: overwritten as you come and go. Technical logs: as long as our hosting providers keep them. ‹‹RETENTION DETAIL››

## The September 2026 breach

Between 24 and 27 September 2026 a third party gained administrative access to our systems and copied our database. **They still hold that copy.** It contained 232 email addresses (231 waitlist sign-ups and 1 tournament entry), 8 accounts identified by wallet address only, and wallet addresses, game history and the credit ledger. It held no names, no passwords, no payment details and no postal addresses. Our public transparency report has the full account.

## Your rights

You can ask for a copy of what we hold about you, ask us to correct or delete it, object to or restrict how we use it, and withdraw consent: write to ‹‹PRIVACY EMAIL››. Two limits, stated plainly:

- **We can't delete blockchains.** Transactions on the Internet Computer or Solana are permanent and public. We can delete what's in our own database.
- **We may keep ledger records we need** to settle an open prize, claim, cash-out or dispute, and we'll tell you when that applies.

If you're in the EU or UK you can complain to your national data protection authority.

## Children

The Platform is not for anyone under ‹‹MIN AGE››. We don't knowingly collect data from children; if you believe we have, write to ‹‹PRIVACY EMAIL›› and we'll delete it.

## International transfers

Our providers operate in the United States and elsewhere. Where personal data leaves the EEA or UK, it moves under the provider's standard contractual clauses. ‹‹TRANSFER DETAIL››

## Changes

We'll update the date above and announce material changes. We won't quietly reduce your rights.

## Contact

‹‹PRIVACY EMAIL››