PRIVACY POLICY

$ cat PRIVACY.md

This Privacy Policy explains what information the NForge project ("we") collects when you use the NForge website and NForge Gym, how we use it, and what choices you have. NForge is a research platform and our privacy architecture is designed around one principle: raw media never leaves your device.

1. Summary — What You Need to Know

2. Information We Collect

The table below lists every category of data touched by NForge Gym, whether it is processed locally only or uploaded to our servers, and the purpose.

Note: all webcam and microphone processing happens inside your browser using WebAssembly (MediaPipe Face Mesh) and native Web Audio APIs. Raw video frames and raw audio waveforms never cross the network. You can verify this by inspecting the client-side source code in our GitHub repository or by watching the network tab in your browser's developer tools while playing.

3. How We Use Your Information

• Reward payouts. Your wallet address is used to send SOL rewards when you complete qualifying gameplay.
• Scientific research. Behavioral features are aggregated and used to train and evaluate machine learning models for the NForge brain encoding framework. Research findings may be published; they will never identify individual players.
• Session accounting. We track active gameplay seconds per wallet per day to enforce the daily earnings cap and prevent abuse.
• Fraud and abuse prevention. Signal patterns are used to detect bots, Sybil attacks, and farming behavior.
• Operational monitoring. Error logs and anonymized metrics help us keep the Service running and diagnose bugs.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area and the United Kingdom, our legal basis for processing your data is:

• Contract. Processing necessary to deliver the reward service you signed up for.
• Legitimate interest. Processing necessary to conduct scientific research, prevent fraud, and secure our infrastructure.
• Consent. By connecting your wallet and playing, you explicitly consent to the collection of behavioral features for research purposes. You may withdraw consent at any time by ceasing to use the Service and requesting deletion.

5. Data Sharing and Disclosure

We do not sell your data. We do not share it with advertisers. We share data only with the following categories of third parties, and only to the extent necessary:

• Supabase — our hosted database provider. Stores the data listed above, encrypted at rest.
• Netlify — our serverless function and static hosting provider. Processes requests and maintains limited operational logs.
• Helius / Solana RPC — used to broadcast payout transactions and check wallet balances. These providers see the target wallet address and transaction details (which are public on the blockchain anyway).
• Google (MediaPipe) — MediaPipe Face Mesh runs entirely in your browser via WebAssembly. No data is sent to Google servers as a result of using MediaPipe on our site.
• Law enforcement. If legally compelled by a valid subpoena or court order, we may disclose the minimal information required.

6. On-Chain Data

Payout transactions are recorded on the Solana blockchain. This is a public, immutable ledger. Anyone can see that a given wallet received 0.01 SOL from our hot wallet. We cannot delete on-chain data; it is outside our control by design. Please factor this into your decision to participate.

7. Data Retention

• Behavioral telemetry. Retained for up to 24 months, after which it is either deleted or fully aggregated (no per-wallet rows) for research.
• Session records. Retained for up to 24 months.
• Payout records. Retained indefinitely for accounting and audit purposes. On-chain records are permanent by design.
• Operational logs (IP, User-Agent). Retained for up to 90 days.
• Login nonces. Retained for a maximum of 5 minutes and then deleted.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access. Request a copy of the data we hold about your wallet.
• Correction. Request correction of inaccurate data.
• Deletion. Request deletion of your off-chain data. On-chain payout records cannot be deleted.
• Portability. Request your data in a machine-readable format.
• Objection. Object to our processing where based on legitimate interest.
• Withdraw consent. Withdraw research participation at any time.

To exercise any of these rights, open an issue or contact us through the GitHub repository at github.com/kairowandev/NForge with the wallet address you wish to reference. We will respond within 30 days.

9. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us so we can delete it.

10. Security

We employ reasonable safeguards to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher
• Database rows are encrypted at rest by Supabase
• Telemetry blob storage paths use peppered SHA-256 hashes of wallet addresses, not the raw addresses themselves
• Row-level security policies restrict service-role access to our backend functions only
• Hot wallet balances are capped at a small maximum to limit the blast radius of any compromise
• Rate limiting and quality checks on every sensitive endpoint

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify affected users via the website and community channels within 72 hours.

11. International Transfers

Our infrastructure providers (Supabase, Netlify, Helius) operate globally. By using the Service, you acknowledge that your data may be processed in countries outside your country of residence, including the United States.

12. Cookies and Local Storage

We do not use tracking cookies or advertising cookies. NForge Gym stores a small amount of data in your browser's localStorage for session authentication (your JWT token) and to remember your connected wallet. Clearing your browser storage will log you out.

13. Do Not Track

Our website does not respond to Do Not Track signals because we do not track users across third-party websites.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be announced via the website and community channels. Continued use of the Service after changes take effect constitutes acceptance.

15. Contact

For privacy questions, data access requests, or deletion requests, contact us via the NForge GitHub repository at github.com/kairowandev/NForge.

$ EOF