Privacy Policy

Last updated: 30 July 2026 · Version 2.0

Applies to Snake Pot, PAC ARENA, Kart Arena and Blackjack, and to the websites snakepot.com and pac-arena.com (together, the Platform).

The short version. We collect as little as we can get away with: an email address (handled by Privy), your wallet address, a display name if you set one, and your game statistics. We do not sell your data, we do not run advertising trackers, and we never see your private keys or your password. The one thing you cannot undo is the blockchain — see section 6.

CONTENTS

1. Introduction 2. Who is responsible for your data 3. What we collect 4. What we deliberately do NOT collect 5. Why we use it, and our legal basis 6. Blockchain data is public and permanent 7. Local storage and cookies 8. Who we share data with 9. International transfers 10. How long we keep it 11. Security 12. Your rights 13. How to exercise your rights 14. California residents 15. Automated decision-making 16. Children 17. Changes to this policy 18. Contact and complaints

1. Introduction

This policy explains what personal data the Platform collects about you, why we collect it, who it is shared with, how long it is kept, and what rights you have over it. It should be read together with our Terms of Service, of which it forms part.

We have written this in plain English rather than legalese. Where a term has a specific legal meaning — personal data, controller, processor, legal basis — we use it in the sense given by the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Who is responsible for your data

The Platform is operated by an individual sole operator (the Operator, we, us). The Operator is the data controller for the personal data described in this policy.

For all privacy matters — access, correction, deletion, objection, or a complaint — contact morrisdonovan78@gmail.com. This is a monitored address and is the correct route for any data request; please do not send data requests by Discord direct message, as we cannot verify identity reliably there.

Some parties act as independent controllers in their own right rather than on our instructions — notably Privy for authentication and wallet custody. Their handling of your data is governed by their own privacy policy as well as this one.

3. What we collect

3.1 Account and identity

Email address — collected and verified by Privy when you sign in by email, and shared with us so we can identify your account. If you sign in with Google, we receive the email address associated with that Google account.
Privy user identifier — an opaque id linking your session to your account.
Solana wallet address(es) — the public address of the embedded wallet provisioned to your account, and any other embedded wallet on the same account.
Display name — only if you choose to set one. Display names are public and appear on leaderboards, in lobbies and in chat.

3.2 Gameplay and financial activity

Match records — games played, entries paid, amounts wagered, amounts won, kills, deaths, wins and losses, per game.
Transaction references — Solana transaction signatures for entries and payouts, used to verify payment and to prevent the same deposit being used twice.
Balance history — timestamped points recording cumulative amounts wagered and earned, which is what draws your profit chart.
Referral data — a referral code you arrived with, and the link between a referrer and a referred player.
Enforcement records — bans, suspensions and the reason for them, where applicable.

3.3 Communications

Text chat — messages you send in lobby or in-game chat, transmitted to other players in that lobby.
Voice chat — where you enable it, your audio is transmitted live to other players in the same lobby. We do not record or store voice audio.
Support correspondence — anything you send us by email or Discord when asking for help.

3.4 Technical data

Server logs — generated automatically by our hosting and network providers, and typically including IP address, timestamp, requested URL, response status, and user-agent string. Used for security, abuse prevention and debugging.
Device and browser characteristics — such as screen size and input devices, used to render the game correctly and to detect whether you are on a controller, mouse or touchscreen.
Connection telemetry — latency and connection quality, used to diagnose desync and lag.

4. What we deliberately do NOT collect

To be explicit, because it matters:

We never see your private keys or seed phrase. Key material is held by Privy. We cannot move your funds and could not do so if compelled.
We never see your password. Authentication is handled entirely by Privy or Google.
No payment card or bank data. The Platform accepts only SOL on-chain; there is no card processing anywhere in the system.
No identity documents. We do not run KYC and do not ask for passports, driving licences or proof of address.
No advertising or cross-site tracking. We do not run ad networks, advertising pixels, third-party analytics profiling or behavioural trackers, and we do not build advertising profiles.
No special category data. We do not collect data about health, race, religion, politics, sexuality or biometrics, and ask that you do not send such data to us.

5. Why we use it, and our legal basis

If you are in the UK or the EEA, we must have a lawful basis for each use of your data. Ours are set out below.

What we do	Data used	Legal basis
Create and authenticate your account	Email, Privy id, wallet address	Performance of a contract
Run matches, take entries and pay prizes	Wallet address, match records, transaction signatures	Performance of a contract
Show leaderboards, profiles and your stats	Display name, match records, balance history	Performance of a contract; legitimate interests
Prevent cheating, collusion, multi-accounting and fraud	Match records, technical data, enforcement records	Legitimate interests (protecting players and the integrity of the games)
Diagnose faults and improve the games	Server logs, connection telemetry	Legitimate interests (operating a working service)
Respond to your support requests	Correspondence, wallet address, match records	Performance of a contract; legitimate interests
Enable voice chat	Live microphone audio	Consent (you enable it; you can disable it at any time)
Operate referrals and events	Referral code, match records	Performance of a contract
Enforce our Terms, and establish or defend legal claims	Any of the above, as relevant	Legitimate interests; legal obligation

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms, and we have concluded it is not — but you can object at any time (see section 12) and we will reconsider it for your case.

6. Blockchain data is public and permanent

This is the most important thing in this policy. The Platform runs on Solana, a public blockchain. Your wallet address, every deposit, every entry, every prize and every withdrawal are recorded publicly, permanently, and by anyone in the world with an internet connection. They are not held by us and we cannot edit, hide or delete them — nor can anyone else.

A wallet address is pseudonymous rather than anonymous. If you link your address to your real identity anywhere — by posting it publicly, by withdrawing to an exchange account in your name, or by funding it from one — your on-chain activity on the Platform may become traceable to you by third parties such as chain-analysis firms.

Your right to erasure (section 12) applies to the data we hold in our own systems. It cannot and does not extend to the blockchain, because that is technically impossible. Please take this into account before you deposit.

7. Local storage and cookies

We do not use advertising or tracking cookies, and we do not sell or share data with ad networks. What we do use is browser local storage on your own device, to remember your settings and keep you signed in. Nothing in this list is transmitted to us for profiling.

Stored item	Purpose
Privy session tokens	Strictly necessary — keeps you signed in and authorises wallet actions. Set and managed by Privy.
Display-name keys	Remembers the name you chose so it shows in-game.
Game settings	Graphics, audio, controller bindings, and whether the controls panel stays on screen while racing.
Referral code	Remembers the referral link you arrived through so it can be credited on your first paid entry.
Wallet-creation marker	Short-lived flag that stops a second wallet being created for you by accident.
Failed-deposit receipt	If a paid join fails after payment, the transaction reference is kept locally so you can quote it to support.

You can clear local storage through your browser at any time. Doing so will sign you out and reset your settings, but it will not affect your funds, which live on the blockchain and with Privy.

8. Who we share data with

We do not sell your personal data, and we never have. We share it only with the service providers needed to run the Platform, and only as far as each needs:

Provider	Role	Data involved
Privy	Authentication and embedded wallet custody	Email, Google identity, wallet keys and addresses
Vercel	Website and API hosting	Server logs, IP address, request data
Upstash	Database for accounts, stats and match records	Wallet address, display name, match and balance records
Solana RPC providers	Reading and broadcasting blockchain transactions	Wallet address, transaction data
Ably	Realtime messaging between players	Session and lobby data, chat messages
Game servers	Running matches authoritatively	Wallet address, display name, gameplay input, chat and voice
Discord	Community and support	Only what you choose to post or send there
Price feeds	Converting SOL to a display figure in USD	None — no personal data is sent

We may also disclose data:

where we are legally required to, such as under a valid court order or a binding request from a competent authority;
where necessary to establish, exercise or defend legal claims;
to prevent or investigate fraud, cheating or a threat to someone’s safety;
to a successor operator if the Platform is transferred, in which case we will tell you first.

Some information is public by design: your display name, your leaderboard position and your headline statistics are visible to other players, as is your wallet address where you make it discoverable in order to receive payments from friends.

9. International transfers

Our providers operate globally, and our servers are located in multiple regions, including North America and Europe. Your data will therefore be transferred to and processed in countries outside your own, which may have different data-protection laws.

Where data is transferred out of the UK or EEA, we rely on the safeguards our providers have in place — typically the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses, together with additional technical measures such as encryption in transit. You can ask us for details of the safeguards applying to a particular transfer.

10. How long we keep it

Data	Retention
Account and wallet records	While your account is open, and up to 12 months after closure to handle disputes and fraud claims
Match, stats and balance history	While your account is open; kept in aggregated or anonymised form afterwards for leaderboards and integrity
Deposit and payout references	Retained as long as needed to prevent replay and to answer payment disputes
Server logs	Short-term only, typically 30–90 days, per our hosting providers’ defaults
Chat messages	Transient; retained only where flagged in a moderation report
Voice audio	Never recorded or stored
Ban and enforcement records	Retained indefinitely, so that a ban cannot be evaded by re-registering
Support correspondence	Up to 24 months
On-chain transactions	Permanent and outside our control — see section 6

11. Security

We take the following measures, among others:

all traffic is encrypted in transit over HTTPS and secure WebSockets;
private keys are never held by us — custody sits with Privy;
money-affecting actions are authenticated with a cryptographic signature from your own wallet, so a request cannot be forged on your behalf;
administrative endpoints require a signed, path-bound token and are not reachable without it;
deposits are verified independently against the blockchain rather than being taken on the client’s word, and each deposit can be used once only;
secrets and credentials are held in the hosting provider’s encrypted environment store, not in source code.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and will tell affected players without undue delay.

12. Your rights

Depending on where you live, you have some or all of the following rights over your personal data. Under the UK and EU GDPR, you have all of them:

Access — to be told whether we hold data about you, and to receive a copy of it.
Rectification — to have inaccurate data corrected and incomplete data completed.
Erasure — to have your data deleted where there is no overriding reason for us to keep it. Subject to section 6: we cannot delete the blockchain.
Restriction — to have processing paused while a dispute about accuracy or legitimate interests is resolved.
Portability — to receive the data you gave us in a structured, commonly used, machine-readable format.
Objection — to object to processing based on legitimate interests, on grounds relating to your situation.
Withdraw consent — where we rely on consent, such as voice chat, you can withdraw it at any time without affecting processing already carried out.
Complain — to your data-protection regulator (see section 18).

Exercising these rights is free, and we will not treat you differently for doing so.

13. How to exercise your rights

Email morrisdonovan78@gmail.com with the right you want to exercise and your wallet address. We will respond within one month. If the request is complex we may extend this by up to two further months, and will tell you if so.

We must be satisfied that the request comes from you before we act on it — otherwise the “right of access” becomes a way for someone else to obtain your data. Because we hold no identity documents, the practical way to prove control of an account is to sign a short message from the wallet concerned, or to write from the email address registered to the account. We will tell you exactly what is needed when you get in touch.

Account deletion. Ask us to close your account and we will delete or anonymise the personal data we hold, subject to the retention exceptions in section 10 — chiefly enforcement records, and records we need to defend a legal claim. Withdraw your balance first: your funds are held with Privy against your wallet, and we cannot move them for you.

14. California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information is collected, used and disclosed; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising those rights.

The categories of personal information we collect are set out in section 3, the purposes in section 5, and the parties we disclose to in section 8. We collect this information directly from you and from the public blockchain.

We do not sell or share personal information as those terms are defined by the CCPA, and we do not process sensitive personal information for the purpose of inferring characteristics. We have not sold personal information in the preceding twelve months. Because there is no sale or sharing, there is no opt-out to operate — but you may still exercise your other rights using section 13.

15. Automated decision-making

We use automated systems to detect cheating, botting, collusion and abuse, and these can trigger a restriction or suspension without a person looking first. Where an automated decision has a significant effect on you — for example a ban, or withheld winnings — you have the right to ask for human review, to express your point of view, and to contest the decision. Write to morrisdonovan78@gmail.com and a person will look at it. We do not use automated profiling for advertising or for any purpose unrelated to game integrity.

16. Children

The Platform is strictly for adults aged 18 or over. We do not knowingly collect personal data from children, and we do not direct the service at them.

If we learn that an account belongs to someone under 18, we will suspend it, delete the associated personal data, and return any remaining deposited balance to the originating wallet. If you believe a child is using the Platform, please tell us at morrisdonovan78@gmail.com and we will act promptly.

17. Changes to this policy

We may update this policy to reflect new features, new providers or changes in the law. The version number and date at the top always identify the current version. Where a change materially affects how we use your data, we will give notice through the Platform or our Discord before it takes effect. Continued use after that date means you accept the updated policy.

18. Contact and complaints

Privacy, data requests and legal notices: morrisdonovan78@gmail.com
General support: Discord

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain directly to your data-protection regulator. In the UK that is the Information Commissioner’s Office (ico.org.uk). In the EEA it is the supervisory authority of the country where you live, work, or where the issue occurred. In California it is the California Privacy Protection Agency.

See also our Terms of Service, including section 19 on responsible play and self-exclusion.