Privacy Policy

PullChain ("we", "us", "our") is operated by BlindspotLab. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data. We are committed to minimal data collection — we only collect what is necessary to operate the Platform.

We collect the following data when you use PullChain: • Wallet address (if you connect a wallet via Privy) • Email address (if you authenticate via email) • Username (set during profile setup) • Game progress data: topics attempted, quiz scores, difficulty completions • Session data: lives used, stability, time taken • Leaderboard scores • Certificate issuance records • Basic usage analytics (page views, feature usage — no personal identifiers)

We do not collect: • Private keys or seed phrases (we never ask for these) • Payment card information • Government-issued ID or KYC documents • Precise geolocation • Browsing history outside of PullChain We do not sell your data to third parties. Ever.

We use your data to: • Authenticate you and maintain your session • Save and display your game progress • Generate and store certificate records • Display leaderboard rankings • Improve the Platform's educational content and game mechanics We do not use your data for targeted advertising.

PullChain uses Privy for authentication. Privy handles wallet connections and email-based login. When you authenticate, Privy creates a unique user ID that we store alongside your game data. Privy's own privacy policy applies to data processed by their service. You can review Privy's privacy policy at privy.io.

When you mint a certificate on Base, your wallet address and the transaction hash are recorded on-chain permanently. Blockchain data is public and immutable — we have no ability to delete or modify on-chain records. This includes your certificate token ID, minting timestamp, and associated difficulty tier.

Game progress, user profiles, leaderboard data, and certificate records are stored in a PostgreSQL database hosted by Supabase. Certificate metadata (JSON files for NFT display) is stored in Supabase Storage. Both services are subject to Supabase's own privacy and security practices.

PullChain uses cookies set by Privy for authentication session management (the privy-token cookie). We do not use advertising cookies or third-party tracking cookies. You can clear these cookies at any time through your browser settings, which will log you out of the Platform.

We retain your data for as long as your account is active. If you would like your account data deleted, contact us at mojeeb.eth@gmail.com. Note that on-chain data (your certificate NFTs and transaction history) cannot be deleted — it is permanently recorded on the Base blockchain.

Depending on your jurisdiction, you may have rights to: • Access the data we hold about you • Request correction of inaccurate data • Request deletion of your off-chain data • Object to certain uses of your data To exercise any of these rights, contact us at mojeeb.eth@gmail.com.

We implement reasonable security measures to protect your data, including encrypted connections (HTTPS), authentication via Privy, and access controls on our database. However, no system is perfectly secure. We encourage you to use a strong, unique password for any email authentication and to keep your wallet private keys secure.

PullChain is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will update the "Last Updated" date when changes are made. Continued use of the Platform after changes constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at hello@pullchain.fun or reach out on X at @PullChainFun.