Privacy Policy
Effective Date: September 24, 2026
Last Updated: September 28, 2026
1. Who We Are
Dungeons & Moles ("the Game", "we", "us") is developed and operated by Ailton Sávio Sacramento Júnior, an individual based in Brazil, who is the controller of the personal data described here. This policy covers the Android app, the web client at app.dungeonsandmoles.com, the landing site (dungeonsandmoles.com) and this documentation site.
Privacy questions and requests: legal@dungeonsandmoles.com. Help with the Game: support@dungeonsandmoles.com.
The Game runs on the Solana blockchain. Some of what you do in it is written to the blockchain, where it is public and permanent. Section 4 explains what that means.
2. What We Collect
2.1 When you sign in with a wallet
| Data | Where it goes | Why |
|---|---|---|
| Wallet public address | Solana blockchain, your device, our RPC and rollup providers | Your account is your wallet; every on-chain action needs it |
| Display name (up to 32 characters) | Solana blockchain | Shown to other players |
| Game state: runs, items, inventory, quests, match results | Solana blockchain | Playing the Game |
| Hashed wallet ID (a SHA-256 hash of your wallet address) | Google Firebase / Google Analytics, Sentry | Ties play analytics and error reports to one player |
| Play events: app opened, sign-in steps, tutorial steps, runs, days, moves, combats, items, gold, points of interest, quests and PvP queue results, each tagged with a random per-run ID | Google Firebase / Google Analytics | Balancing the Game and finding where players get stuck |
| Your answer to "where did you hear about us" (asked once, optional) | Google Firebase / Google Analytics | Knowing which channels bring players |
| Device and usage data collected by Firebase: device model, operating system, app version, language, approximate country (derived from IP address), how the app was installed | Google Firebase / Google Analytics | Aggregate statistics |
| Errors, crash reports and performance traces | Sentry | Fixing bugs |
| Notification preferences and a push token | Your device, Google Firebase Cloud Messaging | Sending the notifications you switch on (section 3.4) |
| Session keys | Your device only (Expo SecureStore in the app, sessionStorage in the browser) | Signing in-game actions without a wallet prompt each time |
| Settings, tutorial progress and similar preferences | Your device only | Remembering your choices |
2.2 Guest mode
Guest mode runs on your device without a wallet and writes nothing to the blockchain. Play events and error reports are still sent as described above, but without a wallet or hashed wallet ID.
2.3 Websites
The web client uses Vercel Web Analytics for page views and, when enabled, Firebase Analytics. The landing site (dungeonsandmoles.com) uses Google Analytics 4. See section 6 for cookies and browser storage.
2.4 The First Descent leaderboard
To appear on the event leaderboard at dungeonsandmoles.com, you sign a one-time message with your wallet and connect your X account. We store your wallet address, your X user ID and handle, when you linked, and whether you chose to show your handle on the board. From X we read only your user ID and handle; we never post for you. Scores come from public on-chain results. The event rules explain how the leaderboard works.
2.5 What we do not collect
- Names, email addresses or phone numbers (unless you email us)
- Passwords, seed phrases or private keys
- Precise location (GPS)
- Your contacts, photos or files
- Advertising IDs. We do not turn on Google Signals, and we do not use your data for advertising
We do not sell or rent personal data.
3. Why We Use It, and on What Legal Basis
3.1 Running the Game
Your wallet address, display name and game state are processed to provide the Game you asked to use (performance of a contract: LGPD Art. 7, V; GDPR Art. 6(1)(b)).
3.2 Play analytics
Play events, the hashed wallet ID, the acquisition answer and the device data Firebase collects are processed in our legitimate interest in balancing and improving the Game (LGPD Art. 7, IX; GDPR Art. 6(1)(f)). We keep the data to what that needs and never use it for advertising.
You can switch this off at any time with Share play data in the in-game Settings. When it is off, the app stops sending play events and tells Firebase to stop collecting. It is on by default. You can also object by emailing legal@dungeonsandmoles.com.
3.3 Error reports
Crash and error reports are sent to Sentry in our legitimate interest in keeping the Game working. Share play data does not turn these off. They contain technical details of the failure; the screen you were on; the last game steps before it (moves, fights, points of interest, session and transaction steps, without wallet addresses or transaction signatures); the game mode, device type and rollup region; and the hashed wallet ID. Performance traces are sampled (about 20%).
3.4 Notifications
On Android the Game can remind you about quest resets, a streak about to break or an unfinished run. These are scheduled on your device. If you allow notifications and keep Event news on, the app also subscribes to an event-news topic in Firebase Cloud Messaging so we can announce launch events. We send those to the topic as a whole. We do not store your push token. You can turn each kind off in Settings or turn all of them off in your phone's settings. Opening a notification is recorded as a play event.
3.5 The First Descent leaderboard
Your wallet address and X account are processed to run the event you chose to enter: showing the board, reviewing potential winners and delivering prizes to the wallet that earned them (performance of a contract: LGPD Art. 7, V; GDPR Art. 6(1)(b)). Your X handle is shown publicly only if you turn that on.
3.6 Emails you send us
If you email us, we use your address and message only to reply and keep a record of the request.
4. Blockchain Data
The Game currently runs on Solana devnet, a test network. Devnet data is still public.
5. Who Receives Data
| Provider | What for | What they receive |
|---|---|---|
| Google (Firebase, Google Analytics, Firebase Cloud Messaging) | Play analytics, landing-site analytics, notifications | Play events, hashed wallet ID, device and usage data, IP address, topic subscription |
| Functional Software, Inc. (Sentry) | Error and crash reporting | Error details, recent game steps, device data, hashed wallet ID, IP address |
| Vercel Inc. | Hosting the websites, web page analytics | Page views, IP address, browser data |
| Helius Labs, Inc. | Solana RPC access | Wallet address, transactions, IP address |
| MagicBlock | Ephemeral rollups for real-time play | Gameplay transactions, wallet address, IP address |
| Jupiter | Token price quotes | Token amounts, IP address |
| Your wallet app (Phantom, Solflare, Backpack and others) | Sign-in and signing transactions | Signing requests. Your wallet has its own privacy policy |
| X Corp. | Linking your X account to the event leaderboard | The sign-in request; X sends us your user ID and handle |
| Supabase, Inc. | Hosting the event leaderboard database | Wallet address, X user ID and handle, link time, scores |
| Solana network validators | Processing transactions | Everything written on-chain (section 4) |
Their privacy policies: Google, Sentry, Vercel, Helius, MagicBlock, X, Supabase.
We may also disclose data when the law requires it, or to protect the Game and its players from fraud or abuse.
6. Cookies and Device Storage
- Landing site: Google Analytics 4 sets first-party cookies (
_ga,_ga_*) to count visits, kept for up to 2 years. - Web client: Firebase Analytics, when enabled, uses the same Google Analytics cookies and browser storage. Vercel Web Analytics does not use cookies. The Game stores settings in localStorage and session keys in sessionStorage.
- Android app: Firebase keeps an app-instance ID on your device. Settings and progress are kept in app storage; session keys in the system's secure storage.
You can clear cookies and site data in your browser, or clear the app's data in Android settings. This resets your settings but not anything on-chain.
7. How Long We Keep It
- On-chain data: permanently.
- Firebase / Google Analytics: user-level event data for up to 14 months, then deleted; aggregated reports may be kept longer.
- Sentry: up to 90 days.
- Vercel Web Analytics: per Vercel's retention, aggregated.
- Data on your device: until you clear it or uninstall the app; web session keys until the tab closes.
- Event leaderboard X links:until the event's prizes are delivered and winner reviews are settled, then deleted. We keep a record of each prize and the wallet it went to.
- Emails: as long as needed to handle the request.
8. Security
- We never see your seed phrase or private keys.
- Session keys stay on your device, in secure storage in the app and in sessionStorage in the browser.
- We run no database of personal data of our own. Off-chain data sits with the providers in section 5.
- Analytics records are scrubbed of keys, tokens and secrets.
No system is perfectly secure, and we cannot guarantee the security of data on your device or with third parties.
9. International Transfers
The providers in section 5 are mostly in the United States and process data there and elsewhere; the event leaderboard database is hosted in Japan. We rely on their standard contractual clauses and data processing terms for these transfers (LGPD Art. 33; GDPR Chapter V).
10. Your Rights
Wherever you live, you can ask us to confirm what data we hold about you, give you a copy, correct it, delete it, or stop using it for analytics. Email legal@dungeonsandmoles.com from any address and include your wallet address so we can find the hashed ID. We may ask you to sign a message with the wallet to prove it is yours. We answer within 15 days.
10.1 Brazil (LGPD)
Under LGPD Art. 18 you have the right to confirmation, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share data with, and to oppose processing based on legitimate interest. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD).
10.2 European Economic Area and United Kingdom (GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection. You may object to analytics at any time (the Share play data switch does this instantly). You can complain to your local data protection authority.
10.3 California (CCPA/CPRA)
You have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.
11. Children
The Game is not for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has used the Game, email legal@dungeonsandmoles.com and we will delete the off-chain data linked to them.
12. Changes to This Policy
We will post changes on this page with a new "Last Updated" date. For significant changes we will also tell players in the Game before they take effect.
13. Contact
Ailton Sávio Sacramento Júnior
Privacy and legal: legal@dungeonsandmoles.com
Player support: support@dungeonsandmoles.com
Website: dungeonsandmoles.com