This Privacy Policy ("Policy") describes how 3D Print Corner, operated by Anastasiia Miroshnichenko, doing business as Coffee on Chain ("Company," "we," "us," or "our") collects, uses, and protects information when you use the BrainStake application ("App"), a skill-based crypto trivia game on the Solana blockchain. By connecting your wallet and using the App, you agree to the practices described in this Policy. This Policy is incorporated into our Terms and Conditions.

1. Data Controller

The data controller responsible for the processing of your personal data is:

3D Print Corner
Anastasiia Miroshnichenko
Ehrenbergstraße 8, 10245 Berlin, Germany
Email: coffeeonchainsol@gmail.com

2. Information We Collect

Wallet Address (Public Key): When you connect your Solana wallet, we collect your public wallet address. This serves as your account identifier. We never access, store, or request your private keys, seed phrases, or wallet credentials.

Game Data: We collect quiz answers, game scores, response times, and prize pool participation records to operate the game and determine results.

Optional Profile Data: If you choose to connect your X (Twitter) account for sharing features, we collect your public X handle. This is entirely optional.

Session Data: We use JSON Web Tokens (JWT) for session authentication. We do not use cookies for tracking purposes.

3. Information We Do Not Collect

We do not collect: email addresses, passwords, real names, phone numbers, physical addresses, IP-based location data, device fingerprints, or any other personal information beyond your wallet address and optional X handle. We do not use third-party analytics or tracking services.

4. How We Use Your Information

We use the information we collect to: authenticate your session via wallet signature, record and display game scores and leaderboards, operate prize pool entry and reward distribution, enable optional social sharing via X (Twitter), and improve the App's functionality and user experience.

5. Legal Basis for Processing

We process your personal data on the following legal bases under the EU General Data Protection Regulation (GDPR):

Contract performance (Art. 6(1)(b) GDPR): Wallet authentication, game operation, score recording, and prize distribution are necessary for the performance of the contract between you and us (our Terms and Conditions).

Legitimate interest (Art. 6(1)(f) GDPR): Fraud prevention, security measures, and service improvement are based on our legitimate interest in providing a safe and functional service.

Consent (Art. 6(1)(a) GDPR): Optional X (Twitter) connection and optional profile data are processed only with your explicit consent, which you may withdraw at any time.

Legal obligation (Art. 6(1)(c) GDPR): Compliance with applicable laws and tax reporting obligations.

6. Blockchain Transparency

BrainStake operates on the Solana blockchain. By participating in prize pools, you acknowledge that certain data is recorded on-chain and is publicly visible to anyone, including: your wallet address, pool entry transactions, staked amounts, scores submitted on-chain, and reward distributions. On-chain data is immutable and cannot be deleted or modified by us or anyone else. This is an inherent property of blockchain technology.

7. Third-Party Services

The App relies on the following third-party services:

Helius: We use Helius as our Solana RPC provider to interact with the blockchain. Helius may process your wallet address and transaction data in accordance with their own privacy policy.

Netlify: Our backend infrastructure runs on Netlify Functions. Netlify processes requests in accordance with their privacy policy.

Neon Postgres: Game data (scores, quiz answers, pool records) is stored in a Neon Postgres database. Data is stored securely and is not shared with Neon beyond what is necessary to provide the database service.

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

8. International Data Transfers

Your data may be transferred to and processed in the United States through our third-party service providers: Netlify, Neon Postgres, and Helius. These transfers are protected by Standard Contractual Clauses (SCCs) as per Commission Implementing Decision (EU) 2021/914, and where applicable, the EU-US Data Privacy Framework. You may request a copy of the applicable SCCs by contacting us at coffeeonchainsol@gmail.com.

9. Data Retention

We retain your data for the following periods:

Game session data: Retained for 2 years after your last activity.

Leaderboard data: Retained for the lifetime of the service.

Authentication tokens (JWT): Expire after 24 hours.

On-chain data: Permanent due to blockchain immutability. This data cannot be deleted or modified by us or anyone else.

Account deletion requests: Upon receiving a valid deletion request, off-chain data will be deleted within 30 days.

10. Data Security

We implement reasonable technical and organizational measures to protect your data, including secure HTTPS connections, JWT-based authentication (no passwords stored), and access controls on our database infrastructure. However, no system is completely secure, and we cannot guarantee absolute security.

11. Your Rights Under the GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and to request a copy of that data.

Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data concerning you.

Right to erasure (Art. 17 GDPR): You have the right to request deletion of your off-chain personal data. Please note that on-chain data (wallet address, transactions, scores recorded on the Solana blockchain) is immutable and cannot be deleted or modified by us or anyone else due to the inherent nature of blockchain technology.

Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing of your personal data under certain circumstances.

Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests.

Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at coffeeonchainsol@gmail.com.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany. Email: mailbox@datenschutz-berlin.de.

You can also disconnect your wallet at any time to end your active session, and you can choose not to connect your X (Twitter) account or disconnect it at any time.

12. Automated Decision-Making

The App uses automated scoring and anti-cheat detection mechanisms. Score calculations are deterministic based on your answers and response timing. No fully automated decisions with significant legal effects are made about users under Art. 22 GDPR.

13. Data Protection Officer

We have not appointed a Data Protection Officer as we do not meet the thresholds requiring one under Art. 37 GDPR. For all data protection inquiries, please contact us at coffeeonchainsol@gmail.com.

14. Children's Privacy

The App is not intended for individuals under the age of eighteen (18). We do not knowingly collect information from minors. If we become aware that a minor has used the App, we will take steps to delete their off-chain data.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the revised Policy. We encourage you to review this page periodically.

16. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

3D Print Corner (Coffee on Chain)
Anastasiia Miroshnichenko
Ehrenbergstraße 8, 10245 Berlin, Germany
Email: coffeeonchainsol@gmail.com
Website: coffee-on-chain.com

By using BrainStake, you acknowledge that you have read and understood this Privacy Policy.