Privacy Policy

1. Information we collect

Information you give us

• Sign-in details: your email address, and the name, profile picture and account identifier from a sign-in provider you choose, such as Google, Discord, X or an email login handled by Privy.
• Wallet addresses: the public addresses of wallets you connect, or that a Service creates for you. We never ask for, and never store, your private keys or seed phrase.
• Profile and game information: usernames, display names, avatars, binder covers and other choices you make, plus game saves, scores and progress.
• Purchases: what you bought, when and for how much. Card payments are handled by payment processors; we don’t receive or store full card numbers.
• Support requests: what you tell us when you ask for help, such as a ticket’s subject and details, your wallet address and the device or browser you use, and the messages and files you post in the ticket.
• Communications: emails and messages you send us, and your answers to surveys or feedback forms.

Information from Discord

When you use one of our Discord apps or bots, Discord shares some information with it, and Discord’s own privacy policy applies to that sharing. Depending on the app, this can include:

• your Discord user ID, username, display name and avatar;
• your roles and membership in servers where the app is installed, which we use to check what you’re allowed to do;
• for our support bot, the messages and attachments posted in ticket channels. The bot stores only messages from ticket channels; it ignores and does not store messages anywhere else; and
• for Discord Activities such as Moki Pochi, the information Discord provides when you launch the activity, such as your user ID and username, along with your progress in the game.

We use information from Discord only to run the app you’re using and to support you. We don’t sell it, use it for advertising, or share it with data brokers.

Information collected automatically

• Device and log data: IP address, browser and device type, operating system, the pages and features you use, timestamps and error reports.
• Gameplay data: for example when a game is launched, and the matches, scores and actions in it.
• Cookies and local storage: see Cookies and local storage below.

Information from other sources

• Public blockchain data, such as which NFTs a wallet holds and its transaction history.
• Sign-in, wallet and analytics providers, and other services you connect to your account.

2. How we use information

• To provide the Services: signing you in, running games and leaderboards, showing your collection, processing purchases and delivering rewards.
• To support you: answering tickets and messages, and keeping a record of how problems were resolved.
• To keep the Services safe and fair: detecting and preventing fraud, cheating, abuse, security incidents and breaches of our Terms of Service.
• To improve the Services: understanding how they’re used, fixing bugs and building new features, using aggregated or de-identified data where we can.
• To communicate with you: sending service messages and, where the law allows, news about Moku. You can opt out of marketing at any time.
• To meet legal obligations: complying with the law, including sanctions, tax and accounting rules, and establishing or defending legal claims.

3. Legal bases (EEA, UK and Switzerland)

If data protection laws such as the GDPR apply to you, we rely on:

• Contract, to provide the Services you ask for;
• Legitimate interests, such as keeping the Services secure and fair, supporting players, keeping records and improving the Services, where those interests aren’t overridden by your rights;
• Consent, where the law requires it, for example for some cookies or marketing emails. You can withdraw consent at any time; and
• Legal obligation, where the law requires us to process data.

4. How we share information

• Service providers that process data for us under contract. They include hosting and infrastructure (for example Vercel, Cloudflare, Google Cloud and Railway), databases and storage (for example MongoDB Atlas and Upstash), sign-in and wallets (for example Privy), analytics (for example Vercel Analytics and Mixpanel), and blockchain infrastructure such as Ronin network providers.
• Discord: when our team replies to your ticket, the bot posts the reply in Discord, where it is handled under Discord’s privacy policy.
• Other players and the public: usernames, avatars, scores, leaderboard positions and NFT holdings may be visible to others, as are messages you post in community channels.
• Blockchains: transactions you make are public and permanent.
• Affiliates that help us run the Services.
• Legal and safety: when the law requires it, or to protect the rights, property or safety of Moku, our players or others, including to prevent fraud.
• Business transfers: as part of a merger, acquisition, financing or sale of all or part of our business.
• With your consent or at your direction.

We don’t sell personal information, and we don’t share it for cross-context behavioural advertising.

5. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete it or make it anonymous. In particular:

• Account information: for as long as your account is active, and for a reasonable period afterwards.
• Support tickets: a ticket’s channel in Discord is locked when the ticket closes and deleted about five days later. We keep the ticket and a copy of its conversation for as long as we need them to help you and to keep a record of how issues were resolved. You can ask us to delete them at any time.
• Purchase and transaction records: for as long as tax, accounting or other laws require, which is often several years.
• Logs: for a short operational period, unless we need them longer to investigate a security issue or abuse.

Information recorded on a blockchain is permanent. Neither we nor anyone else can delete or change it.

6. Security

We use technical and organisational measures to protect personal information, such as encryption in transit, access controls, and limiting access to the staff who need it. For example, our support dashboard can be used only by Moku staff signed in with their company accounts. No system is perfectly secure, so we can’t guarantee security. If a breach affects your personal information, we will notify you and the regulators where the law requires it.

7. Cookies and local storage

• Essential: cookies that keep you signed in and keep the Services secure.
• Preferences and saves: your browser’s local storage, which holds settings, binder layouts and some game saves.
• Analytics: tools that help us understand usage and performance.

We don’t use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but some Services won’t work without the essential ones. The Services don’t respond to “Do Not Track” signals.

8. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is wrong;
• have your information deleted;
• restrict or object to how we use it;
• receive your information in a portable format;
• withdraw consent you have given; and
• not be treated differently for exercising these rights.

To make a request, email support@moku.gg with “Privacy Request” in the subject line, or open a support ticket in our Discord. This includes asking us to delete your support tickets or any other data our Discord apps hold about you. We may need to verify your identity first, and we will respond within 30 days, or sooner if the law requires.

You can unsubscribe from marketing emails using the link in any of them. You also have the right to complain to your local data protection authority. We can’t delete or change information recorded on a blockchain.

9. Children

The Services aren’t directed to children under 13, and we don’t knowingly collect personal information from them. Some Services require you to be 18 or older. If you believe a child has given us personal information, contact us and we will delete it.

10. International transfers

We are based in Costa Rica, and our service providers operate around the world, including in the United States and the European Union. When we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we use safeguards such as the European Commission’s Standard Contractual Clauses.

11. California residents

If you live in California, you have the right to know what personal information we collect, to have it deleted or corrected, and to opt out of its sale or sharing. In the past 12 months we collected the categories described in Information we collect: identifiers, commercial information, internet and gameplay activity, approximate location derived from your IP address, and the content of support conversations. We used them for the purposes in How we use information and disclosed them to the recipients in How we share information. We do not sell or share personal information, including that of anyone under 16. You can exercise your rights yourself or through an authorised agent, using the contact details below.

12. Third-party services

The Services link to and work with services we don’t control, such as Discord, Google, wallets, blockchains and marketplaces. Their own privacy policies apply to the information they collect.

13. Changes to this policy

We may update this policy. We’ll post the new version on this page and change the “Last updated” date. If a change is significant, we’ll also give notice, for example on our website, in our Discord or by email.

14. Contact us

Degenku, which runs the Moku brand, is responsible for your personal information (the “controller”). To ask a question or make a request:

• Email: support@moku.gg, with “Privacy Request” in the subject line
• Discord: open a support ticket in the Moku Discord