Privacy Policy

Last Updated: March 23, 2026

Foundly Labs Pty Ltd

This Privacy Policy describes how Foundly Labs Pty Ltd ("Foundly Labs," "we," "us," or "our"), an Australian proprietary limited company registered in Queensland, Australia, collects, uses, stores, and protects your information when you use the Farverse Games Hub platform, including all games, services, features, and blockchain-integrated functionality (collectively, the "Platform").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use the Platform.

This Privacy Policy should be read in conjunction with our Terms of Service.

1. Information We Collect

We collect the following categories of information when you use the Platform:

Wallet and Blockchain Data

Wallet Address. Your public cryptocurrency wallet address, which serves as your primary identifier on the Platform.

Transaction Data. Records of purchases and transactions you make through the Platform, including transaction hashes, amounts, payment currency (USDC or $FARVERSE), timestamps, and associated item or service details.

On-Chain Activity. Your interactions with smart contracts deployed by Foundly Labs, including token claims, staking activity, and NFT interactions. This data is inherently public on the blockchain.

Farcaster Profile Data

If you authenticate or interact with the Platform through Farcaster, we collect information from your public Farcaster profile, including:

Farcaster ID (FID)

Username and display name

Profile picture URL

Linked wallet addresses

Farcaster Pro status

Game Data

Player progress, statistics, and achievements within each game

In-game collections, inventory, and equipment

Rewards tier, loyalty points, and daily streaks

Technical and Device Data

IP Address. Collected from request headers for security, geolocation, and anonymous ad tracking purposes.

User Agent. Your browser and device information as provided in HTTP request headers.

Country. Your approximate country-level location, determined via server-side headers provided by our hosting infrastructure.

Anonymous Identifiers

For the purposes of anonymous ad impression tracking, we generate a daily rolling anonymous identifier using a one-way cryptographic hash. This identifier cannot be used to identify you personally, resets every 24 hours, and is not stored persistently.

Communication Data

Notification tokens and push notification subscription preferences

Your preferences for receiving communications from us

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Platform. To operate, maintain, and deliver the Platform and all games, features, and services

Processing Transactions. To process in-game purchases, verify payments, and maintain transaction records

Game Functionality. To track your progress, manage your inventory, calculate rewards, and deliver gameplay experiences across all games

Authentication. To verify your identity through wallet signatures and Farcaster authentication, and to maintain your session via secure cookies

Security. To detect, prevent, and address fraud, abuse, cheating, unauthorized access, and other harmful activities

Ad Delivery. To deliver and measure the performance of self-serve advertisements displayed within the Platform using anonymous identifiers

Geolocation. To enforce geographic access restrictions where applicable

Communication. To send you notifications related to your gameplay, transactions, and Platform updates, where you have opted in

Compliance. To comply with applicable laws, regulations, and legal obligations

Improvement. To analyze usage patterns and improve the Platform, games, and services

We do not sell your personal information to third parties. We do not use third-party advertising networks or cross-site tracking technologies.

3. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal bases for processing your personal data are:

Performance of a Contract. Processing necessary to provide the Platform and fulfill our obligations under the Terms of Service, including processing transactions, maintaining your account, and delivering game functionality.

Legitimate Interests. Processing necessary for our legitimate interests, including security, fraud prevention, Platform improvement, and ad measurement, where those interests are not overridden by your rights and freedoms.

Consent. Processing based on your explicit consent, such as push notification subscriptions. You may withdraw consent at any time.

Legal Obligation. Processing necessary to comply with applicable laws and regulations.

4. Blockchain and Public Data

The Platform operates on the Base blockchain, a public, decentralized network. You acknowledge and agree that:

Wallet addresses and blockchain transactions are publicly visible. Anyone can view your wallet address, token balances, transaction history, NFT holdings, and smart contract interactions on the Base blockchain using publicly available block explorers.

Blockchain data is permanent and immutable. Foundly Labs cannot modify, delete, or remove any data that has been recorded on the blockchain. This includes transaction hashes, token transfers, NFT mints, and any other on-chain activity.

On-chain data is outside the scope of deletion requests. While we can delete your off-chain data (game progress, profile information, session data) upon request, we cannot delete information recorded on the blockchain. Your right to erasure under applicable privacy laws does not extend to publicly recorded blockchain data.

5. Cookies and Local Storage

Cookies

The Platform uses a single essential cookie:

Session Cookie. A secure, encrypted session cookie with a seven (7) day expiration that stores your session information. This cookie is strictly necessary for authentication and cannot be disabled while using the Platform.

We do not use third-party cookies, advertising cookies, or analytics cookies.

Client-Side Storage

The Platform uses standard browser storage mechanisms (such as localStorage and sessionStorage) to maintain client-side application state, including UI preferences and cached game data. This data is stored locally on your device and is not transmitted to our servers.

6. Third-Party Services

The Platform integrates with third-party services to operate, including blockchain networks, social identity providers, wallet and payment processors, database and hosting infrastructure, and content delivery services. These services may process your data as necessary to provide their respective functions, and each is governed by its own privacy policy.

You interact directly with the Base blockchain (where transactions, tokens, and NFTs are recorded) and the Farcaster protocol (for authentication and social features). Your use of these protocols is subject to their inherent properties, including the public nature of blockchain data.

We do not share your personal information with third-party services beyond what is necessary for them to provide their respective functions.

7. Data Sharing

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

Service Providers. With third-party service providers who process data on our behalf as described in Section 6, subject to contractual obligations to protect your data.

Legal Requirements. When required to comply with applicable laws, regulations, court orders, or governmental requests.

Protection of Rights. To protect the rights, property, or safety of Foundly Labs, our users, or the public.

Business Transfers. In connection with a merger, acquisition, reorganization, or sale of assets, in which case your information may be transferred to the successor entity.

With Your Consent. In any other circumstances where you have provided explicit consent to the sharing.

8. Data Retention

Off-Chain Data. We retain your off-chain data (game progress, profile information, transaction records, session data) for as long as your account is active or as needed to provide you with the Platform. Following account deletion or a valid deletion request, we will delete your off-chain personal data within thirty (30) days, except where retention is required by law or for legitimate business purposes (such as fraud prevention or dispute resolution).

Blockchain Data. Data recorded on the blockchain (transaction hashes, wallet addresses, token transfers, NFT interactions) is permanent and cannot be deleted by Foundly Labs or any party. This data will persist on the blockchain indefinitely.

Anonymous Data. Anonymized and aggregated data that cannot be used to identify you may be retained indefinitely for analytical purposes.

9. Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Secure, encrypted cookies for session management

Server-side management of sensitive credentials and API keys

Normalized and validated data inputs

Access controls on database and infrastructure resources

However, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your information. You are responsible for maintaining the security of your wallet credentials, private keys, and any devices you use to access the Platform.

10. International Data Transfers

Foundly Labs is based in Queensland, Australia. Your information may be transferred to and processed in countries other than your country of residence, including but not limited to the United States, where our infrastructure providers operate data centres.

If you are located in the EEA or UK, transfers of your personal data to countries outside the EEA/UK that have not been deemed to provide an adequate level of data protection will be made subject to appropriate safeguards, such as standard contractual clauses approved by the European Commission.

If you are located in Australia, your information may be transferred overseas in accordance with Australian Privacy Principle 8 of the Privacy Act 1988 (Cth).

By using the Platform, you consent to the transfer of your information to countries outside your country of residence as described in this section.

11. Your Rights

All Users

Regardless of your location, you may:

Request access to the personal information we hold about you

Request correction of inaccurate personal information

Request deletion of your off-chain personal data (subject to the limitations described in Section 4 regarding blockchain data)

Withdraw consent for processing based on consent at any time

Opt out of non-essential communications

Australian Users

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

Access your personal information held by us

Request correction of your personal information

Make a complaint to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

European Economic Area and United Kingdom Users (GDPR)

If you are located in the EEA or UK, you have the following additional rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

Right of Access. The right to obtain confirmation of whether we process your personal data and to receive a copy of that data.

Right to Rectification. The right to request correction of inaccurate personal data.

Right to Erasure. The right to request deletion of your personal data, subject to certain exceptions (including blockchain data as described in Section 4).

Right to Restriction. The right to request restriction of processing of your personal data in certain circumstances.

Right to Data Portability. The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object. The right to object to processing of your personal data based on legitimate interests.

Right to Lodge a Complaint. The right to lodge a complaint with your local data protection supervisory authority.

California Users (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know. The right to know what personal information we collect, use, disclose, and sell.

Right to Delete. The right to request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out. The right to opt out of the sale or sharing of your personal information. We do not sell or share your personal information as defined by the CCPA/CPRA.

Right to Non-Discrimination. The right not to receive discriminatory treatment for exercising your privacy rights.

To exercise any of these rights, please contact us at contact@foundly.dev. We will respond to your request within the timeframe required by applicable law (generally within 30 days).

12. Children's Privacy

The Platform is not intended for use by anyone under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a user under 18, we will take steps to delete that information and terminate the associated account as promptly as possible. If you believe that a child under 18 has provided us with personal information, please contact us at contact@foundly.dev.

13. Advertising and Tracking

The Platform includes a self-serve advertising system. Advertisements displayed within the Platform are managed directly by Foundly Labs and approved advertisers through our internal system.

No Third-Party Ad Networks. We do not use third-party advertising networks within the Platform. No third-party advertisers place cookies or tracking technologies on your device through our Platform.

Anonymous Impression Tracking. We track ad impressions and clicks using anonymous identifiers that cannot be linked to your personal identity. These identifiers are generated using a one-way cryptographic hash that resets daily.

No Cross-Site Tracking. We do not track your activity across other websites or platforms.

14. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no accepted standard for how to respond to DNT signals, and because the Platform does not engage in cross-site tracking, we do not currently respond to DNT signals. This policy may be updated if a uniform standard is adopted.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Updated versions will be posted on the Platform with a revised "Last Updated" date. Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically for any changes.

16. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: