Privacy policy
We collect as little as we can. This page lists what we keep, why, and for how long.
Draft pending legal review. It can still change before v1.0, published before the token launch.
In short
| Data | Where | Why | Kept |
|---|---|---|---|
| If you joined the waitlist before it closed (14 October 2026): your email and the time you signed up | Our database | One email when the token and the game launch | Until you ask us to delete it |
| A keyed hash of your IP address that changes every day | Our database | Limit repeated requests and abuse | Short term for rate limits. Kept in the error log and, once the game opens, with the record of each game action, which is never deleted |
| Support tickets: what you write, optional wallet address and optional email | Our database | Answer your ticket and keep a record if a problem comes back | The ticket stays as a record; the email is deleted 180 days after the ticket is answered or closed, the IP hash after 30 days |
| Page views, counted per page per day | Our database | See which pages are read | Daily totals only |
| Game settings, such as sound, the progress of test builds, the last box orders your wallet signed (wallet address and signature) and an action still waiting for an answer | Your browser (local storage) | Keep your settings between visits and finish a purchase if the connection drops | Until you clear your browser data; a pending action until it is answered or replaced |
| Request data: IP address and browser details | Cloudflare | Encryption, caching, and protection from attacks and bots | Under Cloudflare's privacy policy |
| Once the game opens: your wallet address, game state, balance history, box results, claims and a log of game actions | Our database and our on-chain gateway; on-chain actions are also public on the blockchain | Run your account, calculate balances, verify box results, pay claims and stop cheating | Balance history is never deleted (balances are calculated from it); blockchain data cannot be deleted by anyone |
| Once the game opens: a session cookie | Your browser; our database keeps only a hash of it | Keep you signed in to the game | Until it expires or you sign out |
| Once the token is live, if you swap in the Wallet tab: your wallet address, the amount and the transaction you sign | Jupiter (jup.ag), sent by our server | Get a swap route and send your signed transaction | Under Jupiter's privacy policy; the result is kept in our log of game actions |
Support tickets
A ticket keeps what you wrote, the category, an optional public wallet address, an optional email for the answer, a keyed hash of your IP address (to stop spam) and technical details (the page it came from and a shortened browser description). Only the team sees it. The email is used only to answer that ticket and is deleted 180 days after the ticket is answered or closed; the IP hash is deleted after 30 days.
The waitlist (closed)
The waitlist closed on 14 October 2026: we no longer take sign-ups. If you joined before, we keep your email and the time you signed up. Nothing else: no name, no wallet, no referral code. We send one email, when the token and the game launch. No newsletter.
We don't sell the list or give it to anyone else. If we use an email delivery service to send the launch email, it receives the addresses only to deliver it.
To remove your email, use the unsubscribe link in the launch email, or the contact channel published on /links before the token launch. We delete it and confirm.
Anti-abuse
The support form and the wallet sign-in can use Cloudflare Turnstile to check that a person is sending them. Our server never stores your IP address. It keeps a keyed hash of it, which changes every day, to limit repeated attempts. If a request fails on our side, the error log keeps the same hash.
Page views and cookies
We count views per page per day. The count has no IP address, no cookie and no identifier.
We don't use tracking or advertising cookies, so there is no cookie banner. Cloudflare may set strictly necessary security cookies, for example to remember that a browser passed a bot check.
The game in your browser
The game at /play keeps your settings, such as sound, in your browser's local storage. Test builds also save their progress there. Once the game opens, your progress is kept on our server, not in your browser (see below); your browser also keeps the box orders your wallet signed and an action still waiting for an answer from our server, until it is answered or replaced. That copy stays on your device. Clearing your browser data deletes it.
When the game opens
You sign in by signing a message with your wallet (Sign In With Solana): no email, no password, no network fee. Your wallet address is your account. A session cookie keeps you signed in; our database keeps only a hash of it.
Your wallet address is public on the Solana blockchain, and so is every on-chain transaction it makes or receives, including boxes bought from the wallet and claim payouts. Anyone can see them and link them to that address. Neither we nor anyone else can delete data from the blockchain.
We store your game state, your balance history, every box result with the data needed to check it, your claims, and a log of every game action, with the daily hash of your IP address. We use them to calculate balances, verify box results, pay claims, stop cheating, spot automated play from the timing of game actions, and detect multiple accounts. Balance history is append-only: entries are never edited or deleted, because every balance is calculated from them.
Our on-chain gateway, a separate service of ours and the only part that talks to the blockchain, keeps its own database of box purchases (including the orders your wallet signs to pay from your game balance), rounds of box draws and claim payouts, by wallet address. Your browser reads the blockchain through your wallet app, under that app's own privacy policy.
Once the token is live (Solana mainnet), the game's Wallet tab can swap SOL and {token} through Jupiter (jup.ag). Our server, not your browser, asks Jupiter (api.jup.ag) for a route with your wallet address and the amount, and sends Jupiter the transaction your wallet signs. Jupiter handles that data under its own privacy policy. The page loads no scripts from Jupiter. The tab also links to jup.ag: if you follow the link, Jupiter sees your request data and wallet address under its own privacy policy.
Where it runs
Requests to globalcrisis.io pass through Cloudflare. The server runs on Railway and the database on Supabase, both in the eastern United States. When database backups are enabled, they are encrypted and kept on GitHub for 30 days. When the game opens, the on-chain gateway runs on Railway too, with its own database.
Your requests
To get a copy of your data or to delete it, use the contact channel published on /links. Balance history stays, for the reason above, and data on the blockchain can't be deleted. We don't knowingly collect data from anyone under 18.
Changes
Changes to this policy are posted on this page with a new version and date.