Privacy Policy

1. Information We Collect

SkillClassics collects minimal personal information. Depending on your authentication method, we may collect:

• Wallet Address: Your public blockchain wallet address, which is used as your account identifier. This is inherently public on the blockchain.
• Email Address: If you sign in via Google, X, or Email OTP, we store the associated email address for authentication purposes and for referral integrity (see below).
• Username: An optional display name you may set on your profile.
• Game History: Records of all matches played, including moves, outcomes, and timestamps.
• Chat Messages: Messages sent in lobby chat, room chat, and forum posts.
• Two-Factor Authentication Data: If you enable 2FA, we store your authenticator secret in encrypted form, used only to verify the codes you enter. It is never displayed or transmitted back in plaintext.
• Bug Reports: If you submit an in-app bug report, we collect your description, an optional screenshot you choose to attach, and basic technical context (page, browser). The screenshot is user-initiated and may contain whatever is on your screen at the time.
• Network Metadata: We record the IP addresses your account connects from, and your approximate country and region derived from them. This is used for security, abuse and multi-account prevention, referral integrity, and to enforce the jurisdiction restrictions described in our Terms. It is not used for advertising, analytics, or behavioural profiling.

Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to facilitate matches, escrow settlement, leaderboard rankings, and account management.
• Legitimate Interest (Art. 6(1)(f)): Anti-cheat detection, security measures, fraud prevention, and maintaining platform integrity.
• Consent (Art. 6(1)(a)): Optional features such as chat messaging, forum participation, and profile customization. You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable anti-money laundering regulations and legal requests.

2. Data Controller

The data controller for your personal data is:

If you have concerns about our processing of your personal data, you have the right to lodge a complaint with a data protection supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

3. Information We Do NOT Collect

We are committed to minimal data collection:

• No localStorage Tokens: We do not store authentication tokens in your browser's localStorage. All session management uses HttpOnly cookies.
• No Third-Party Tracking: We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.
• No Marketing Cookies: We do not place marketing or advertising cookies.
• No Tracking or Profiling: We do not use your IP address for advertising, analytics, or behavioural profiling. Limited network metadata is retained for security and abuse prevention — see section 1 for what we collect and section 7 for how long we keep it.
• No Private Keys: We never have access to your wallet private keys.

4. How We Use Information

The information we collect is used solely for:

• Match Facilitation: Connecting you with opponents, validating moves, and settling outcomes.
• Leaderboard Rankings: Calculating and displaying ELO ratings and win statistics.
• Automated Integrity Checks: Analyzing gameplay patterns to detect potential cheating.
• Platform Communication: Delivering in-game chat and forum functionality.
• Account Security: Rate limiting and session management to protect your account.
• Referral Integrity: Comparing limited account signals — connection IP history and, for social sign-in, the sign-in email — between a referrer and a referred player to detect self-referral.

5. Cookies

SkillClassics uses only essential cookies:

• Session Cookie (HttpOnly): A secure, HTTP-only cookie that maintains your authentication session. This cookie cannot be accessed by JavaScript, protecting against XSS attacks.
• Chain Preference: Your selected blockchain network preference may be stored locally.

We do not use analytics cookies, advertising cookies, or any third-party cookies.

6. Blockchain Data

Please be aware that blockchain transactions are public and permanent by design. When you interact with our smart contracts (depositing entry fees, claiming earnings), the following information is publicly visible on the blockchain:

• Your wallet address
• Transaction amounts and timestamps
• Smart contract interactions

This is a fundamental property of blockchain technology and is outside our control. We recommend using a dedicated gaming wallet if you wish to maintain separation from your primary financial wallet.

7. Data Retention

• Chat Messages: Automatically pruned after 7 days.
• Game History: Stored indefinitely to support leaderboards and player profiles. Retention is justified under legitimate interest (Art. 6(1)(f)) for leaderboard integrity, anti-cheat analysis, and dispute resolution.
• Authentication Sessions: Expire after 24 hours of inactivity.
• Forum Posts: Stored indefinitely unless deleted by the author.
• Rate Limiting Data: Temporary, cleared automatically after the rate window expires.
• Network Metadata: Connection IP history is retained for the life of the account under legitimate interest (Art. 6(1)(f)) for security, multi-account and abuse prevention, and jurisdiction compliance.

8. Third-Party Services

We use the following third-party services:

• Openfort: For embedded wallet creation and management for social login players. Openfort processes your OAuth tokens to create your embedded wallet. See Openfort's Privacy Policy.
• Price Data Providers: We fetch live cryptocurrency price data from third-party providers. No user data is sent to them.
• Blockchain Networks: When you interact with smart contracts (depositing entry fees, claiming earnings), transaction data is recorded on public blockchain networks (currently BNB Chain, plus the Ethereum Sepolia and BSC Testnet test networks; additional networks as we expand). This data is inherently public and immutable, and is not controlled by SkillClassics.
• On-Chain Price Feeds: Decentralized oracle price feeds are used for token pricing. No user data is transmitted to them.

We do not sell, share, or transfer your personal information to any other third parties.

9. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights:

• Right of Access (Art. 15): View your game history, profile information, and chat history through the Platform. You may also request a structured summary of all personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data. You can update your username and profile information directly through the Platform.
• Right to Erasure (Art. 17): Request deletion of your forum posts, chat messages, and profile information by contacting support. Note: on-chain transaction history cannot be deleted due to blockchain immutability, and game history may be retained where we have a legitimate interest (anti-cheat, leaderboard integrity).
• Right to Restrict Processing (Art. 18): Request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of your data or assess a legitimate interest claim.
• Right to Object (Art. 21): Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability (Art. 20): Request your personal data in a structured, commonly used, machine-readable format (JSON). This includes your game history, profile data, and ELO ratings. Contact support@skillclassics.com to request an export.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Export Your Keys: Social login players can export their embedded wallet private key from Settings (Security) at any time.
• Account Deactivation: Contact support to deactivate your account.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.

To exercise any of these rights, contact us at support@skillclassics.com. We will respond to your request within 30 days.

10. Security Measures

We implement the following security measures to protect your data:

• HttpOnly session cookies (resistant to XSS attacks)
• Rate limiting on all authentication endpoints
• Server-side player identity verification on every move
• Optional authenticator-app two-factor authentication (2FA), with the secret stored encrypted at rest
• Isolated signing keys to prevent cross-chain replay attacks
• Production startup validation (refuses to start with default keys)

11. Cross-Border Data Transfers

SkillClassics backend infrastructure is hosted in Singapore and Brazil. Our frontend is served via Bunny CDN (Slovenia) with a permanent mirror on Arweave. If you access the Platform from outside these regions, your personal data may be transferred to and processed in countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Singapore's Personal Data Protection Act (PDPA) and Brazil's Lei Geral de Proteção de Dados (LGPD) provide supplementary domestic data protection.
• The EU-U.S. Data Privacy Framework, where applicable.

Blockchain transaction data is stored on globally distributed, decentralized networks and is publicly accessible by design. This is an inherent property of blockchain technology and falls outside the scope of traditional cross-border transfer mechanisms.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the supervisory authority: Within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Notify affected players: Without undue delay where the breach is likely to result in a high risk to your rights and freedoms, as required by GDPR Article 34.
• Document the breach: Maintain records of all breaches, including their effects and remedial actions taken.

Breach notifications will be communicated via email (if we have your email address) and prominently displayed on the Platform.

13. Children's Data

The Platform is not intended for individuals under the age of 18 (or the legal age of majority in the applicable jurisdiction). We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly.

If you believe that a minor has provided us with personal data, please contact us at support@skillclassics.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Platform after changes constitutes acceptance of the updated policy.

15. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at support@skillclassics.com or visit our Contact page.

SkillClassics DAO LLC (Wyoming, USA)
Technology by Oh-Kay Labs