PRIVACY POLICY

Last updated: February 2026

1. INFORMATION WE COLLECT

When you use Smuggler's Run, we collect the following information:

• Account data: Email address, username, and hashed password. If you sign in via Google OAuth, we receive your Google profile ID and email.
• Game data: Run scores, turns played, zones completed, equipment inventory, currency balances, and leaderboard rankings.
• Payment data: When you purchase Flux, payment is processed by Stripe. We store Stripe transaction IDs and purchase amounts. We never store credit card numbers or payment credentials.
• Blockchain data: If a wallet is created for your account, we store the wallet address and on-chain token IDs associated with your equipment. Wallet key management is handled by Privy, a third-party service.

2. HOW WE USE YOUR DATA

• Authentication: To verify your identity and maintain your session
• Gameplay: To track your progress, inventory, and game state
• Leaderboards: To display your username and scores on seasonal leaderboards
• Payments: To process Flux purchases and maintain transaction records
• Communication: To send account-related notifications (e.g., terms updates)

3. THIRD-PARTY SERVICES

We use the following third-party services that may process your data:

• Stripe — Payment processing. Stripe's privacy policy: stripe.com/privacy
• Google OAuth — Optional sign-in authentication. Google's privacy policy: policies.google.com/privacy
• Privy — Server-side wallet management for blockchain features
• Pimlico — Blockchain transaction relay (account abstraction)

4. DATA STORAGE AND SECURITY

Your data is stored in a PostgreSQL database hosted on Google Cloud Platform. All connections use TLS encryption. Passwords are hashed using bcrypt. Authentication tokens (JWT) are stored in your browser's localStorage.

Payment processing is handled entirely by Stripe. We are not PCI-DSS certified because we never handle, store, or transmit credit card data — Stripe does this on our behalf.

5. COOKIES AND LOCAL STORAGE

We do not use tracking cookies. We use browser localStorage to store:

• Your authentication token (JWT) for maintaining login sessions
• Audio mute preference

6. DATA RETENTION

We retain your account data for as long as your account is active. Game data (scores, runs) is retained for leaderboard integrity. Payment transaction records are retained as required by applicable financial regulations.

7. YOUR RIGHTS

You may request:

• Access: A copy of the personal data we hold about you
• Deletion: Removal of your account and associated personal data
• Correction: Updates to inaccurate personal information

To exercise these rights, contact support@smugglersrun.xyz. We will respond within 30 days.

8. CHILDREN'S PRIVACY

Smuggler's Run is not directed at children under 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from a child under 18, we will delete it promptly.

9. CHANGES TO THIS POLICY

We may update this privacy policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance.

10. CONTACT

For privacy-related questions or data requests, contact us at support@smugglersrun.xyz.