This policy explains what Galactic Kongress (“we,” “us”) collects when you use this site and game, why, and who it's shared with. It applies to [Legal Entity Name] operating Galactic Kongress at [domain].
What we collect
Depending on how you use the app:
- Account info — email address and/or username if you create an account; a securely hashed password if you use email/password sign-in (we never store your plaintext password); your Google profile name/email if you sign in with Google.
- Guest play — if you play without an account, we assign a random guest token stored in a browser cookie. No personal information is required to play as a guest.
- Wallet address — if you connect a crypto wallet, we store the public wallet address you sign with, used to check ownership of the Kongress Members NFT collection and to identify your account. We never have access to your private keys or wallet funds.
- Gameplay data — decks you build, cards you author (if you're a founding member or admin), game session history, leaderboard scores, and your $MNDK balance and transaction history.
- Purchase data — a record that you purchased $MNDK and how much, and your booster-pack purchase/opening history. We do not receive or store your card number or other raw payment details — those are handled entirely by Stripe (see below).
- Technical data — standard web logs (IP address, browser/device information) generated automatically by our hosting provider and used for security (e.g. rate-limiting abuse) and basic analytics.
How we use it
- To operate your account, save your progress, and run the game and store.
- To process $MNDK purchases and prevent fraud or abuse.
- To verify Kongress Members NFT ownership for founding-member features.
- To keep the service secure (rate limiting, detecting abuse, debugging errors).
- To communicate with you about your account, e.g. a magic sign-in link if you request one.
We do not sell your personal information.
Who we share it with
We use a small number of third-party services to run the app, each only for its specific purpose:
- Stripe — processes $MNDK purchases. Your payment details go directly to Stripe; we only receive confirmation that a payment succeeded and its amount.
- Google — if you choose to sign in with Google.
- Rarible — we send your public wallet address to Rarible's API to look up which NFTs it holds (read-only; we never initiate a transaction on your behalf).
- Anthropic and Google (Gemini) — founding members' and admins' card-authoring prompts (card names, descriptions) may be sent to these providers' APIs to generate card art or text. Player accounts that don't use card authoring never send data here.
- Our hosting provider — to run the servers and store data.
We don't share your data with anyone else, and we don't sell it.
Cookies
We use a session cookie to keep you signed in and a guest-token cookie so guest progress persists across visits. Both are functional, not advertising, cookies.
With your permission (asked via the banner on your first visit) we also use Google Analytics cookies to measure how the site and game are used. Analytics is off until you accept, advertising features and ad personalization are never enabled, and you can decline or change your choice at any time by clearing this site's data in your browser. If you accept, purchase-related events (such as buying a pack or $MNDK) may also be sent to Google Analytics tagged with your account ID, not your name or email.
Independently of that choice, we keep first-party records of economy activity (pack purchases, $MNDK purchases, card merges/repairs, daily rewards) in our own database to run and balance the game.
Your choices
- You can disconnect a linked wallet at any time from your dashboard.
- You can request that we delete your account and associated personal data by contacting us at [contact email] — we'll do so except where we're required to retain records (e.g. transaction records for tax/accounting purposes).
- You can ask what personal data we hold about you by contacting us at the same address.
Children
Galactic Kongress is not directed at children under 13, and we don't knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact us and we'll remove it.
Changes to this policy
If we make a material change, we'll update the date at the top of this page and, where appropriate, let signed-in users know.
Contact
Questions about this policy: [contact email].