Privacy Policy

Last updated: 21 October 2026

Privacy Policy

Effective date: January 1, 2026

Turtz ("we", "our", "us") is the first gaming layer on Arc. This Privacy Policy describes how we collect, use, and protect information when you use the Turtz platform at turtzgaming.wtf ("Service").

1. Information We Collect

1.1 Account Information (X/Twitter OAuth)

When you sign in with X (Twitter), Supabase Auth receives and we store:

  • Your X user ID and username.
  • Your X display name and public avatar URL.
  • OAuth access tokens (encrypted at rest, used only for session maintenance).

    • We do not access your X direct messages, follower lists, or any non-public X data.

    1.2 Platform Activity

  • Game sessions: score (normalised), duration, timestamp. Raw scores are never stored beyond session scoring.
  • Economy events: iTurtz earnings, spending, adjustments (tracked as ledger entries; history is never deleted).
  • Whitelist applications: answers you provide, timestamps, admin decision and notes.
  • Social tasks: task IDs, evidence links you submit.
  • Leaderboard position: derived from your activity, publicly visible.

    • 1.3 Wallet Information

    If you optionally link an EVM wallet:

  • We store your wallet address and chain ID.
  • We verify ownership via a cryptographic signature over a server-issued nonce. We never ask for or store your private key or seed phrase.

    • 1.4 Technical Data

  • IP address (via Supabase; used for abuse detection, not stored by the app).
  • Browser and device type (standard Next.js / Vercel request metadata).
  • Cookies: a single httpOnly session cookie issued by Supabase Auth.

    • 2. How We Use Your Information

    PurposeLegal basis

    |---|---|

    Provide and operate the ServiceContract performance
    Authenticate your sessionContract performance
    Calculate and credit rewards (XP, iTurtz)Contract performance
    Prevent fraud, score manipulation, and platform abuseLegitimate interests
    Respond to support enquiriesLegitimate interests
    Comply with legal obligationsLegal obligation

    We do not sell, rent, or share your personal information with advertisers.

    3. iTurtz and $TURTZ

    iTurtz is an off-chain, platform-internal currency. It has no guaranteed monetary value and is not a financial instrument. $TURTZ is a future on-chain token that is not live at publication of this policy; this policy will be updated before any on-chain conversion is enabled.

    4. Data Retention

  • Account data: retained until you request deletion or your account is permanently banned.
  • Ledger/transaction history: retained indefinitely (regulatory audit trail).
  • Admin audit logs: retained indefinitely.
  • Game session logs: retained for 24 months.

    • 5. Your Rights

    Depending on your jurisdiction you may have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Delete your account and associated personal data (note: ledger history may be anonymised rather than deleted to preserve accounting integrity).
  • Object to processing based on legitimate interests.
  • Data portability: receive a machine-readable copy of your data.

    • To exercise any right, contact us at legal@turtzgaming.wtf.

    6. Cookies

    We use a single first-party httpOnly session cookie set by Supabase Auth. We do not use advertising cookies or third-party tracking pixels.

    7. Third-Party Services

    ServicePurposeData shared

    |---|---|---|

    Supabase (supabase.com)Database, auth, storageAll platform data
    Vercel (vercel.com)Hosting, edge runtimeRequest metadata
    X (Twitter)OAuth sign-inPublic profile only

    8. Security

    We employ:

  • Row Level Security (RLS) on all database tables.
  • Encrypted-at-rest Supabase storage.
  • Server-side validation for all privileged operations.
  • Service-role key never exposed to the browser.
  • Admin actions logged to an immutable audit trail.

    • No system is 100% secure. Please notify us immediately at security@turtzgaming.wtf if you discover a vulnerability.

    9. Children

    The Service is not directed at users under 13. We do not knowingly collect data from minors. If you believe a minor has signed up, contact us at legal@turtzgaming.wtf and we will delete the account.

    10. Changes to This Policy

    We will post material changes here with an updated effective date. Continued use of the Service after changes constitutes acceptance.

    11. Contact

    Turtz / Arc · legal@turtzgaming.wtf