PRIVACY POLICY

1. WHO WE ARE

The $GYMBRO ecosystem is operated from the United Arab Emirates. The legal data controller responsible for the personal data described in this policy is the operator of gymbrocrypto.com (the "Operator"). You can contact us at any time at [email protected].

Because the $GYMBRO ecosystem operates on the BNB Chain — a public, permissionless blockchain — some categories of data we describe below are recorded on-chain by design and cannot be edited or deleted by us or anyone else. We explain this in detail in Section 9.

2. DATA WE COLLECT

We try to collect only what we need to operate the service. The categories below cover everything the $GYMBRO ecosystem actively records.

2.1 Identifiers you provide

• Wallet address — when you sign in with a Web3 wallet (MetaMask, Trust Wallet, etc.), we store your wallet's public address.
• Telegram identifier — when you sign in via Telegram (e.g. for Dan AI), we store your Telegram user ID and public username.
• Email address — if you provide one (e.g. for support requests, newsletters, or account linking), we store it.
• Display name — any nickname or screen name you choose to set.

2.2 Technical data collected automatically

• IP address — recorded in our server logs for each API request. Used for rate-limiting, fraud detection, and security forensics.
• User-agent string — browser and device identifier sent automatically by your browser.
• Request timestamps and paths — what endpoints you hit and when.
• Cookies and local storage — used to maintain your session (so you stay logged in). We do not use third-party advertising cookies.

2.3 Activity data (when you use the services)

• Game session data — start/end timestamps, scores, replay payloads used for anti-cheat validation, server-generated random seeds and commit hashes.
• Pass purchases and credits — which tier you bought, when, how many plays remain.
• Leaderboard standings — your scores and ranks in daily, weekly and game-specific leaderboards, displayed publicly within the service.
• Dan AI conversations — messages exchanged with the Dan AI Telegram bot, retained to provide continuity in coaching.
• Body Scan submissions — images and analysis results, if you choose to use the Body Scan tool.

2.4 On-chain data (public by nature)

• Transaction hashes — every $GYMBRO transfer to or from our arcade wallets is recorded on the BNB Chain and visible to anyone via BSCScan or any block explorer.
• Wallet-to-wallet flows — when you purchase a pass or receive a payout, the transfer between your wallet and ours is permanently recorded on a public ledger.

3. HOW WE USE YOUR DATA

We use the data we collect for the following purposes only:

• Service delivery — authenticating you, recording game sessions, matching payments to passes, queueing and dispatching prize payouts.
• Anti-cheat and fraud prevention — validating game session integrity, detecting abnormal patterns, manually reviewing high-value or suspicious payouts.
• Customer support — answering questions sent to [email protected].
• Security — protecting the service from abuse, rate-limiting, investigating incidents.
• Service improvement — understanding which features are used, fixing bugs, planning new games and features.
• Legal compliance — meeting our obligations under applicable laws and responding to lawful requests from authorities.

We do not sell your personal data. We do not show third-party advertising based on your data. We do not use your data to train external AI models.

4. LEGAL BASIS FOR PROCESSING (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract — to deliver the services you signed up for (game sessions, pass purchases, payouts).
• Legitimate interests — for fraud prevention, anti-cheat, security logging, and basic service analytics. We balance these interests against your rights.
• Consent — for any optional features you actively opt into (e.g. newsletters, marketing emails). You may withdraw consent at any time.
• Legal obligation — where we are required by law to retain or disclose certain data.

5. THIRD-PARTY PROCESSORS

We rely on a small number of trusted third-party service providers to operate the $GYMBRO ecosystem. Each handles only the data necessary for its function and is contractually or terms-of-service bound to protect it.

Provider	Purpose	Data handled
Railway	Application hosting and database	All operational data
Cloudflare	CDN and DDoS protection	IP addresses, request metadata
Namecheap	Domain, frontend hosting, email	Email correspondence, static page requests
Moralis	BNB Chain transaction monitoring	Wallet addresses, transaction events
Telegram	Dan AI bot interface	Telegram messages and user IDs
UptimeRobot	Service availability monitoring	Endpoint health pings only
BNB Chain / BSCScan	Public blockchain ledger and explorer	Wallet addresses, transaction hashes, amounts (public)

None of these providers receives access to data beyond what is strictly necessary for the function shown above.

6. INTERNATIONAL DATA TRANSFERS

The $GYMBRO ecosystem operates globally. Your data may be processed in countries other than your own, including in the United States (where Railway, Cloudflare and other providers operate), the European Union, and the United Arab Emirates. Where required by law (e.g. for users in the EEA), we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our providers.

7. DATA RETENTION

We keep your personal data only as long as we need it. Specifically:

• Account data (wallet, email, Telegram ID) — for as long as your account is active and for up to 24 months after last activity.
• Game session data and scores — retained indefinitely for leaderboard history and anti-cheat audit purposes.
• Server logs and IP addresses — typically rotated after 90 days, except where required for incident investigation.
• Support correspondence — kept for up to 36 months for service quality and dispute resolution.
• On-chain data — permanent and cannot be deleted. See Section 9.

8. YOUR RIGHTS

8.1 Rights under GDPR (EEA, UK, Switzerland)

If you are in the EEA, the UK or Switzerland, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to the limits in Section 9
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw consent for any consent-based processing
• Lodge a complaint with your local data protection authority

8.2 Rights under CCPA / CPRA (California residents)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and the sources, purposes, and recipients
• Request access to the specific pieces of personal information we hold about you
• Request deletion of your personal information, subject to legal exceptions and Section 9
• Opt out of "sale" or "sharing" of personal information — we do not sell or share your data for advertising purposes
• Be free from discrimination for exercising your privacy rights

8.3 How to exercise your rights

Send an email to [email protected] from the email address associated with your account, or include a wallet signature proving control of the wallet associated with your account. We will respond within 30 days (GDPR) or 45 days (CCPA), or explain any extension required.

9. ON-CHAIN DATA — IMPORTANT LIMITATION

This means:

• Your wallet address, the transaction hashes of your pass purchases and your prize payouts, the amounts transferred, and the timestamps are all recorded on the BNB Chain forever.
• Anyone in the world can view this data using a block explorer like BSCScan. We do not control what others do with publicly available on-chain data.
• If you exercise your "right to deletion", we will delete your data from our own systems where legally and technically possible, but we cannot remove anything from the blockchain.
• If you would like to limit the on-chain footprint associated with your real identity, consider using a separate wallet address that you do not link to your name or other identifiers anywhere else.

10. COOKIES AND TRACKING

We use a minimal set of cookies and similar storage:

• Essential session cookies — required to keep you logged in and to maintain CSRF protection. Cannot be disabled if you wish to use the authenticated parts of the service.
• Preference cookies — remember your language and light/dark mode settings.
• Google Translate — when you use the language switcher, Google's translation service may set its own cookies. See Google's privacy policy for details.

We do not use third-party advertising or analytics cookies that track you across sites.

11. CHILDREN'S PRIVACY

The $GYMBRO ecosystem is intended for users aged 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact [email protected] and we will delete it from our systems.

12. DATA SECURITY

We use reasonable technical and organisational measures to protect your data, including:

• TLS encryption for all traffic between your device and our servers
• Encryption at rest for our database
• Access controls restricting who on the Operator's team can see operational data
• Separate hot and cold wallet architectures (planned and progressively rolled out) to limit the impact of any single key compromise
• Regular security reviews of our codebase, dependencies, and third-party integrations

No system is perfectly secure. If we ever discover a breach affecting your personal data, we will notify you and the relevant authorities within the timeframes required by applicable law.

13. CRYPTOCURRENCY AND WEB3 DISCLAIMERS

By using the services you acknowledge:

• You are solely responsible for the security of your wallet's private keys. We cannot recover lost keys or reverse unauthorised transactions from your wallet.
• Transactions on the BNB Chain are irreversible. If you send tokens to the wrong address, neither we nor any third party can recover them.
• Gas fees, network congestion and price volatility are inherent to blockchain operation and outside our control.
• Smart contracts may contain bugs despite professional audits. We make no guarantee of perfect security.
• The value of $GYMBRO tokens can go up or down. Nothing in our services constitutes investment advice.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our services or in applicable law. When we do, we will update the "Last updated" date at the top of this page. Material changes will be announced via our public channels (website banner, Telegram, or email where appropriate). Continued use of the services after a change constitutes acceptance of the updated policy.

15. CONTACT US

If you have questions about this Privacy Policy or about how we handle your data, please contact us at:

• Email: [email protected]
• Telegram: t.me/GYMBRO_CryptoBot