Privacy Policy

Effective date: October 25, 2026
Version: 2.0

This policy explains what Tudys ("we", "us", "our") collects when you use the Tudys website and services (the "Platform"), who can see it, and what you can do about it.

Tudys is a free fantasy sports game on the Sepolia test network. We don't ask for your name, email address, phone number or payment details, and we don't take payments.

1. What we collect

1.1 Your wallet address

Your wallet address is your player ID. We store it with everything you do on Tudys: the leagues you join or run, your picks and points, invites you send or receive, and requests to join.

A wallet address doesn't show your name, but it is a permanent public identifier. Anyone who knows it can look up its history on the blockchain, and it can sometimes be linked to a real person.

1.2 Sign-in data and the session cookie

Sign-in messages. When you sign in, you sign a message with your wallet. We check the signature, and we store the one-time code from the message for up to a day so it can't be reused.
Wallet session cookie. After you sign the session message, we set one cookie that holds your wallet address, its expiry time and a signature that proves we issued it. It lasts 24 hours, is HttpOnly (scripts on the page cannot read it), is sent only over HTTPS in production, and is used only to recognise your wallet on Tudys. You can end it at any time by signing out or clearing your cookies.

1.3 What you write

We store the text you add to the Platform:

nicknames: the one you use in a league, and those league staff give members or invited wallets;
invite link labels (often the name of the person a personal link is for);
league names and descriptions;
notes league staff post to their league;
join request messages: the optional message and nickname sent when you ask to join a league; and
the note you send when you ask to run leagues.

1.4 Game data

The leagues you are in, how you joined (for example, which invite link you used), your picks and when you made them, your points and table positions, whether you were removed from or banned in a league, and the decisions on your invites and requests to join.

1.5 Audit logs

For security, we keep an audit log of important actions, such as joining or leaving a league, picking, inviting, changing nicknames, moderating, deciding requests to join, failed sign-ins and all admin actions. Each entry records the wallet, the action, its result and details, the time, and the IP address and browser user agent of the request.

We also use IP addresses briefly, in memory, to limit how many requests one address can send. Those counters are not stored.

1.6 Analytics

We use queryoo, an analytics service, to count page views. Its script reports the address of the page you visit and the general information every web request carries (such as your browser and the referring page). We don't load it on invite link pages, so invite tokens never reach it.

1.7 On your device

Your browser keeps a few things locally, such as whether you've seen the "How it works" guide and your wallet connection (stored by the wallet connection library). We can't read these from our servers.

1.8 What we don't collect

We don't collect your private keys or recovery phrase, passwords, name, postal address, phone number, email address (unless you write to us), payment details, or device fingerprints.

2. Who can see what

Who	What they see
Anyone who can open a league page	The league's name, description and settings, and its table: each member's wallet address, nickname, points and right picks. A league hidden by platform admins shows none of this.
Other players	Your picks after each fixture has kicked off. Before kickoff, other players can't see which side you picked. Public share pages hide the team until kickoff.
Notes	A public league's notes can be read by anyone; a private league's notes only by its members and staff.
The league's owner and co-owners	Their members' wallet addresses and nicknames, how each member joined (including invite link labels), removed and banned members, the wallets they invited, and requests to join with their message and nickname.
Platform admins	Everything league staff see in any league, the requests to run leagues, and the audit log.
Everyone, on the blockchain	Anything that happens on-chain (see section 3).

Private leagues keep their invite list private: we never show it to people outside the league's staff.

3. On-chain data is public

Joining, picking and running a league happen off-chain, and the Tudys app sends no transactions. The only on-chain activity linked to Tudys is in the old staked leagues (see Legacy vault leagues): past joins, refunds the Tudys Core Safe sends to members' wallets, and claims members make from a vault themselves, outside the app. Those transactions are public, permanent records on the Sepolia blockchain that anyone can read with a block explorer. We can't change or delete them.

4. How we use your data

We use the data above only to:

run the game: show leagues, tables and picks, score picks and handle invites and requests to join;
recognise your wallet and keep your session;
keep the Platform secure and fair: prevent abuse, investigate reports and enforce our Terms and Fair play rules;
understand which pages people use, so we can improve them; and
comply with the law.

We don't sell your data and we don't use it for advertising.

5. Services we rely on

We share data with these services only as needed to run the Platform:

hosting and database providers, which store the data described above;
blockchain RPC providers, which your browser and our servers use to read the Sepolia network;
WalletConnect, if you connect a wallet through it;
queryoo analytics (section 1.6); and
sports data sources for fixtures, results and logos. We send them none of your data.

We may also disclose data if the law requires it, or to protect players or the Platform from serious harm.

6. How long we keep it

Game data and what you write stays while the league exists, so tables and league history keep working. Deleting a note or revoking an invite hides it from the Platform; the record may stay in our database.
One-time sign-in codes are deleted after about a day.
The session cookie expires after 24 hours.
Audit logs are kept as long as we need them to keep the Platform secure and investigate abuse. We don't yet delete them on a fixed schedule.
On-chain data is permanent and outside our control.

7. Your choices and rights

You can change your own nickname in a league, leave a league before it starts, withdraw a request to join, and sign out at any time.
Depending on where you live, you may have rights to access, correct, delete or object to the use of your data, and to complain to a data protection authority. To use them, contact us (section 10). We may need you to prove you control the wallet, for example by signing a message.
We can't delete on-chain data, and we may keep some records (such as audit logs) where we need them for security or by law. Deleting your data from a league's history can change its table.

8. Security

We use HTTPS, signed and HttpOnly session cookies, one-time sign-in codes, access checks on every private request and rate limits. No system is perfectly secure. Keep your wallet and recovery phrase safe; see the Testnet notice.

9. Children

Tudys is for people aged 18 or over. If you think a child has used it, contact us and we'll remove what we can.

10. Changes and contact

We may update this policy. When we do, we change the effective date and version at the top, and for important changes we tell you on the Platform.

Questions or requests: [SUPPORT EMAIL TO BE ADDED]
Data controller: [LEGAL ENTITY NAME AND ADDRESS TO BE ADDED]