Privacy notice

1. Controller and contact

The provider above is responsible for personal data processed to operate RoostDingers. Contact us at the email address above to exercise your data protection rights.

2. Visiting and playing without a wallet

The free practice game does not require an account, email address or wallet. Delivering pages, images, music and API responses involves your IP address, requested URL, time, browser/device information and technical error or security data. We process these to provide the requested service (Article 6(1)(b) GDPR) and to keep it available, secure and protected against abuse (Article 6(1)(f) GDPR; our legitimate interests are service reliability and security).

Fonts are hosted with the game. This release has no advertising trackers or project web analytics. Music begins after interaction. Merely opening the legal pages does not connect a wallet or load the game.

3. Functional storage on your device

The game uses local browser storage for language, audio and motion settings, replay speed, the tutorial hint, practice opponents, saved crews/presets, recent battle history and recovery information for pending transactions. These support the game and settings you request; they are not used for advertising. The rd: entries remain until replaced or you clear this site's browser data. Clearing them removes local progress and preferences but does not delete blockchain records. Wallet software and optional WalletConnect may store their own connection/session information.

Access to device storage that is strictly necessary for the requested functionality is based on Section 25(2) TDDDG. If optional tracking is introduced, it will require separate information and any legally required consent before activation.

4. Optional wallet and NFT features

If you connect a wallet, we process its public address, selected network, public collection and token identifiers, ownership data and any sign-in proof to verify ownership and provide your crew. A sign-in message is bound to this website; challenges expire after two minutes and are single-use, and the game session token expires after 30 minutes. The game never requests your recovery phrase or private key. An in-memory game session is separate from your wallet provider's own connection.

Ownership and NFT metadata may be read from public Robinhood or Avalanche RPCs, collection APIs and configured indexers. Those services receive the information necessary for the query; direct browser requests can also disclose your IP address. This processing serves the NFT features you request (Article 6(1)(b) GDPR); anti-fraud and ownership verification also protect the service and other players (Article 6(1)(f) GDPR).

5. Public battles, names and NFT careers

When you submit a blockchain transaction, your address, transaction, participating NFTs, defense/loadout information, chosen public crew name and battle result can become publicly readable worldwide. Ranked results, NFT careers and leaderboard data can be indexed by anyone and remain visible after an NFT transfer. Practice battles are stored locally unless you share them. Choose a fantasy crew name and avoid real names, contact details or other personal information.

Public blockchain nodes and independent explorers are outside our control. We can examine requests concerning data held by us, correct our own indexes and remove offchain data where required; we cannot technically erase a transaction from the global blockchain. This technical limitation does not remove your GDPR rights. Providing optional onchain gameplay and its public record is based on Article 6(1)(b) GDPR; maintaining reliable indexes and preventing manipulation is based on Article 6(1)(f) GDPR.

6. NFT image preparation

For supported Hens, the configured collection image may be fetched and prepared for display. Source identifiers, image hashes, processing versions, job state, transparent images and previews are retained in Cloudflare R2 and the processing store so the same NFT asset can be reused across devices and owners. Paid background-removal processing is disabled in this release. If activated later, the original NFT image and technical job data would be sent to the configured Replicate processing service; this notice will be updated before a materially different use. Do not submit personal photographs.

7. Recipients and infrastructure

• Vercel: website hosting, server functions and operational logs.
• Cloudflare: asset delivery, R2 storage, security and, when the domain is activated there, DNS/CDN services. Some shared assets are delivered from assets.roostrift.com.
• Upstash: server-side Redis storage for challenges, preparation jobs, indexes and operational state.
• Reown / WalletConnect: optional wallet connection after you choose that connection method. AppKit analytics, email login and social login are disabled in this integration.
• Your selected wallet, public RPCs, NFT collection APIs (including Hens), ownership indexers and explorers: optional blockchain and NFT interactions. Explorer links contact the explorer when you open them.
• Email service providers: messages you send to our support address. We process your email address and message to respond (Article 6(1)(b) or (f) GDPR), and retain required records under Article 6(1)(c) GDPR.

Infrastructure providers can process data in the EU/EEA, the United States and other countries. Their published transfer documentation describes applicable adequacy decisions and/or standard contractual clauses and supplementary safeguards. You may ask us for information about the recipients, locations and safeguards applicable to your data. Independent wallet, collection, RPC and explorer operators also have their own privacy notices.

8. Retention

Challenges are deleted on use or expire after two minutes; game session credentials expire after 30 minutes. Device data remains under your browser's control. NFT assets, public battle indexes and preparation records are kept while needed to display and verify the NFT/game history, including after ownership changes. Operational logs and support messages are kept for the period necessary to resolve issues, protect the service or meet legal retention duties; relevant evidence may be retained for legal claims. The admin audit store retains up to its latest 1,000 events. There is no fixed automatic deletion period for persistent asset or career records. Contact us for deletion or restriction of data held by us.

9. Your rights

Subject to the GDPR's conditions, you have rights of access, rectification, erasure, restriction and portability. You can object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future. You may complain to a data protection supervisory authority, including the authority where you live, work or consider a breach to have occurred; the Hamburg Commissioner for Data Protection and Freedom of Information is an available contact for the provider's stated address.

Write to [email protected]. We may request proportionate proof of identity or wallet control, never a private key. Requests are normally answered within one month; legally permitted extensions will be explained. Game simulation automatically determines battle outcomes and scores; we do not use the game for automated decisions about credit, employment or similar significant personal matters.