Privacy Policy

This Privacy Policy explains what The Hood ("we", "us") collects when you use the Service, why we collect it, and what you can do about it. It applies together with our Terms of Service. Plain summary first: your wallet address is your identity here. We keep what a custody-and-draws service needs to run: account records, transaction history, chat messages, and basic security data. We do not sell personal data and we do not run third-party ad trackers.

• Account data: your wallet address, your generated username, admin role if any, and when you created the account and were last active.
• Money data: deposits detected on your deposit addresses, credited amounts and prices, ticket buys and sells, duel stakes, winnings, withdrawals, and the resulting balance. This is a financial ledger, and we keep it for accounting integrity.
• Chat messages you send, with timestamps, and moderation actions taken on them.
• Terms acceptance: which version of the Terms you accepted and when.
• Technical and security data: your IP address and request headers for rate limiting and abuse prevention, session records that tie your session token to your account, and server logs with errors and worker activity. Logs may include your wallet address or IP when you trigger the logged action.

The Solana blockchain is public. Your deposits, sweeps, and payouts are visible on-chain to anyone, forever, tied to your addresses. That is a property of blockchain networks, not something we control, and no privacy policy can change it. If you value on-chain privacy, use a dedicated wallet for this Service.

We use your data to:

• create your account and keep you signed in securely;
• detect your deposits, credit your balance, run draws, and pay out withdrawals;
• moderate chat, enforce the Terms, and block fraud, abuse, and exploits;
• meet accounting, record-keeping, and legal obligations;
• keep the Service running: debugging, monitoring, and abuse analysis.

Where the GDPR applies, our legal bases are performance of our contract with you (account, balances, draws), legitimate interests (security, fraud prevention, debugging), and legal obligation (financial records). We do not carry out automated decision-making with legal effect, and we do not profile you for advertising.

We do not sell or rent personal data. We share it only with:

• service providers: the providers that host, deliver, and back up the Service and its database, the Solana RPC service we read and broadcast transactions through, and third-party APIs we use for deposit pricing. They process data on our instructions to make the Service work.
• authorities, where we are legally required or where we reasonably believe it is necessary for fraud, security, or legal claims; and
• a buyer of the Service, if it is ever sold or merged, under this policy or a notice you receive first.

We use one essential cookie, raffle_session, which keeps you signed in. Your wallet extension and our sign-in flow also store state in your browser's local storage, such as which wallet you last used and that you accepted the Terms. We do not use advertising or analytics cookies. Because the cookies we set are strictly necessary, the Service works without a consent banner.

We keep account and financial ledger data for as long as your account exists and afterwards for as long as accounting rules or potential legal claims require, in practice at least seven years for ledger records. We keep chat history for moderation and community safety, and security logs for a shorter operational window. On-chain data is permanent and outside our control, as described in section 3.

Session tokens are HttpOnly cookies, and per-user deposit keys are encrypted at rest with AES-256-GCM. We use parameterized queries, signature-based sign-in, and rate limits on sensitive endpoints. No system is perfectly secure, and carrying value makes us a target, so treat this as one reason not to keep a large balance on the platform. If something goes wrong that affects your data, we will notify you and affected regulators as the law requires.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, export it, object to certain processing, and ask us to delete it. Deletion has limits: we can remove your username, chat messages, and account markers, but the financial ledger must survive for accounting and legal reasons, and your wallet address is permanently embedded in public blockchain records. To exercise any right, email us and tell us the wallet address you signed in with. We may ask you to sign a message with that wallet to verify the request.

EU and UK residents may complain to their local data protection authority. Nothing here limits rights that consumer law gives you mandatorily.

The Service is strictly 18+, or the age of legal majority in your jurisdiction if higher. We do not knowingly collect data from anyone under that age. If you believe a minor used the Service, contact us and we will close the account.

We may update this policy as the Service changes. We will update the date at the top, and material changes require you to re-accept at your next sign-in, same as the Terms. Continued use after a change means you accept the updated policy.

Questions, requests, or complaints: [email protected]. We answer from that address, and it is the same channel for exercising your data rights.