YOUR DATA.
YOUR UNIVERSE.

Overview and scope

Exoland ("we", "us", "our") operates the Exoland Web3 gaming platform at exoland.xyz, including its wallet connection, EXO Star Runner, player profiles, EXO-holder eligibility checks and competitive leaderboards. This notice describes personal data we may process when you browse or use those features and when you contact us. Other Exohood ecosystem sites are separate services and publish their own privacy notices.

The platform may change over time. Planned features, including Neon Racers, paid digital collectibles, NFT trading, and transferable EXO reward missions, are not treated in this notice as already operating. We will update the notice and provide any additional disclosures required before material new processing begins.

Who controls your data

The platform is presented by Exoland Labs LLC. For privacy enquiries, contact privacy@exoland.xyz. Our operational base is in the United Kingdom, while the platform can be accessed internationally subject to applicable availability rules.

The precise registered office, registration number, any required representative and any appointed data protection officer must be confirmed and published where legally required. This email is the privacy contact and does not itself imply that a statutory data protection officer has been appointed.

Information we may collect

Depending on the feature you use, information may include: public wallet address and connected chain; a locally chosen callsign and spaceship avatar; game title, start time, ticket, score, best score, rank and basic anti-abuse validation data; EXO token balance eligibility as returned by public blockchain queries; IP address and limited request/device information in server logs; cookie choices and optional analytics identifiers; and messages you submit to support or privacy.

We do not require your legal name or email address merely to connect an EVM wallet and play the current arcade game. We do not request or store wallet private keys, seed phrases or wallet passwords. A wallet address is not necessarily anonymous and may be personal data when linkable to you.

Wallet connection and providers

When you choose Connect Wallet, a compatible provider may disclose your public wallet address, network identifiers and connection status to Exoland. WalletConnect/Reown and the wallet provider may process related technical information under their own notices; their operations are not controlled solely by Exoland.

Connecting a wallet is not permission to move your tokens. The current player preview may rely on wallet connection without a server-verified identity signature. Therefore, do not treat wallet connection alone as strong authentication for any future financial or reward feature.

EXO-holder access checks

The current platform may query the public EXO token contracts on Ethereum, Polygon and BNB Chain to determine whether a connected public address has any EXO balance. These are read-only balance checks; they do not transfer EXO or require token spending approval.

For an eligibility check, your public address and applicable contract/network information may be sent from our server to blockchain RPC infrastructure or other network providers. These providers may see request metadata, including the server IP, and their processing is subject to their arrangements with us or their own privacy terms. We use the result to allow or deny entry to holder-only features and troubleshoot service errors.

Game sessions and performance

EXO Star Runner may record session tickets, mission start and completion times, scores and game outcomes through server-side endpoints, and may keep a separate best score in browser storage. Some game features may operate locally, while accepted competitive results are submitted to our server.

Game telemetry is used to operate gameplay, evaluate basic plausibility of results, manage rankings, identify misuse and improve stability. Browser-based score validation is not guaranteed to be tamper-proof. The current game coins are in-game collectibles, not cryptocurrency or transferable cash prizes.

Public leaderboards and visibility

If a competitive result is accepted, the leaderboards may display your selected callsign, abbreviated public wallet address, game title, score, rank and relative changes in position to other visitors. A shortened display address is not an anonymity guarantee because the underlying wallet identity may still be linked through other information.

We generally display no more than the Top 10 for a game plus a connected player’s own rank, where supported. If you request a callsign change or object to publication, we will assess the request, security needs and applicable rights; we may anonymise or suppress public display where appropriate while retaining limited integrity logs when lawful.

Player profiles and local storage

The current player identity can store a nickname, avatar selection and local score information in the browser associated with the connected wallet address. This may be device-specific and not synchronised across devices. Clearing browser storage or changing devices may remove local preferences.

Browser storage is not a secure backup. We may introduce verified server-side player accounts later; before doing so, we will describe the additional information, verification and retention involved. A wallet alone is not proof of age or legal identity.

Why we use data

We use relevant information to: deliver games and wallet-linked features you request; check access eligibility; maintain a fair and reliable leaderboard; detect fraud, abuse and technical incidents; respond to enquiries; maintain necessary business records; comply with applicable law; and, only where a valid basis exists, measure usage and improve the platform.

We do not use player rankings as a present entitlement to EXO token payments. Future commercial functions, NFTs or financial-value reward programmes will receive additional purpose-specific notices before launch.

Lawful bases and our interests

Where the UK GDPR, EU GDPR or similar laws apply, we assess the lawful basis for each purpose rather than using one blanket basis. Contractual necessity may apply to delivering an agreed gameplay or account feature; legitimate interests may apply to security, fraud detection and reliable operations, subject to a balancing assessment; legal obligation may apply to required compliance and record keeping; and consent applies where required for optional cookies, analytics or marketing.

Our legitimate interests are protecting the service, users and game integrity, maintaining basic technical functionality, and understanding aggregate performance without unnecessary intrusion. Where consent is the basis, you may withdraw it without affecting earlier lawful processing. Other lawful bases may apply where supported by the law relevant to your location.

Cookies, analytics and measurement

Exoland may use essential cookies or storage for preferences, session operation and security. Optional technologies on the main platform may include Google Analytics, Microsoft Clarity, Hotjar and Yandex Metrica for analytics, and HubSpot for marketing or CRM measurement, according to the consent options presented on the live site.

Optional analytics and marketing technologies should remain off until the relevant consent is obtained where required. You can review or change those choices using the Cookie settings control in the main site footer or the mechanism available in your browser. Withdrawing consent does not necessarily delete data already lawfully received by a third-party provider; you may also need to contact that provider.

Embedded third-party resources, such as hosted web fonts or wallet libraries, may receive routine network data (including an IP address) when loaded. A browser’s Do Not Track signal is not a substitute for any legally required consent controls.

Blockchain data and immutability

Public blockchains are independently operated networks. On-chain addresses, token balances, transactions, contract events and timestamps may be publicly accessible, searchable and persistent. Exoland cannot promise to delete or alter public-chain entries or make them private.

Where personal-data rights apply to blockchain-related processing, we assess what we can control, such as our own copies, off-chain indexes, public display names and connections between wallet addresses and profiles. We may be unable to remove data from a decentralised network not under our control.

Purchases, NFTs and digital items — planned features

Skins, digital items, minting, NFT inventory, transfers and marketplace purchases are not activated by this privacy notice. If introduced, they may involve transaction history, item identifiers, payment confirmation, smart-contract interaction, tax or consumer records, and additional providers such as marketplaces or payment processors.

Before enabling any such feature, we will explain the specific data, retention, recipients, legal basis, disclosures and choices. Do not submit financial or identification documents to the current gameplay interface unless an official, verified and lawful process is subsequently established.

Support and privacy requests

If you contact privacy@exoland.xyz, we may process your email address, the message, any information you choose to include and correspondence needed to resolve the request. We may request proportionate proof that you control a wallet before disclosing or changing account-linked information, but we will never ask for your seed phrase or private key.

Please avoid including unnecessary identity documents, financial credentials or sensitive personal information in unsolicited messages. We may retain limited records of resolved complaints or rights requests to evidence compliance and prevent repeated fraud, subject to applicable retention limits.

IP addresses, security and abuse prevention

Web and application servers may log IP addresses, request times, URLs, technical response codes, device/browser characteristics and security events to operate the site, prevent repeated automated submissions and investigate attacks. We may infer a general country or region from an IP address where reasonably necessary for security or availability checks; we do not require precise GPS positioning for ordinary gameplay.

Security controls may include rate limits, temporary blocks, anomaly detection and review of suspicious leaderboard submissions. We aim to minimise data used for these checks and distinguish unreliable risk signals from confirmed misconduct.

Sharing and service providers

We may disclose limited information to providers helping us host the platform, secure APIs, retrieve blockchain data, connect wallets, operate analytics selected through consent, and deliver support. We may also disclose information when legally required, to defend legal claims or to protect users and the service from serious abuse.

Publicly displayed leaderboard details are visible to other visitors by design. Connecting to third-party services such as Exoswap, wallet software, blockchain explorers or external marketplaces means those services may process information under their own policies. We do not publish seed phrases or private keys because we do not request them.

International processing and transfers

Exoland may be accessed internationally and service providers may operate in several jurisdictions. Where protected data is transferred outside a jurisdiction that requires safeguards, we assess the relevant requirements and use a lawful transfer mechanism when one is required, such as applicable adequacy arrangements or contractual safeguards.

You may ask privacy@exoland.xyz for information on relevant transfer safeguards. Public-chain data, independently visible around the world, has characteristics that differ from ordinary controlled off-chain database transfers.

Retention and deletion criteria

We retain information only for as long as reasonably needed for the purpose for which it was collected, subject to legal obligations, security needs, dispute handling and operational integrity. Current criteria include: game records while a valid leaderboard or integrity investigation requires them; technical logs for short periods consistent with security needs; cookie choices until reset or replaced; and support correspondence until the matter is resolved and any necessary follow-up or legal period ends.

We do not represent a particular fixed retention period as already configured for every server and vendor. Specific retention periods and deletion schedules should be documented in Exoland’s operational records and applied to production systems. Public on-chain records cannot be deleted by our off-chain retention process.

Your privacy rights

Depending on applicable law and the circumstances, you may be entitled to access your personal data; request correction or deletion; restrict or object to certain processing; obtain portable data in appropriate cases; withdraw consent; and challenge qualifying solely automated decisions. Those rights are not absolute and may depend on the legal basis and legitimate exemptions.

To exercise a right, email privacy@exoland.xyz and describe the request, relevant wallet address (public only) and any necessary context. We may ask for reasonable verification, respond within the deadline required by applicable law, and explain any refusal or limitation. You may also complain to an appropriate data-protection regulator.

Marketing preferences

We do not treat connecting your wallet as permission to receive promotional email. If Exoland introduces newsletters or personalised marketing, we will identify the applicable permission or other legal basis and provide an unsubscribe or opt-out method where required.

You may ask us to stop direct marketing by writing to privacy@exoland.xyz. Where law gives you an unconditional right to object to direct marketing, we will respect it.

Children and age-sensitive features

Wallet-linked economic features and transferable-token rewards may be restricted to adults or subject to higher local age requirements. A wallet address by itself does not verify age. We will assess age assurance and the protection of children if services are likely to be accessed by them.

We aim to minimise profiling, public exposure and unnecessary data collection for younger users. If you believe a child has submitted personal information inappropriately, contact privacy@exoland.xyz so we can investigate and take lawful steps.

Security and incident response

We use proportionate administrative and technical safeguards appropriate to our services, including controlled server access and restrictions on public access to leaderboard storage. However, no internet service, browser, wallet or blockchain system can be guaranteed completely secure.

If a personal-data incident occurs, we will evaluate containment, investigation, legal notification duties and steps to reduce harm. Users should independently protect their wallets, use genuine wallet applications and report suspected phishing promptly.

Automated checks and profiling

Automated technical checks may assess whether a wallet holds EXO, whether a session ticket is valid, and whether a game result passes basic plausibility rules. Such decisions can affect access to a game or whether a leaderboard score is accepted. These are not intended as decisions about creditworthiness, employment, insurance or similarly sensitive eligibility.

If an automated action materially affects you, contact privacy@exoland.xyz and explain the outcome. Where relevant law grants rights about solely automated decisions with legal or similarly significant effects, we will respect them.

Data accuracy and player choices

You may be able to edit your callsign or avatar within the player interface. You can disconnect a wallet from Exoland; this stops the local connection, but does not automatically erase server leaderboard records or publicly recorded blockchain activity.

Clearing browser storage may remove local preferences and locally saved scores, but it may not remove data held on our servers or by third parties. To request server-side changes, write to privacy@exoland.xyz.

Links and independent services

Links to Exohood, Exoswap, Exania, Alpascape, external wallets, analytics providers, blockchain explorers and other sites lead to independently operated services. Their privacy notices and terms govern data collected directly by them.

Exoland does not control the security settings, data practices or availability of those external services. Please check the destination and its policies before connecting a wallet or disclosing information.

Changes to this notice

We may update this Privacy Policy when our services, technical practices, providers or applicable obligations change. The effective date and version on this page identify the current notice; significant changes will be communicated in a suitable manner where required.

If we introduce paid purchases, NFT trading, verified player accounts or token rewards, we will reassess the data flows and provide additional privacy information before processing starts.

Contact and supervisory complaints

Privacy requests and questions: privacy@exoland.xyz. Please state the feature involved, a public wallet address if relevant, and the privacy right or issue concerned. Do not send credentials, private keys or recovery phrases.

Where privacy laws apply, you may have the right to complain to your competent supervisory authority, including the UK Information Commissioner’s Office where UK law applies or an EU/EEA supervisory authority where EU law applies. Contacting us first is welcome but does not remove any statutory right to complain.