Privacy Policy
What SCRAPLAND processes, why it is needed and your choices about your data.
We use game progress and wallet information to provide saves, rankings and optional blockchain features. We do not ask for your private keys or seed phrase. Public blockchain records cannot be deleted by SCRAPLAND.
1. Who is responsible
Sol Studio, operates SCRAPLAND and is responsible for the personal data described here. This policy covers the game website and Android app; independent wallet providers and app stores have their own policies.
2. Data we process and why
- Local game data: progress, heroes, resources, team selection, settings and pending transaction information are stored on your device to run and resume the game.
- Wallet and authentication data: when you connect or sign in, we process your public wallet address, authentication message and signature, and session information. A wallet authorization token or selected wallet information may be kept on your device so you can reconnect. These are not private keys.
- Cloud gameplay data: for signed-in online features, we store a wallet-linked profile, progress, battle actions and results, timestamps, reward records and request identifiers. This enables cloud saves, verifies legitimate gameplay and prevents duplicate rewards or purchases.
- Transactions and digital assets: optional blockchain features use public addresses, transaction signatures, order references, amounts, status and NFT ownership information to verify payments, delivery and access.
- Ranking data: leaderboard records include wallet addresses, rank, distance, score and eligible NFT badges. Public API responses can contain the full wallet address even when the interface displays a shortened one.
- Technical and security data: hosting and network providers process connection information such as IP addresses and request details to deliver the service. Our sign-in protection uses a hashed IP address with a short-lived request counter to limit abuse.
- Support messages: if you contact us, we process the contact details and information you choose to send to answer and resolve your request. Do not send passwords, seed phrases or private keys.
The current game does not include advertising trackers or a third-party behavioural analytics SDK. It does not request access to your contacts, microphone, camera or precise device location. Generated game artwork and audio are prepared during development; playing the game does not send player content to the audio-generation service.
3. Purposes and legal bases
Where data-protection law requires a legal basis, we process data necessary to provide the features you request under our agreement with you: authentication, saves, gameplay and delivery. Our legitimate interests support proportionate fraud prevention, security and service reliability. We may also retain or disclose records to meet applicable legal obligations. If an optional feature requires consent, we will request it separately; you can withdraw that consent without affecting earlier lawful processing.
4. Cookies and on-device storage
We use local storage for game progress, wallet connection preferences and settings, and a service-worker cache for game files and offline access. The sr_login cookie supports a sign-in challenge for up to 10 minutes; sr_session supports an authenticated session for up to 30 days. Authentication cookies are HttpOnly, use SameSite restrictions and use Secure on HTTPS. The sign-in rate-limit counter expires after 10 minutes.
These mechanisms support requested functionality and security, rather than advertising. You can clear browser/app storage or disconnect your wallet. Clearing storage can erase local progress and does not by itself remove server records or public blockchain data. Revoking wallet permissions is managed in your wallet.
5. Recipients and public data
Our infrastructure uses Vercel for hosting and API delivery, Upstash for cloud storage, and Helius or public Solana RPC infrastructure for blockchain requests. These providers receive the data needed for their role. Your selected wallet receives the connection and signing requests you approve. Asset gateways may receive standard connection data when a requested asset is loaded.
Leaderboard data described above is publicly accessible. Solana transactions, NFT ownership and any signed on-chain save/checkpoint are public blockchain records that can be copied and analysed by others. Wallet addresses are pseudonymous, not necessarily anonymous. We cannot erase, hide or edit records on the public blockchain.
We do not sell personal data or share it for cross-context behavioural advertising. We may disclose relevant information where legally required or necessary to investigate abuse or protect legal rights. Providers and public blockchain participants may process data outside your country. Contact us for details of applicable processing locations and transfer safeguards.
6. How long data remains
Local data remains until you clear it, remove the app or a game update replaces it. Authentication and short-lived security records have the expiry periods above. Cloud profiles, verified progress, leaderboard entries and completed purchase records do not currently have a fixed automatic expiry; we retain them while needed to provide your account, preserve purchases, resolve disputes or meet legal obligations, and review deletion requests individually. Temporary purchase quotes expire after 10 minutes.
Hosting/security log retention also depends on the provider and service configuration. When data is no longer needed, it should be deleted or anonymised; limited records may need to remain for a legal obligation or unresolved dispute. Public blockchain data can persist indefinitely and is not under our deletion control.
7. Your choices and requests
You can use guest features without linking a wallet, subject to their limitations. Connecting a wallet is needed for wallet-linked saves and blockchain features; participating in ranked online play can publish the ranking data described above.
Depending on the law that applies to you, you may request access, correction, deletion, a copy or portability of your data, restriction of processing, or object to processing based on legitimate interests. You may also complain to your local data-protection authority. Requests should identify the relevant public wallet address and the action requested; never disclose your private keys or seed phrase.
To protect an account, we may ask you to prove control of its public wallet address using a non-payment message. We will never need your private key or seed phrase. There is currently no in-game button that deletes a cloud account; requests are handled by Sol Studio. Deletion of off-chain data cannot remove public transactions, and legally necessary records may be retained. We will explain applicable limitations when responding.
8. Security, young users and changes
We use HTTPS, wallet-signature verification, restricted authentication cookies and server-side validation to protect the service. No system can guarantee absolute security. Keep your device and wallet secure and review signing requests carefully.
We do not ask players for their date of birth. If you believe a child has provided personal data without the required permission, contact us so we can review and address it under applicable law. See the eligibility requirements in our Terms of Use.
We may update this policy when the service or our practices change. The published version will show its effective date; material changes will be communicated through the game or website as appropriate.