seliqui e.U. (Austria) operates this website — moralhazard.stream — including its servers, database, and this interface. For everything described here, seliqui e.U. is the controller under Art 4(7) GDPR. Registration details are in the imprint.

Pending: the entity structure for operating the game (as distinct from this website) is still being settled. If a separate operating entity is established, this section will name it and set out the split. Nothing about the data below changes — only who answers for it.

• No cookies. None. Not for analytics, not for anything.
• No accounts, no registration, no email, no name. Your wallet address is your identity.
• No advertising, no third-party trackers, no profiling, and no automated decision-making.
• Analytics are counters, not visits — a number per page per day, with nothing attached to it.
• IP addresses are used to stop abuse and nothing else — in memory for rate limiting, and on disk only for the invite brute-force lock, where they are pruned automatically (§2.3).
• The database is SQLite on our own server. No third-party analytics or database service.

2.1 — Data from the blockchain. Wallet addresses, transactions, streams, claims and NFT ownership are public on the blockchain by design. The interface reads them; where we index them for speed, that is a cache of already-public data, not a new collection. We cannot alter or delete anything on a blockchain (§7).

2.2 — Data you give us by using a feature. All of it is keyed to a wallet address — never a name, email, or account.

2.3 — IP addresses, the honest detail. Two uses, both narrow:

• Rate limiting. Your IP is a bucket key in an in-process map. It is never written to disk, and expired windows are swept about once a minute. It stops one client draining the testnet faucet, the explorer API key, or the server.
• Invite brute-force backstop. Redeeming an invite code writes a row keyed by your IP, counting failed attempts so codes cannot be guessed at scale. That row holds only a counter, a first-failure time and a lock expiry — it is not linked to your wallet, your votes, or anything else. Rows are pruned once the rolling hour and any lock have passed.

Your IP is not logged for analytics, not stored with page views, and not used to build any profile.

2.4 — Usage analytics are counters only. The interface sends one beacon on page changes containing a single allowlisted key and nothing else. The server increments a counter storing exactly three things: a day, a key, and a number.

There is no identifier of any kind in that data — no address, no IP, no session, no fingerprint. Two people cannot be told apart in it, and one person cannot be followed across days. It can answer “how many times was the Handbook opened yesterday”, and cannot answer “who opened it”.

2.5 — Stored on your device. No cookies are used. A few values live in your browser's localStorage and never leave your device:

Why there is no cookie banner: because there is nothing to consent to. There are no cookies, and every item above is strictly necessary for a function you asked for — remembering your own settings, your own invite code, your place in a guide. None of it is used for analytics, advertising, or tracking across sites, and storage of that kind is exempt from consent. Clear it any time in your browser; the site keeps working, it just forgets your preferences.

• Art 6(1)(b), performance of a service you requested — voting, invite codes, the waitlist, notification state, your device preferences.
• Art 6(1)(f), legitimate interests — rate limiting, the invite brute-force lock (§2.3), and the aggregate counters (§2.4). The interest is keeping a free, unauthenticated service usable and preventing abuse of it. The data is minimal, short-lived and unlinked, which is what makes the balance come out in your favour.

Nothing here is based on consent, because nothing here needs it. No special-category data is processed.

No data is sold, rented, or shared for advertising. Ever.

We do not send your data to third parties. But this is a normal web application, so your browser connects directly to services that will see your IP address as a consequence:

• Your wallet provider — connecting a wallet involves that provider's relay infrastructure.
• Blockchain RPC providers — a primary provider with public per-chain endpoints as fallback.
• The Superfluid subgraph — for stream and distribution data.
• Ethereum mainnet ENS resolution — to show a .eth name instead of a raw address.
• Image hosts — token icons and ENS avatars load from their own sources.

Not on that list: fonts. The typeface (Encode Sans) is served from this site's own server rather than embedded from Google Fonts, so simply opening a page here discloses nothing to a font CDN. Attribution and licence are in the imprint.

Each is an independent controller under its own privacy policy. If that matters to you, a VPN — or simply not connecting a wallet — keeps them from seeing your address.

Our server additionally contacts block-explorer APIs for contract verification and, for administrative accounting only, currency-rate sources. Neither involves your personal data.

International transfers (Art 44 ff.): some of those services sit outside the EU/EEA. Where an adequacy decision does not apply, transfers rest on Standard Contractual Clauses or on being necessary for a service you requested. This is one of the points flagged for professional review.

Under Arts 15–21 GDPR you may request access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interests. There is no cost and no form to fill — contact details are in §9.

Because there is no account, we identify you the way the app does: by asking you to sign a message with the wallet address in question. That proves control of the address without us needing any other personal data from you.

You may also complain to a supervisory authority — in Austria, the Datenschutzbehörde.

We can delete your rows from our database: vote records, invite links, waitlist entry, notification state.

We cannot delete anything from a blockchain. Transactions, streams, claims and NFT ownership are permanent and public, replicated across independent nodes worldwide, and nobody — including us — can alter or remove them. That is a property of the technology, not a policy choice, and it is worth understanding before you interact rather than after.

If you mint the Profile NFT, your interface preferences and acknowledgements are written on-chain and are publicly readable by anyone, permanently. That is inherent to what it is, it is stated before you mint, and minting is entirely optional.

Contracts are verified and open-source; the site runs over HTTPS with a strict transport policy and a Content Security Policy. The database is on our own server, not a third-party service. The contracts have had repeated internal and AI-assisted security review, but no formal third-party security audit by a professional audit firm has been completed — review is not assurance, and both facts are stated plainly in the Handbook and the draft terms rather than glossed over.

Reach us through the routes in the Handbook — I'd like to collaborate or who made this — or the address in the imprint.

Material changes will be announced in the interface, and the date below updated.