What we hold, and what we deliberately do not

Before the game opens

The game is not open yet. Until it is, this site sets no cookies and asks you for nothing. Our host keeps ordinary server logs, as every website does. Everything below describes what happens once you play.

Who is responsible for your data

The team that runs bobibird.com decides what is collected and why, so the responsibility is ours. The legal entity that acts as the data controller will be named here before the token launches, after legal review. How to reach us is under “Your rights”, below.

What we collect

• Wallet address. Public by nature. It is how your Bobis are yours.
• Email address, if you sign in with one or add one for emergency notifications.
• Telegram user ID, username and chat, if you link Telegram to get daily messages.
• Your time zone and chosen feeding hours, because the game is scored against your own schedule.
• If you open someone’s share link, a hashed IP address and your browser type, kept for 30 days, only to count each visitor once.
• Game activity. Feeding times, purchases, listings, scores.
• IP address and a device fingerprint, kept briefly, only to rate-limit and to stop one person counting as many.

Why we are allowed to use it

• To run the game you signed up for — your wallet address, the email you sign in with, and your game activity. Without these there is no game to give you. The legal basis is performing our agreement with you.
• To stop abuse — your IP address and device fingerprint. The legal basis is our legitimate interest in keeping one person from counting as many and in keeping the service up.
• Because you chose to — a linked Telegram account, and an email address added only for emergency notifications. The legal basis is your consent. Unlink or remove them and we stop.

What we do not collect

• No identity documents. There is no KYC here.
• No card or bank details. We do not take card payments at all.
• No private keys or seed phrases, ever, for any sign-in method.
• No advertising trackers and no data sold to anyone.

Who processes it

• Supabase — database and authentication.
• Privy — embedded wallets for email sign-in. They hold the key material; we never do.
• Cloudflare — bot protection and rate limiting.
• Vercel — hosting.
• Telegram — if you choose to link it.
• Helius — our connection to the Solana network. It sees the transactions we send and the addresses we look up.
• Postmark — email, if you give us an address.
• Anthropic — writes the occasional letter from your Bobi.

Where it is processed

Several of the companies above are based in the United States, and your data may be processed outside the country you live in. The safeguards that cover those transfers will be set out here before the token launches, after legal review.

What is public whether we like it or not

Solana is a public ledger. Your wallet address, your Bobis, your purchases and your trades are visible to anyone. That is how the chain works and we cannot hide it — which is worth knowing before you connect a wallet you use elsewhere.

Cookies

A session cookie so you stay signed in, and Cloudflare's bot-protection cookie. No advertising or analytics cookies.

How long we keep it

• Account and game data: while your account exists.
• IP addresses and fingerprints: 30 days.
• On-chain records: forever, and not by our choice.

Your rights

You can ask us to:

• Show you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your account, your email address and your Telegram link.
• Stop a use you object to that rests on our legitimate interest, such as the abuse checks. We will stop unless we have a strong reason not to, and if we do, we will tell you what it is.
• Export the data you gave us, in a machine-readable file you can take elsewhere.
• Withdraw your consent to anything you chose to switch on, at any time.

We will answer within one month. Two limits apply to all of these: we cannot change or delete anything already written to Solana, and we cannot delete records we need to keep the ledger balanced — those are kept detached from your identity instead.

For now, send a request as a direct message to @bobibirdcoin on X. An email address will be added here before the token launches, so that you will not need an X account to use these rights.

If you are unhappy with how we handle your data, you can complain to the data-protection authority where you live. You do not have to come to us first.

Children

BobiBird is not for anyone under 18. Eggs are a paid random outcome and should be treated accordingly.

Changes

If this page changes meaningfully we will say so on X rather than quietly editing it, and the date at the top will change with it.