Privacy policy
What we collect, what we do not, and the limits of what anyone can promise about data written to a public chain.
Last updated 27 July 2026Who is responsible for this
LOOT is a decentralized protocol with no operating company behind it. There is no incorporated entity, so there is no named data controller and no registered address to give you. We are telling you that plainly instead of naming a company that does not exist.
What that means in practice: the commitments below are about how the interface is built and operated. They are not backed by a corporate entity you could address a formal request to.
What we collect
| What | Where it comes from | Why |
|---|---|---|
| Wallet address | your wallet, when you connect | to show your holdings, positions and game state |
| Login identifier | our wallet provider: an email address, phone number or social account, only if you choose that login method | to sign you in and recover your account |
| Profile you set | you: username, picture, cover image, bio | to display your profile |
| Things you post | you: token details, images, chat messages, referral codes | to run the product |
| Technical request data | your browser: IP address, user agent, request paths | security, rate limiting and diagnosing errors |
Most of what the site shows you is not collected from you at all. It is read from the public chain and attributed to your address.
What we never collect
- Your seed phrase or private keys. We never have them and we will never ask for them. Anyone who does is stealing from you.
- Custody of your funds. We never hold your assets.
- Government identity documents. There is no identity verification on LOOT.
- Payment card or bank details. We do not process payments.
Who else processes it
Running the product means other companies handle some of this data on our behalf: our embedded-wallet and login provider, our hosting and network providers, and an error-reporting service. Reading the chain means sending requests to blockchain node providers, who see your IP address and what you asked for. Connecting an external wallet involves that wallet’s own connection service.
Images and token metadata are published to a public content-addressed storage network. Anything published there is public and permanent, and cannot be recalled.
Device recognition
The site can run a third-party device-recognition agent in your browser to help detect abuse such as one person operating many accounts. Where it is enabled, that agent sends signals about your browser and device to its provider and returns an identifier.
Your choices, and the hard limits
You can disconnect your wallet, stop using the site, clear cookies, or ask us to remove a profile you created. We will do what we can on our own systems.
Delete anything from the blockchain. Un-publish something written to a public content-addressed network. Make your on-chain history private, or unlink it from your address. Reverse a transaction.
Any service that promises you otherwise is describing something it cannot deliver.
Security and retention
We keep what we hold for as long as it is needed to run the product, and we protect it with the usual measures: encrypted transport, restricted access, no storage of credentials we do not need. No system is perfectly secure and we cannot guarantee this one is.
Children
LOOT is not for anyone under 18. We do not knowingly collect data from anyone under 18.
Changes
If this policy changes, the date at the top changes with it. Material changes will be made visible on the site rather than published quietly.