Privacy Policy

This Privacy Policy explains what information the operators of 1 Million Egg ("we," "us," "our") process in connection with the 1 Million Egg website, mini app, and related services (the "App"), and how we use it. Please read it together with our Terms of Service.

1. Scope

This Policy covers information processed through the App itself. It does not cover the practices of independent third parties you may interact with through the App (such as your wallet provider, Veil, or Galxe), each of which has its own privacy practices — see Section 9.

2. Information We Collect

Depending on how you use the App, we may process:

• Wallet address, when you connect a wallet to the App.
• Onchain activity related to the App (such as Tap, Daily Claim, Reward Claim, Standard Egg Pay, and — if you choose to register a public key — Private Transfer registration). This activity occurs on a public blockchain and is not private (see Section 5).
• Referral information: if you arrive via a referral link (a ?ref= URL parameter), the referrer's wallet address is stored in your browser's local storage for up to 7 days so it can be applied if you later connect a wallet and take a qualifying action. This value is read from and removed from the URL by your browser; it is not automatically transmitted to our servers as part of this capture step.
• Farcaster information, if you connect via Farcaster or choose to link a Farcaster account: your Farcaster ID (FID), and, if you enable notifications or add the 1 Million Egg mini app within Farcaster, a notification token and delivery URL provided to us by Farcaster's platform for the purpose of sending you in-app notifications (for example, a Daily Claim reminder), where that feature is active. The current production configuration does not maintain a persistent application database for wallet-to-Farcaster identity mappings. If this changes in the future, we will update this Policy to describe the specific retention and deletion practices that apply at that time.
• Basic analytics, such as page views, referrer, approximate geolocation (country/region/city level), device type, browser, and operating system, collected through Vercel Web Analytics and Speed Insights. Per Vercel's own published privacy documentation (see Section 9), this data is anonymized, not tied to your IP address, does not use cookies, and any visitor-session data is automatically discarded within 24 hours.
• IP address, in limited circumstances: certain requests (for example, to a share-card generation endpoint and a live-activity refresh endpoint) read your IP address from request headers solely to apply short-term, transient rate-limiting to prevent abuse. This is processed in the memory of the server handling your request and is not written to a database by our application code; it does not persist beyond that server process's own lifetime.
• Information sent to Standard Egg Pay's or Veil's smart contracts, if you use those features — see Section 7 and Section 8.

3. Information We Do Not Collect

We do not ask for, and our code does not collect, store, or transmit:

• passwords for the App (we rely on your wallet's own authentication);
• private keys or seed phrases for your wallet; or
• your Veil private key or Veil signing material — see Section 8 for exactly how this is handled.

We do not collect personal identity information (such as your legal name, government ID, or physical address) unless you voluntarily provide it to us directly (for example, in a support request).

4. How We Use Information

We use the information above to:

• operate core App features (Tap, Daily Claim, Reward Claim, leaderboard, seasons, referrals);
• provide Standard Egg Pay and, when enabled, Private Transfer, when you choose to use those features;
• send you notifications you have opted into via Farcaster, where applicable;
• understand aggregate usage patterns to improve the App; and
• detect, prevent, and respond to abuse, fraud, or violations of our Terms of Service.

5. Blockchain Data Is Public and Permanent

Any transaction you make on Base — including Tap, Daily Claim, Reward Claim, Standard Egg Pay payments, and any Veil action you register onchain (such as your public deposit key) — is recorded on a public, decentralized blockchain. This data is public, generally permanent, and cannot be edited or deleted by us, regardless of any request you make to us. Please consider this before taking any onchain action.

6. Cookies and Similar Technologies

The App's own code does not set first-party cookies. Some third-party infrastructure we use for wallet connections (see Section 9) may use its own cookies or local storage for its own purposes (such as maintaining your wallet connection session) — this is governed by that provider's own policy, not this one. We use your browser's local storage directly only for the referral mechanism described in Section 2, and Veil-related session state as described in Section 8.

7. Standard Egg Pay Data

If enabled and if you use Standard Egg Pay, the recipient address, USDC amount, expiry, and resulting status (accepted, cancelled, or refunded) of any payment you create are recorded on the public blockchain as part of the transaction itself — see Section 5. We do not additionally collect or store this information outside of what the smart contract itself records onchain, except to the extent needed to display it back to you within the App interface during your session.

8. Private Transfer (Veil) Data

If enabled and if you choose to use Private Transfer:

• Deriving your Veil key requires a signature from your connected wallet. That signature, and the key derived from it, are processed only in your browser and are not transmitted to our servers and not written by our code to any persistent storage (no cookie, localStorage, or sessionStorage entry is created for this key). We do not, however, guarantee that your browser's own memory management erases this data in a cryptographically secure way once your session ends — see Section 5 of the Terms of Service.
• If you choose to register with Veil, your public deposit key is written to a public blockchain and becomes visible onchain, like any other onchain data (Section 5). Your private key material is never registered, displayed, or transmitted anywhere.
• Any transfer, deposit, or withdrawal you make through Private Transfer is processed by Veil's own protocol and, where applicable, Veil's relay infrastructure — both operated by Veil, an independent, unaffiliated third party, under Veil's own data-handling practices, which we do not control. Please review Veil's own, currently-published terms and privacy practices directly from Veil.
• We do not claim that Private Transfer is anonymous or untraceable — see Terms of Service Section 5.

9. Third-Party Service Providers

Depending on which features you use, the App may share limited information with, or rely on infrastructure operated by, the following third parties. Each has its own, independent privacy practices, which we do not control:

10. Data Retention

We retain information only for as long as needed for the purposes described in this Policy, or as required by applicable law. Specifically:

• Referral information stored in your browser is automatically discarded after 7 days, or sooner if you clear your browser storage.
• The current production configuration does not maintain a persistent application database for wallet-to-Farcaster identity mappings (see Section 2) — there is no such record for us to retain in the first place. If a persistent database and Farcaster-ID linking are enabled in a future version of the App, we will update this section to describe the specific retention and deletion practices that apply.
• IP addresses processed for rate-limiting are held only transiently, in server memory, and are not retained in a database by our application code.
• Onchain data is retained by the blockchain itself, indefinitely and outside our control (see Section 5).

We do not commit to a specific retention period for every category of information, because — as described above — some categories depend on which optional features you use and on infrastructure that may not be active in every deployment of the App.

11. International Data Transfers

Because the App relies on infrastructure providers (including those listed in Section 9) that operate globally, information may be processed in countries other than your own, including countries that may have different data protection laws than your country of residence.

12. Your Rights

Depending on your location, you may have rights to access, correct, or request deletion of personal information we hold about you, or to object to certain processing. Because most of the data described in this Policy either lives only in your own browser (referral information, Veil key material) or on a public blockchain we do not control (Section 5), many requests can be self-served by clearing your browser storage or are technically outside our ability to fulfill (we cannot delete data from a blockchain). For anything else, contact us using the details in Section 17.

13. Children's Privacy

The App is not directed to, and we do not knowingly collect information from, anyone under the age required by Section 1 of our Terms of Service (18 years old). If you believe a minor has provided us with information, contact us using the details in Section 17 and we will take appropriate steps.

14. Security

We take reasonable measures to help protect the App and the limited information we process. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security — this applies equally to our own infrastructure and to every third-party service listed in Section 9.

15. Data Security Incidents

If we become aware of a security incident affecting information we control that creates a risk to you, we will take reasonable steps to investigate and, where required by applicable law, notify affected users and/or the relevant authority.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" at the top of this page. Material changes will be reflected here; continued use of the App after an update takes effect constitutes acceptance of the updated Policy.

17. Contact

Questions about this Privacy Policy, or requests relating to your information, can be sent to set1millionegg@gmail.com.