Privacy Policy

This Privacy Policy explains how AE Labs Inc. ("we", "us" or "our") collects, uses, shares and protects Personal Data when you use webPunk, including the webPunk mobile application (the "App") and webpunk.com (the "Website"), together the "Services". AE Labs Inc. is the controller of your Personal Data. Terms not defined here have the meaning given in our Terms of Service.

Please read this Privacy Policy carefully. If you do not agree with it, please do not use the Services.

Summary

• We collect what you give us (such as your email address, profile and the Content you create), what is generated as you use the Services (such as device, usage and in-game data), and limited information from partners (such as purchase and verification status).
• We use it to run webPunk, keep it safe, personalize what you see, improve the Services, show ads and measure our marketing, and meet our legal obligations.
• We do not sell your Personal Data for money. Our use of advertising and measurement partners may count as "sharing" or "targeted advertising" under some laws; you can opt out as described below.
• Messages are encrypted in transit and stored on our servers. They are not end-to-end encrypted.
• We do not collect your device's precise (GPS) location.
• If you add webPunk widgets or allow Live Activities, your friends' usernames, profile pictures and stars, your unread counts and your open missions can show on your device's home screen and lock screen. You can remove them or turn them off at any time.
• You can access, download, correct and delete your data, and you can delete your account in the App at any time.

1. Personal Data

"Personal Data" means information that identifies, relates to, or can reasonably be linked to an identified or identifiable individual.

2. Personal Data we collect

3. How we use Personal Data and our legal bases

We use Personal Data for the purposes below. Where the law of your country requires a legal basis (for example, the EU or UK GDPR), we rely on the basis shown for each purpose.

• To provide the Services — creating and securing your account, signing you in, delivering messages, calls and notifications, showing your widgets and Live Activities, running the hub and its multiplayer features, generating AI Content you ask for, processing purchases, rewards and Wallet features, and providing customer support. Basis: performance of our contract with you.
• To personalize the Services — ranking your feed, suggesting people and content, and remembering your settings and where you left off in the hub. Basis: performance of our contract and our legitimate interest in showing you relevant content.
• To keep webPunk safe — preventing fraud, spam, cheating and abuse; enforcing our Terms and Community Guidelines; reviewing reports; applying protections for younger members; and running automated safety checks on AI prompts and generations. Basis: our legitimate interests in a safe service, and legal obligations.
• To understand and improve the Services — analytics, diagnostics, testing and developing new features. Basis: our legitimate interest in improving the Services, or your consent where required.
• Advertising and marketing measurement — showing ads in the App, rewarding you for rewarded ads you choose to watch, and measuring the performance of our advertising campaigns. Basis: your consent where required (including in the EEA, UK and Switzerland, and Apple's App Tracking Transparency on iOS), otherwise our legitimate interest in funding and growing the Services.
• To communicate with you — service and security messages, push notifications you have allowed, and responses to your requests. Basis: performance of our contract, and your consent for push notifications.
• To comply with law — tax and accounting, responding to lawful requests, and establishing or defending legal claims. Basis: legal obligations and legitimate interests.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated systems help rank content and flag possible abuse, and people review enforcement actions where required.

4. Information visible to other people

webPunk is a social platform. Depending on the feature and your settings, other people can see:

• your public profile (username, display name, profile picture, bio, avatar and world) and the posts and remixes you publish;
• messages, voice notes and media you send, to the members of that chat, and typing indicators and read receipts ("Seen"), to the members of that chat;
• in the hub, your avatar, name, position, movement, chat bubbles, emotes and voice, to other players in the same hub instance;
• if "Leave a ghost behind" is on, a replay of your avatar's path (with your name), shown to other players in the hub for up to 24 hours;
• in Ophan live, your avatar, name, answers, X's and whether you won, to the other players and spectators in the same hub instance and on the theatre's screens in the hub; and your username, profile picture and game totals (games, wins, right answers) on the game's weekly and all-time leaderboards, to anyone using the App;
• that you are online in the hub, to your friends (for example, through a "your friend is online" notification);
• your Wallet address and on-chain transactions, to anyone, because public blockchains are public;
• your username, profile picture and stars, on the home screen and lock screen widgets and Live Activities of friends who use them.

If you add webPunk widgets (home screen or lock screen), Control Center controls or Quick Settings tiles, or allow Live Activities, your device can show your friends' usernames, profile pictures and stars, your unread message counts and your open missions on its home screen and lock screen, and on iOS in the Dynamic Island, StandBy and a paired Apple Watch. Anyone who can see your screen can see them, even while your device is locked. They never show what a message says.

Anything you share with others can be copied or saved by them. Please share thoughtfully.

5. How we share Personal Data

We share Personal Data only as described here:

• Service providers who process it on our behalf to operate the Services, listed in Section 6;
• Advertising and measurement partners (Google AdMob and AppsFlyer, and through AppsFlyer, the advertising platforms on which we run campaigns), subject to your device settings and consent choices — never for ad personalization or attribution of members under 18 (Section 14);
• Other users, as described in Section 4;
• Public blockchains, when you initiate an on-chain transaction;
• Parents or guardians who supervise a minor's account with that minor's agreement, as described in our Age Suitability page;
• Professional advisors, such as lawyers, auditors and accountants;
• Authorities and others where required by law or legal process, or where necessary to protect the rights, property or safety of our users, the public or us;
• Business transfers, to a successor or counterparty in a merger, acquisition, financing, reorganization, asset sale or similar transaction;
• Affiliates, meaning entities that control, are controlled by or are under common control with us, who will handle it consistently with this Privacy Policy;
• With your consent or at your direction.

6. Service providers

We use the following service providers. They may process your Personal Data only to provide services to us, under contractual confidentiality and data protection obligations, except where a provider (such as Apple, Google, Stripe or Bridge) acts as an independent controller under its own privacy policy, which you should review.

7. Cookies and similar technologies

On the Website we use cookies and browser storage (such as local storage) that are necessary to keep you signed in, remember your settings and complete purchases, and analytics cookies and storage from PostHog to understand how the Website is used. Vercel's page analytics does not use cookies. We do not use advertising cookies on the Website.

In the App we use similar technologies, such as device identifiers and the software development kits of the providers listed in Section 6. You can block or delete cookies in your browser settings; some parts of the Website may not work without the necessary ones.

8. Your choices

• Ad tracking on iOS: the App asks for permission before tracking you across other companies' apps and websites. You can change this in Settings → Privacy & Security → Tracking.
• Ad personalization on Android: you can delete or reset your advertising ID in your device's privacy or Google settings.
• Ad consent in the EEA, UK and Switzerland: you can review or change your choices at any time in Settings → Ad privacy in the App.
• Ghosts in the hub: you can turn off "Leave a ghost behind" in Settings. Turning it off also deletes the recordings we hold.
• Notifications: you can turn off all notifications or individual categories in Settings, or in your device settings.
• Widgets and Live Activities: you can remove a widget from your home screen or lock screen, and a control or tile from Control Center or Quick Settings, at any time. You can turn off star and missions Live Activities in the App's notification settings, or all of webPunk's Live Activities in iOS Settings → webPunk → Live Activities; turning a kind off ends the one that is running.
• Safety tools: you can mute, block and report people, and leave any chat, at any time.
• Device permissions: you can withdraw camera, microphone, photo and motion access in your device settings.
• Delete your account: in the App, go to Settings → Account → Danger zone, or contact us.

9. Data retention

We keep Personal Data only for as long as we need it for the purposes described in this Privacy Policy. In particular:

• account and profile information, posts and other Content are kept while your account is active and deleted when you delete them or your account;
• messages are kept until they are deleted by you or other participants, removed by a chat's disappearing-message timer, or deleted with your account; view-once media is deleted shortly after it has been viewed;
• messages in the hub's public chat expire after one hour;
• what an AI-run account remembers about you is deleted after 60 days, and with your account;
• ghost recordings of your hub walks are deleted after 24 hours, or immediately if you turn the feature off;
• your online status in the hub expires within minutes of leaving it; your last hub position is kept so you can continue where you left off;
• a Live Activity's push token is deleted within 7 days after the Live Activity ends, and the token for starting Live Activities after 60 days without the App reporting it again; all of them are deleted with your account;
• analytics, diagnostics and advertising data are kept for limited periods set by us and our providers;
• purchase, rewards and transaction records are kept for as long as required by tax, accounting and other laws;
• we may keep information longer where needed to resolve disputes, enforce our Terms, prevent abuse or comply with law, and residual copies may remain in backups for a limited period.

Information recorded on a public blockchain cannot be changed or deleted by us.

10. Security

We use technical and organizational measures to protect Personal Data, including encryption in transit, access controls, private storage for chat media that is served only to members of the chat through short-lived links, and additional encryption at rest for certain sensitive photos. Wallets are non-custodial and provided by Privy; we do not hold your private keys.

Messages are stored on our servers and are not end-to-end encrypted. No system is completely secure, and we cannot guarantee the security of your information.

11. International data transfers

We are based in the United States, and we and our service providers process Personal Data in the United States and other countries whose data protection laws may differ from those where you live. Where we transfer Personal Data from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or on another lawful transfer mechanism.

12. Your rights

Depending on where you live, you may have the right to:

• know whether we process your Personal Data and access a copy of it, including in a portable, machine-readable format;
• correct inaccurate Personal Data;
• delete your Personal Data;
• object to or restrict our processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting processing carried out before you withdrew it;
• opt out of targeted advertising and of the "sale" or "sharing" of Personal Data;
• not be discriminated against for exercising your rights;
• appeal a decision we make about your request, and lodge a complaint with your local data protection authority.

To exercise these rights, email support@ael.org. You can also delete your account directly in the App. We will verify your request using information associated with your account and respond within the time required by law (generally within one month, or 45 days in the United States). You may use an authorized agent where the law allows it; we may ask the agent for proof of authorization.

13. Additional information for US residents

In the last 12 months we have collected the following categories of Personal Data, for the purposes described in Section 3, from the sources described in Section 2: identifiers (such as email address, account and device identifiers, IP address and Wallet addresses); customer records; commercial information (purchases and rewards); internet and other electronic activity (usage and interactions); approximate geolocation; audio and visual information (photos, videos and voice); and inferences used to personalize your feed. Bridge collects government identification for optional bank transfers directly; we do not receive copies of it.

We disclose these categories to the service providers and other recipients described in Sections 5 and 6. We do not sell Personal Data for money. Disclosing identifiers, device information and activity to Google AdMob and AppsFlyer for advertising and campaign measurement may be considered "selling" or "sharing" Personal Data, or "targeted advertising", under some US state laws. You can opt out using the controls in Section 8 or by emailing us. We do not use or disclose sensitive Personal Data to infer characteristics about you. We do not knowingly sell or share the Personal Data of consumers under 18.

14. Children and younger members

You must be at least 13 years old to use webPunk, and older where your country or app store requires it. We do not knowingly collect Personal Data from children under 13. If we learn that we have, we will delete it. Members under 18 receive additional protections, such as limits on who can message, call or add them to a group, and can choose to link their account with a parent for supervision, as described on our Age Suitability page. For members under 18, the App shows only non-personalized ads, asks Google AdMob to treat its ad requests as coming from someone under the age of consent with a teen content rating, and does not use AppsFlyer. Parents or guardians with questions may contact us at support@ael.org.

15. Third-party services

The Services may link to or integrate with services we do not control, such as Wallet providers, public blockchains and app stores. Their handling of your information is governed by their own privacy policies.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the "Last updated" date. If we make material changes to how we use your Personal Data, we will notify you in the App or by email before the changes take effect and, where the law requires it, ask for your consent. Previous versions are available on request.

17. Contact us

For questions about this Privacy Policy or to exercise your rights, contact AE Labs Inc. at support@ael.org.

We have appointed a Data Protection Officer for the purposes of the EU GDPR and the UK GDPR, who can be contacted at: