DEGEN DUNGEON
Privacy Policy
Last updated: 21 October 2026
Degen Dungeon is a free browser game at degen-dungeon.com, also offered as an app in the Solana dApp Store. This policy explains what we collect when you play, why, how long we keep it, and how you can see or delete it. You can play the whole game without an account.
Who we are
The data controller is the Degen Dungeon developer, an independent developer who runs Degen Dungeon (contact: [email protected]). The EU General Data Protection Regulation (GDPR) and Spanish data-protection law apply. Contact: [email protected].
What we collect
| Data | When and why |
|---|---|
| Anonymous install and session ids | Random ids created in your browser on first visit. They tie gameplay events together so we can balance and fix the game. They are not linked to your name, wallet or Discord account. |
| Gameplay telemetry | Device type (phone, tablet or desktop), browser and OS family, screen size, browser language, game build, and run stats such as hero, time survived, level, kills, upgrades picked, and when a run ends. Used to improve the game. |
| Leaderboard entries | The handle you choose (or a generated Degen_#### name) and your run score: hero, time, kills, level and bosses beaten. Handles and scores are public on the leaderboard. |
| Account data (only if you sign in) | With a Solana wallet: your wallet's public address and, if it has one, its public .sol name. With Discord: your Discord user id, username and avatar. Used to sign you in, sync your progress, and show a verified name on the leaderboard. |
| Cloud save (only if you sign in) | Your game progress (coins, unlocked heroes, perks and lifetime stats), so it follows you across devices. |
| Feedback | The rating and text you send through the in-game feedback form, with your handle, hero, level, run time, build and device type. |
| Moderation reports | When you report a leaderboard name we store the name and a daily-rotating salted hash of your IP address, so one person counts once per day. |
We do not store IP addresses. A salted hash of your IP that changes every day is used only to rate-limit requests and count reports. We do not collect your email, real name, location, contacts, or payment details.
Wallets: sign-in only
Degen Dungeon never requests a transaction. When you sign in with Phantom, Solflare, Backpack or a mobile wallet, your wallet is only asked to sign a plain-text login message ("Sign-In With Solana"). Signing it costs nothing, moves no funds, and grants no permissions. We never see your private key or seed phrase, and we never read your balances.
To show a friendly name, we look up your wallet's public .sol name through the public Solana Name Service API (sdk-proxy.sns.id). Only your public address is sent.
Why we use it (legal bases)
- Running the game you asked for (contract): accounts, sign-in, cloud saves and leaderboard entries.
- Legitimate interests: anonymous telemetry to fix and balance the game; rate limiting, anti-cheat and moderation to keep it fair and safe; reading feedback you choose to send.
We do not sell data, show ads, or use your data for profiling or automated decisions about you.
Service providers
- Cloudflare, Inc.: hosting, content delivery, the database (Cloudflare D1) that stores all of the data above, privacy-friendly page analytics (Cloudflare Web Analytics, no cookies), and email forwarding for our support address.
- Discord Inc.: only if you choose "Sign in with Discord". Discord handles the login and shares your user id, username and avatar with us. Your avatar image is loaded from Discord's servers.
These providers may process data outside the EU. Where they do, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Account data and cloud saves: until you delete your account.
- Sign-in sessions: 30 days, or until you log out.
- Leaderboard entries: for as long as the leaderboard runs, or until you delete your account (for runs submitted while signed in).
- Anonymous telemetry and feedback: up to 24 months, then deleted or kept only as aggregate totals.
- Moderation reports: up to 12 months.
- Rate-limit counters: a few hours. Login challenges: 10 minutes.
Your rights
Under the GDPR you can ask to access your data, get a copy of it, have it corrected or deleted, restrict or object to its use. Email [email protected] and we will reply within one month. Anonymous telemetry is not linked to you, so we usually cannot find it unless you send us your install id. You can also complain to the Spanish data-protection authority, the Agencia Española de Protección de Datos (AEPD), or your local authority.
How to delete your data
- Signed in: open Sign in (your name chip on the main menu), then Delete account and confirm. This immediately deletes your account, linked wallet and Discord logins, sessions, cloud save, and the leaderboard runs you submitted while signed in.
- Guest: open Sign in, then Clear local data. This wipes your progress, settings, handle and anonymous ids from this browser.
- By email: write to [email protected]. For guest leaderboard entries, tell us the handle and roughly when you played.
Cookies and local storage
We use one cookie: an httpOnly session cookie, set only when you sign in, that keeps you logged in. During Discord sign-in a second short-lived (10 minute) cookie protects the login from forgery. There are no advertising, tracking or third-party cookies. The game also keeps your save, settings, handle and the anonymous install id in your browser's local storage so it works offline. These are strictly necessary for the game, so no consent banner is needed.
Children
Degen Dungeon is not directed at children under 13, and we do not knowingly collect personal data from them. In Spain, children under 14 need a parent's consent to create an account. If you believe a child has signed in, email us and we will delete the account.
Changes
If we change this policy we will update the date at the top. Significant changes will also be announced in the game.