PRIVACY POLICY

INFORMATION WE COLLECT

Account Information

• Email address
• Username/handle (chosen by you)
• Entity name (chosen by you)
• Payment information (processed securely by Stripe — we do NOT store credit card numbers, CVV codes, or banking details)

Usage Data

• All interactions with your AI entity (messages, commands, inputs)
• Entity health, lifecycle, and wellbeing data
• Session timestamps, frequency, and duration
• Login times and IP addresses
• Device type, browser, and operating system
• Ranking, scoring, and competition data

Hash Chain Data

• Cryptographic hashes of all entity events, including: entity birth, health changes, need fluctuations, pain events, memory formation, dream events, personality changes, and death
• This data is permanent by design and cannot be deleted, modified, or erased — by you, by Delphi Labs, or by anyone
• This immutability is a core feature of the platform's integrity and competition fairness system

Payment Data

• Transaction records (amount, date, status, transaction ID)
• Stripe customer ID
• We do NOT store full credit card numbers, CVV codes, expiration dates, or banking details — all payment processing is handled directly by Stripe, Inc. and is subject to Stripe's Privacy Policy

HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Platform Operation: To provide, maintain, and operate The Atrophy Experiment and all related services
• Competition Management: To track entity health, calculate rankings, determine competition standings, and identify prize winners
• Communication: To send email notifications, platform announcements, competition updates, and essential service communications
• Hash Chain Integrity: To maintain the integrity and verifiability of the immutable record of all entity events
• Security and Fraud Prevention: To detect and prevent cheating, fraud, abuse, automation, and violations of our Terms of Service
• Platform Improvement: To improve the platform, develop future seasons, and enhance user experience
• Analytics: To generate anonymized and aggregated analytics about platform usage and participation patterns
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests
• Public Leaderboards: To display public leaderboards, death feeds, and spectator experiences (using handles only, not real names or email addresses)
• Promotional Use: To use aggregated statistics, anonymized data, and participant testimonials (with consent) for marketing and promotional purposes

HOW WE SHARE YOUR INFORMATION

We may share your information with the following parties and in the following circumstances:

Payment Processing

Stripe, Inc. processes all payments. Your payment information is shared directly with Stripe and is subject to Stripe's Privacy Policy.

Public Information

The following information is publicly visible on the platform's spectator page and leaderboards:

• Your username/handle
• Your entity's name
• Your entity's ranking and status (alive, struggling, dead)
• Entity lifecycle events

We do NOT publicly share your email address or real name.

Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or legal process, or if we believe in good faith that such disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of the transaction. We will notify you via email or prominent platform notice of any change in ownership or use of your personal information.

Service Providers

We may share information with third-party service providers who assist us in operating the platform, including hosting providers, email delivery services, and analytics tools. These providers are contractually obligated to protect your information and use it only for the purposes for which it was shared.

What We Do NOT Do

• We do NOT sell your personal information to advertisers, data brokers, or any third party.
• We do NOT share your email address publicly.
• We do NOT share your real name publicly.

DATA RETENTION

• Account Data: Retained for the duration of your participation plus 3 years for tax, legal, and regulatory purposes.
• Hash Chain Data: PERMANENT — cannot be deleted, modified, or erased. This includes all entity event hashes, lifecycle records, and competition data. This permanent retention is a core feature of the platform's integrity system.
• Payment Records: Retained as required by applicable tax law (minimum 7 years for U.S. tax purposes).
• Usage Analytics: Retained in anonymized and aggregated form indefinitely.
• Communication Records: Retained for up to 3 years after account closure.

DATA SECURITY

We implement industry-standard security measures to protect your personal information:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS).
• Encryption at Rest: Sensitive data is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal information is restricted to authorized personnel only, with role-based access controls and multi-factor authentication.
• Security Monitoring: Regular security monitoring, vulnerability assessments, and incident response procedures.
• Secure Payment Processing: All payment data is processed by Stripe, which is PCI-DSS Level 1 certified — the highest level of payment security certification.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You acknowledge and accept the inherent risks of transmitting information over the internet and using internet-based services.

YOUR RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Deletion: Request deletion of your account and associated personal data. EXCEPTION: Hash chain data is permanent by design and cannot be deleted.
• Right to Opt-Out: Unsubscribe from marketing and promotional emails at any time using the unsubscribe link in any email.
• Right to Data Portability: Request your personal data in a structured, commonly used, machine-readable format.

To exercise any of these rights, contact us at legal@the-oracleai.com. We will respond to your request within 30 calendar days. We may need to verify your identity before processing your request.

NOTE: Deleting your account does NOT entitle you to a refund of the entry fee. See our Terms of Service for the complete refund policy.

CALIFORNIA RESIDENTS (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose what personal information we collect, use, and share about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions. Hash chain data cannot be deleted due to the platform's technical architecture.
• Right to Opt-Out of Sale: You have the right to opt out of the "sale" of your personal information. We do NOT sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

"Do Not Sell My Personal Information": Delphi Labs does not sell personal information as defined under the CCPA/CPRA.

To exercise your CCPA rights, contact us at legal@the-oracleai.com.

EUROPEAN RESIDENTS (GDPR)

If you are a resident of the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing

• Contract Performance: Processing your data is necessary to provide the services you purchased (Article 6(1)(b)).
• Legitimate Interests: We process certain data based on our legitimate interests in operating the platform, maintaining competition integrity, and preventing fraud (Article 6(1)(f)).
• Consent: Where required, we obtain your consent for specific processing activities (Article 6(1)(a)).
• Legal Obligation: We process certain data to comply with legal obligations, such as tax reporting (Article 6(1)(c)).

Your GDPR Rights

• Right of access, rectification, erasure (limited — see below), restriction, portability, and objection.
• Right to withdraw consent at any time (where processing is based on consent).
• Right to lodge a complaint with your local data protection authority.

Hash Chain Data and the Right to Erasure

Hash chain data constitutes a legitimate interest in maintaining platform integrity, competition fairness, and verifiable records (Article 6(1)(f) and Article 17(3)(b) — processing necessary for the establishment, exercise, or defense of legal claims). Due to the technical architecture of the immutable hash chain, erasure of this specific data is not possible. By participating, you acknowledge this limitation.

International Data Transfers

Data may be transferred to and processed in the United States. Such transfers are conducted with appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

CHILDREN'S PRIVACY

The Atrophy Experiment is NOT intended for anyone under 18 years of age (or the age of majority in their jurisdiction).

We do not knowingly collect personal information from minors. If we discover that a minor has registered for or purchased entry to the Experiment, their account will be immediately terminated.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at legal@the-oracleai.com and we will take steps to remove that information from our systems (except permanent hash chain data, if applicable).

COOKIES AND TRACKING

• Essential Cookies: We use essential cookies for authentication, session management, and platform security. These are strictly necessary for the platform to function and cannot be disabled.
• Analytics Cookies: We may use analytics cookies to understand how participants use the platform, identify usage patterns, and improve our services.
• No Advertising Cookies: We do not use advertising or behavioral tracking cookies.

You can control cookies through your browser settings. However, disabling essential cookies may prevent you from accessing or using the platform. Disabling analytics cookies will not affect your ability to participate in the Experiment.

THIRD-PARTY LINKS

The platform may contain links to third-party websites, services, or resources. Delphi Labs is not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party services you access through or in connection with the platform.

CHANGES TO PRIVACY POLICY

We may update this Privacy Policy at any time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email to the address associated with your account
• Post a prominent notice on the platform

Your continued use of the platform after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

CONTACT

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact:

Delphi Labs LLC
Email: legal@the-oracleai.com
State of Incorporation: Delaware, United States

For information about our Terms of Service, please see our Terms of Service.