Privacy Policy

Last updated: July 3, 2026

1. Introduction

This Privacy Policy describes how NinjaNoJutsu, S.A. ("NNJ", "we", "us", or "our") collects, uses, stores, and protects your personal information when you access or use the NinjaNoJutsu website, game client, smart contracts, and related services (collectively, the "Service").

By using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, you must not access or use the Service.

This Privacy Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Information We Collect

We collect minimal personal information. Our design philosophy is "self-custody first" — we do not hold your funds, your passwords, or your private keys. The information we collect falls into three categories:

2.1. Information You Provide Voluntarily:

  • Username or display name (optional)
  • Email address (optional, for account recovery and notifications)
  • Profile avatar or image (optional)
  • Discord or social media handles (optional, for community features)
  • Communications with our Support team

2.2. Information Collected Automatically:

  • IP address and approximate geolocation (for geoblocking and fraud prevention)
  • Browser type, device type, and operating system
  • Solana wallet public address (when connected)
  • Match participation data, win/loss records, and leaderboard rankings
  • Transaction hashes of on-chain interactions (deposits, claims, fees)
  • Server logs and error reports

2.3. Information We Do NOT Collect:

  • Private keys, seed phrases, or wallet passwords
  • Passwords (we do not use password-based authentication)
  • Full name, mailing address, or government ID (unless required for risk-based KYC)
  • Payment card or bank account information
  • Biometric data

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Provision: To operate the matchmaking system, process match entries, verify prize claims, and maintain your account.
  • Geoblocking and Compliance: To enforce jurisdictional restrictions, prevent access from prohibited states and countries, and comply with sanctions lists (OFAC, UN, EU).
  • Fraud Prevention and Security: To detect and prevent cheating, collusion, multi-accounting, VPN circumvention, and other prohibited conduct. To monitor for suspicious transaction patterns that may indicate money laundering or sanctions evasion.
  • Match Integrity: To generate and store the cryptographically signed per-match ledger, verify server signatures, and resolve disputes.
  • Communication: To send match notifications, prize claim reminders, security alerts, terms updates, and promotional materials (if you opt in).
  • Analytics and Improvement: To analyze platform usage, improve game balance, optimize matchmaking algorithms, and enhance user experience.
  • Legal Compliance: To comply with applicable laws, respond to lawful requests from authorities, and enforce our Terms of Service.

4. Blockchain Data and Public Ledgers

The Solana blockchain is a public, immutable ledger. When you interact with our smart contracts, certain information becomes publicly visible and permanent:

  • Your Solana wallet public address
  • Transaction amounts (deposits, claims, fees)
  • Match UUIDv7 identifiers
  • Smart contract interaction timestamps

Per-Match Ledger: Every match generates an independent, immutable ledger stored on our servers. This ledger includes match state events, timestamps, player actions, and the final resolution event. While the ledger is stored server-side and used for audit and dispute resolution, the on-chain transaction data (your wallet address, match ID, and transaction amounts) is permanently public on the Solana blockchain.

We cannot delete, modify, or redact information that has been recorded on the blockchain. If you require anonymity, you should use a wallet address that is not linked to your identity.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

  • Essential Cookies: Required for the Service to function, including session management, wallet connection state, and geoblocking enforcement.
  • Analytics Cookies: We use a self-hosted analytics software to collect anonymized navigation data, page views, and user engagement metrics. It is configured to respect Do Not Track signals and does not share data with third parties.
  • Functional Cookies: To remember your preferences, such as language selection, display settings, and notification preferences.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

  • Service Providers: We may use third-party providers for hosting, analytics, customer support, and security services. These providers are contractually bound to process data only on our behalf and in accordance with this Privacy Policy.
  • Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or if necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction. We will notify you of any such change in ownership or control.
  • With Your Consent: We may share information with third parties when you explicitly authorize us to do so.

We do not share your information with advertisers, data brokers, or marketing networks.

7. Data Security

We implement industry-standard security measures to protect your information:

  • TLS/SSL encryption for all data in transit
  • Server-side encryption for stored data
  • Access controls and role-based permissions for staff
  • Regular security audits and penetration testing
  • Immutable smart contracts with no admin override for fund access

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

Important: We never store your private keys, seed phrases, or wallet passwords. You are solely responsible for the security of your self-custody wallet.

8. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

  • Account Information: Retained while your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.
  • Match Ledgers: Retained for a period at our discretion, as they serve as the immutable audit trail for match outcomes and prize distributions. The last match event will be retained indefinitely. Ledgers contain wallet addresses and match data but do not contain personal identifiers like names or emails.
  • Server Logs: Retained for 90 days for security and fraud prevention, then deleted or anonymized.
  • Support Communications: Retained for 1 years to assist with dispute resolution and legal compliance.
  • Blockchain Data: As noted in Section 4, on-chain data is permanent and cannot be deleted by us.

9. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request that we correct inaccurate or incomplete information.
  • Deletion: Request deletion of your personal information, subject to legal retention requirements and blockchain immutability.
  • Portability: Request a copy of your data in a structured, machine-readable format.
  • Objection: Object to certain types of processing, such as direct marketing.
  • Withdraw Consent: Withdraw consent for optional data processing (e.g., promotional communications).

To exercise these rights, contact us at support@ninjanojutsu.com. We will respond within 30 days of receiving your request.

Account Deletion: You may delete your account at any time through the account settings page or by contacting Support. Upon deletion, your username, email, and profile data will be removed. Your match history and on-chain transactions will remain as part of the immutable ledger and blockchain record.

10. International Data Transfers

NNJ is based in Costa Rica. Your information may be processed and stored in Costa Rica and other countries where our service providers operate. By using the Service, you consent to the transfer of your information to these locations.

We ensure that any international transfers are subject to appropriate safeguards, including standard contractual clauses or adequacy decisions where required by applicable data protection laws.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at support@ninjanojutsu.com and we will delete such information promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service with a revised "Last updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

NinjaNoJutsu, S.A.
Attn: Privacy / Data Protection
Cartago, Costa Rica
Email: privacy@ninjanojutsu.com