Privacy Policy

1. Who we are

FortBlockGames (“FBG”, “we”, “us”) is the controller of personal data processed through the Service. You can reach us at support@fortblockgames.com for any privacy request (access, deletion, correction, portability, opt-out).

2. Data we collect

When you use the Service, the following data is collected:

• Discord identity via Discord OAuth (with the identify scope): your Discord user ID, username, display name, avatar hash, account creation date, locale, premium status (Nitro tier), MFA enabled flag, public profile flags.
• X / Twitter profile if you connect it (with the users.read / follows.read scopes): your X user ID, handle, display name, bio, location, profile image URL, verified status, account creation date, follower/following/tweet counts.
• Wallet address (Avalanche C-Chain) when you connect a wallet to mint, stake, evolve, or claim NFTs. We never request your private key and cannot move funds without your signed approval.
• On-platform activity: quests completed, predictions made, battle history, factions joined, NFTs minted, lore items claimed, Conquest Points (CP) earned, daily check-in streaks.
• User-submitted content: games you upload to the Arcade (title, description, author name, optional author link, and the uploaded game files), messages you post in faction chat and the global Coms feed, and emoji reactions you add to messages.
• Gameplay telemetry: arcade play sessions and playtime, scores and leaderboard entries, cloud save data for arcade games, PVP duel and wager history, and marketplace listing / purchase activity.
• Referral codes if you sign up through a referral link, and referral codes you generate to invite others.
• Push subscriptionsif you opt into web push notifications: your browser’s push endpoint URL and the public encryption keys that authenticate notifications to your device.
• Sign-in diagnostics: first / last sign-in timestamps and your IP address at last sign-in. Used to identify abusive accounts and to help us recover yours if it gets hijacked.
• Support tickets you file (subject, body, optional transaction hash).

3. How we use it

• To run the game. Tracking CP, faction membership, battle participation, and NFT inventory is what makes the platform function.
• To verify quests.When you claim a Twitter follow quest, we call X’s API to verify the follow. When you claim a Reddit post quest, we fetch your post via Reddit’s API. These calls run only on user-initiated claim attempts; we do not silently scrape.
• To send notifications. Persistent in-app and web push notifications when you complete quests, unlock roles, or receive support replies.
• To detect abuse. Account age, follower count, and sign-in IP are used to flag likely throwaway / sybil accounts during airdrops or campaigns.

4. Who we share data with

We do not sell your personal data. We share data with:

• Hosting and infrastructure: Vercel (web hosting) and Supabase (database). Both are GDPR-compliant processors under data processing agreements.
• Identity providers: Discord (for sign-in), X / Twitter (for optional account linking). They get only what their OAuth flows require.
• Blockchain (public): any NFT mint, stake, or evolve transaction you sign is permanently recorded on the Avalanche public ledger and tied to your wallet address. We have no power to erase on-chain data.
• Push services: browser-operated push relays (Google FCM, Mozilla autopush, Apple APNs) carry our notifications to your device. They see only encrypted payloads and your endpoint URL.

5. Cookies and similar technologies

We set strictly-necessary cookies for authentication (signed NextAuth session token, CSRF token, OAuth callback URL). No third-party advertising or analytics cookies are set. The session cookie is HttpOnly and Secure; it cannot be read by client JavaScript.

6. Your rights

You can request any of the following at any time by emailing support@fortblockgames.com:

• Access: a copy of the personal data we hold about you.
• Correction: of any inaccurate field.
• Deletion: of your platform account. On-chain transactions cannot be deleted.
• Portability: a JSON export of your account.
• Opt-out of any non-essential processing (we currently do none, but reserve the right).

California residents: this section satisfies CCPA notice at collection. EU / UK residents: the lawful basis for processing identity + activity data is performance of contract (running the platform you signed up for) and our legitimate interest in operating it free from abuse.

7. Retention

We retain your account data as long as your account exists. If you request deletion, we delete your platform record within 30 days; on-chain transactions and Discord identity (which we never controlled) remain wherever they were already public.

8. Children

The Service is not directed to children under 13. If you believe a child has provided us data, contact us and we will delete it.

9. Changes

We will update this page (and the “Last updated” date above) when our practices change. Material changes will also be announced in our Discord server.