Privacy Policy

1. Overview

This Privacy Policy explains how Foxsy AI (“Foxsy”, “we”, “us”, “our”) collects, uses and shares information when you access the FoxLeague websites, apps and on-chain Services. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

FoxLeague needs no account beyond your wallet: you sign in by signing a message with your MultiversX wallet. We do not ask for your name, email address, phone number or postal address.

2. Data Controller & Contact

Foxsy AI, a Wyoming corporation
30 N Gould St Ste R
Sheridan, WY 82801, USA
Email: contact@foxsy.ai

Depending on your location, local entities or partners may act as processors on our behalf.

3. What We Collect

Wallet & on-chain data: your public wallet address; the network you are connected to; your $FOXSY and EGLD balances where a check needs them (for example the registration fee check or the onboarding EGLD bonus, which goes only to wallets that hold almost no EGLD); the player NFTs held by your wallet; the transaction hashes of the actions you take on FoxLeague smart contracts (registration, shop payments, training slots, sync, marketplace auctions, fusion, tournament entries, prizes and refunds).

Sign-in data: when you sign in, the server creates a session tied to your wallet address that expires after 24 hours. Your browser keeps the session token in session storage until you close the tab or log out. We record when your wallet was last active.

Team & game data: team name, optional coach name, team badge, formation and lineup choices, training sessions, match results (scores, per-player ratings and match events), match replays, tournament entries and standings, ELO rating and league, marketplace listings, bids and sales, fusion history, shop purchases and refunds, records of onboarding EGLD bonuses, notifications and your notification settings.

Team badge: the badge is generated by sending your team name to a third-party AI image model, currently Google Gemini. The image is stored on IPFS through our own node. Content on IPFS is public and content-addressed: anyone with the address can retrieve it. We cannot guarantee its removal from every IPFS node.

Web push (optional): if you turn on push notifications, your browser gives us a push subscription (an endpoint address and encryption keys) that we store to send you notifications. Turning them off removes it.

Technical data & logs: our web servers log the IP address, time, requested page and browser type of each request. The backend uses the IP address of a request for rate limiting. Failed sign-ins are limited to 10 per minute per IP address and per wallet; past that limit the address or the wallet is refused for 5 minutes, while a valid signature always signs you in. The records we keep of failed sign-ins and of the sign-in that creates your account hold a fingerprint of the IP address instead of the address itself: a 12-character keyed hash (HMAC-SHA256) under a secret only our server holds. It shows us that several attempts came from the same source. For the limit and the fingerprint an IPv6 address counts as its /64 network. When the app hits an error it sends a report with the error, the app version and your wallet address if you are signed in.

KYC / AML data (when required): identity documents, proof of address and liveness checks collected by regulated providers; we receive pass/fail signals and limited metadata.

Communications: messages sent to support or posted in official channels (Telegram).

4. Why We Process Data (Legal Bases)

Provide and operate the Services: sign-in, teams, matches, tournaments, the shop, the marketplace, payouts and refunds (contract performance).
Verify eligibility, prevent fraud, abuse and multi-accounting, ensure fair play and platform security (legitimate interests; legal obligations).
Comply with AML / CFT, sanctions screening and other legal requirements (legal obligations).
Send service notices and, where you opted in, push notifications (legitimate interests / consent).

5. Cookies, Browser Storage & Fonts

The app keeps your sign-in session in session storage and preferences such as theme, sound and settings in local storage, in your browser. We use no advertising cookies and no third-party analytics or tracking scripts. If we later adopt analytics or marketing cookies, we will present a consent banner with granular controls. The app loads its fonts from Google Fonts, so your browser sends your IP address to Google when it fetches them.

We do not sell personal data. We share it only as follows:

The MultiversX network (gateway and API): your transactions and balance queries go through them.
Wallet providers you choose to use (xPortal, MetaMask snap, MultiversX Wallet Extension, MultiversX Web Wallet, Passkey, Ledger): they process your connection and signatures under their own terms.
Google: the Gemini API receives your team name to generate the badge; Google Fonts sees your IP address when your browser fetches the app’s fonts.
IPFS: the badge image is published there.
Telegram: when match announcements are switched on, the tournament or 1v1 challenge name, the team names, the score and a link to watch the match are posted to the public FoxLeague Telegram group; also your messages when you contact us there.
Anyone who asks the public API: the game data the app shows every visitor (wallet addresses, team and coach names, badges, player cards, ratings, results, standings, marketplace listings and sales) is also answered by the public FoxLeague API and by the read-only FoxLeague MCP server to any client, AI assistants included.
Browser push services (run by your browser vendor): deliver push notifications if you opted in.
Exchanges where $FOXSY is traded: only if you choose to use them; they collect their own data, including their identity checks, under their own terms.
Hosting and infrastructure providers that run our servers, under contracts and DPAs.
Compliance & safety: regulators, law enforcement or competent authorities when legally required.
Corporate events: in a merger, acquisition or asset transfer, your information may be transferred subject to standard confidentiality safeguards.

7. International Data Transfers

We operate globally. Where data moves outside your country, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

8. Data Retention

We keep personal data only as long as necessary for the purposes described, including tournament records, dispute resolution, security and legal compliance. Retention periods vary by category and legal requirement. In particular:

Sign-in sessions expire after 24 hours. Expired sessions are deleted by a cleanup that runs with the traffic (by default every 100 signed-in requests) and by a daily sweep.
Replay recordings of every match (casual, ranked, tournament and 1v1) are kept for as long as the game runs, so every replay stays available. A copy is kept by our hosting provider. The results and statistics of every match are kept.
Application event logs are deleted after 30 days; routine refusal notices at the lowest level (for example a match start the rules refused) after 14 days. Error and warning records, including the app’s error reports, are deleted after 90 days once resolved; an unresolved one is kept until it is resolved.
Data written to the blockchain is permanent by the nature of the blockchain (see section 12).

9. Your Rights (EEA / UK and similar regimes)

You may have rights of access, rectification, erasure, restriction and portability (subject to limits). You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. You may lodge a complaint with your data protection authority. Data written to the blockchain cannot be changed or erased by us.

To exercise rights, email contact@foxsy.ai. We may request additional information to verify your identity, for example a message signed with your wallet.

10. Children

FoxLeague is not directed to children under 18. Team creation asks you to confirm you are 18 or older. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us to delete it.

11. Security

We use administrative, technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging. Signing in with your wallet never gives us your private keys. No system is 100% secure.

12. Web3 Transparency

FoxLeague runs on the MultiversX mainnet. Transactions on the MultiversX network are public and immutable. Your wallet address, NFT holdings, $FOXSY balance, marketplace auctions, tournament entries, shop, training and sync payments, fusion events and the prizes and refunds paid to your wallet are written to the ledger and visible on any blockchain explorer (for example explorer.multiversx.com). Do not use a wallet you consider private for public on-chain activity.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date and, where appropriate, additional notice.

14. Contact