Privacy Policy

Version 1.2, 23 August 2026

1. Controller

UDAO SkillsValley AG, Hinterbergstrasse 20, 6312 Steinhausen, Switzerland is responsible for data processing on hodl.udao.org. For privacy requests write to privacy@skillsvalley.io. This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU GDPR applies to you, we honor it as well.

2. What we process

Your wallet address, which also exists on the public blockchain, and your quest activity. Your sign‑in session. An email address only if you add one for notifications. Usernames and account IDs of social accounts only if you connect them for task verification. Technical data such as IP address and browser type from our hosting providers' logs. Error reports when something in the app breaks: the error text, the page it happened on, and your browser type, with wallet addresses removed first. When you sign in, the signed message and its signature, which record which version of the Terms you accepted and when.

3. Why we process it

To run the platform and pay out quests (performance of contract). To verify tasks and prevent fraud (legitimate interest). To find and fix failures through error reports (legitimate interest). To send notification emails you asked for (consent, which you can withdraw on your profile page at any time).

4. Providers

We use Supabase for our database and authentication, Vercel for hosting, Twilio SendGrid for email delivery, thirdweb for wallet sign‑in, and PostHog for error reports. When you connect a social account, that platform (X, Discord, or Telegram) processes the connection under its own policy. Our providers process data in the European Union, the United States, and Singapore, and we select providers that commit to recognized transfer safeguards.

5. The blockchain

Your wallet address, holds, and reward transactions are recorded on the public Polygon blockchain. A public blockchain cannot be edited or erased, by us or by anyone. Your data protection rights apply to the data we store, not to the chain itself.

6. Retention

We keep account data while your account exists and as long as the law requires. You can remove your email address at any time on your profile page.

Records of which version of the Terms you accepted are kept for the duration of the agreement and for ten years afterwards, the limitation period for contractual claims under Swiss law (Art. 127 CO). They are not deleted with the rest of your account data, and we cannot delete them on request, because their whole purpose is to evidence what was agreed and a record we could remove would not do that.

7. Your rights

You can request access, correction, deletion (except on‑chain data and the terms‑acceptance records described in section 6), restriction, and a copy of your data, and you can object to processing. Write to privacy@skillsvalley.io. You can also complain to the Swiss Federal Data Protection and Information Commissioner or to your local authority.

8. Cookies

HODLQuest sets only the cookies needed for sign‑in sessions and account connection flows. There are no advertising cookies. PostHog receives error reports only: it does not track your browsing, and it stores nothing on your device. That is why you see no cookie banner.

9. Changes

We announce material changes on the platform. The current version always lives on this page.