This Privacy Policy explains how Calco Labs LLC ("Calco Labs," "we," "us," or "our") collects, uses, and shares information when you use the CALCo Labs website at calcolabs.com, the CALCo Arcade, and the wallet-login and username registry (collectively, the "Services"). We keep data collection deliberately minimal.
1.Information We Collect
We collect only the information needed to run the Services:
- Wallet information. When you sign in with an XRPL wallet, we receive your public XRP Ledger address and the cryptographic signature or sign-in token proving you control it. We never receive your private keys or seed phrase.
- Username. The globally-unique username you choose and claim, mapped to your wallet address or verified email.
- Email information. If you sign in by email, we collect your email address, a temporary one-time verification code, and your email-verified status.
- Optional profile details. If you provide them, your first and last name.
- Marketing consent. If you opt in to marketing emails, we record that choice along with the consent text, consent version, and opt-in/opt-out timestamps.
- Activity in the Arcade. Game scores (game, difficulty, score, and timestamp), short chat comments, and your preference for whether to display your wallet address publicly.
- Technical and log data. Like most websites, our hosting and infrastructure providers automatically process limited technical data (such as IP address, browser/device information, and request logs) for security, abuse prevention, and reliability. We also use limited browser local storage to keep you signed in.
We do not intentionally collect sensitive categories of personal information, and we do not run third-party advertising trackers.
2.How We Use Information
- To authenticate you and verify control of your wallet or email address.
- To register and display your username and keep one username per account.
- To operate the Arcade — recording and showing scores and chat on public leaderboards.
- To send transactional emails such as verification codes.
- To send marketing emails only if you have opted in (you can opt out anytime).
- To secure the Services, prevent abuse and fraud, enforce our Terms, and comply with law.
3.How Information Is Shared (Service Providers)
We do not sell your personal information. We share information only with the third-party processors that power the Services, and only as needed to provide them:
- Vercel — website hosting, serverless functions, and infrastructure logging.
- Upstash (Redis data store, accessed via Vercel KV) — stores usernames, profiles, marketing-consent records, scores, chat comments, and temporary verification codes and challenges.
- Xaman / XUMM (operated by XRPL Labs) — wallet sign-in and transaction-signing flows.
- WalletConnect — connecting compatible XRPL wallets.
- XRP Ledger (XRPL) — a public blockchain. Wallet addresses and any signed transactions are inherently public on the ledger.
- Resend — delivering verification and other transactional/marketing emails.
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of Calco Labs, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.
Public by design. Usernames, scores, and chat comments appear on public leaderboards and chat. Your wallet address is shown publicly only if you choose to share it. Anything posted on the public XRP Ledger is permanent and outside our control.
4.Data Retention
We keep information for as long as needed to provide the Services and for legitimate business or legal purposes. Username and profile records persist while your account is active. The public scoreboard and chat are capped and retain only the most recent entries; older entries are automatically dropped. One-time email verification codes and wallet sign-in challenges expire automatically within minutes. You may ask us to delete your profile data (see "Your Choices & Rights"). Note that data already written to the public XRP Ledger cannot be deleted by us.
5.Security
We use reasonable technical and organizational measures to protect information, including authentication based on cryptographic wallet signatures and time-limited, hashed email verification codes, served over encrypted (HTTPS) connections through reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your wallet keys and email account.
6.Your Choices & Rights
- Marketing emails. You can opt out at any time by updating your preference or contacting us; we will stop sending marketing emails and record your opt-out.
- Access, correction & deletion. Depending on your location, you may have the right to access, correct, or delete the personal information we hold about you, or to object to or restrict certain processing. To make a request, email us at [email protected].
- Disconnecting. You can stop using the Services and disconnect your wallet at any time.
We will respond to verifiable requests as required by applicable law. We do not sell or share personal information for cross-context behavioral advertising.
7.Children
The Services are intended for users 18 and older and are not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
8.International Users
We operate in the United States, and our service providers may process information in the United States and other countries. By using the Services, you understand that your information may be transferred to and processed in jurisdictions that may have different data-protection laws than your own.
9.Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Your continued use of the Services after changes take effect constitutes your acceptance of the revised policy.
10.Contact
Questions or privacy requests? Contact us at [email protected].