Privacy Policy

This Privacy Notice explains how Cheese Art Labs L.L.C. (“Bad Place”, “we”, “us”) collects, uses, shares and retains personal data when you use the Bad Place website at badplace.io, the Bad Place mobile applications, our APIs, and the features built on them — including BadLine, Bad Street, BadEx, the Backroom, Bad Vault (our web wallet at wallet.badplace.io), and token creation and trading.

Cheese Art Labs L.L.C. is the data controller for this processing. Our registered address is Ukshin Hoti 51, Prishtinë, Republic of Kosovo.

“Personal data” means information that identifies you or can reasonably be linked to you. Data that has been aggregated or irreversibly anonymised so that it can no longer be connected to you is not personal data and this Notice does not restrict our use of it.

This Notice does not cover third-party services you reach through Bad Place — external wallets, blockchain explorers, decentralised exchanges, or any site you open from a link posted by another user. Those operate under their own privacy terms. See section 22.

We collect the minimum needed to operate the platform. The following comes from you directly:

• Email address — required to create an account and to receive one-time sign-in codes.
• Profile information — username, display name, bio, avatar and banner images, and any links you choose to publish.
• Wallet addresses — the public addresses you connect, link or generate, including those of your Bad Vault. Public addresses only; we never receive key material in readable form.
• Bad Vault data — if you create or import a Bad Vault, the encrypted wallet, its settings and the passkey records described in section 4, and your acceptance of the Bad Vault terms.
• Content you create — tokens and their metadata, BadLine posts, replies, comments, uploaded images, AI prompts and AI-generated media, and community submissions.
• Support and abuse correspondence — what you write to us, including reports you file about other users.
• Verification material — where a feature requires it, such as proof of control of a social account or of a wallet.
• Creator Program application — if you apply to the Creator Program: your Telegram profile link, a contact email address (which may differ from the email on your account), any other social profiles you choose to add, and the EVM wallet address to which you want your creator earnings paid. We also keep your X handle and follower count at the time you applied, the record of your acceptance of this Notice, the status of your application and our review decisions. Payouts to that address are blockchain transactions and are public (section 11).

We do not collect private keys, seed phrases or key shares of any kind in readable form (the encrypted Bad Vault copy, which we cannot decrypt, is described in section 4); precise geolocation; contact lists or address books; biometric identifiers — passkey checks happen on your device; or any special-category data such as health, religion, political opinion or sexual orientation. We do not ask for government identity documents, and you should never send them to us.

When you use Bad Place, some information is generated by the act of using it. We collect:

• IP address — recorded in server and security logs, including the Bad Vault security log (section 4), and used for rate limiting, abuse prevention and fraud detection.
• Sign-in history — each time you sign up or sign in, we record the IP address you connected from, the time, the sign-in method and your browser or app's user-agent string against your account. We use this to secure your account, to investigate fraud and abuse, and to respond to valid legal process from law enforcement and other competent authorities (section 10).
• Approximate location — the country, derived from the IP address by our network provider. We do not collect precise location.
• Device and client information — browser type and version, operating system, app version, screen and language settings, and time zone.
• Request metadata — the endpoints you call, timestamps, response codes, referring page, and the session identifier attached to your requests.
• Push notification token — on mobile, only if you grant notification permission.
• Interaction signals — what you view, open, like (“cheers”), reply to and follow, used to rank your feed.
• Website usage analytics — on the website only, the pages you visit and a fixed list of product events, collected with PostHog as described in section 14.

We do not fingerprint your device to track you across other websites, and we do not buy or receive behavioural data about you from data brokers or advertising networks.

We cannot access your wallets, and we hold no key material in a form we can use. This is an architectural fact, not a policy promise — it is a property of how the product is built, and it cannot be quietly reversed by editing this page (section 23 explains why a change to it is always material). What we hold depends on the wallet you use.

• External wallets on the website — if you connect a wallet you already control, such as a browser extension, a wallet connected through WalletConnect, or the Bad Place app through the phone link, its keys stay in that wallet. We receive its public address and, when you link it to your account, a signature that proves you control it.
• Bad Vault on the website — if you create or import a Bad Vault, your browser encrypts the wallet before anything is sent to us. For each Bad Vault we store: the encrypted wallet and the random value used to encrypt it; a second encrypted copy of the key that unlocks the wallet, which only your recovery phrase can open, so that the phrase can add a new passkey; the public address of a signing key derived from your recovery phrase, which lets our servers check requests made with that phrase; the Bad Vault's public EVM and Solana addresses; your Bad Vault settings, such as per-transaction limits, in encrypted form; a format number and a version counter; the version, language and fingerprint (hash) of the Bad Vault terms you accepted and when you accepted them; the dates it was created and last changed; and, where they apply, the date of a reset you requested and the date and reason it was archived. For each passkey you add, we store: its credential identifier, its public key and the algorithm it uses, so that our servers can check that a change to your Bad Vault was approved with one of your passkeys; a random identifier and a random salt generated for it; an encrypted copy of the key that unlocks the wallet; the connection types your browser reports for it (such as built-in or USB); the name shown for it in your device list; and the dates it was added, last used and removed. The keys that decrypt your wallet are derived on your device from your passkey or your recovery phrase and are never sent to us. Nothing we store is enough to decrypt your wallet.
• Passkeys — the passkey's private key, and any fingerprint, face or device PIN check behind it, stay on your device or with your passkey provider. We do not request attestation, so we are not told the make or model of your authenticator, and we never receive biometric data.
• Bad Vault security log — we record security-relevant actions on your Bad Vault: creating or importing it, replacing it after a reset, re-encrypting it, deleting and archiving it, adding, renaming and removing passkeys, changing its settings, accepting its terms, requesting a reset (including sending you the confirmation code), cancelling a reset, authorising the deletion of your account, rejected attempts to change it, and our deletion of an archived or purged Bad Vault. Each entry holds the time, the kind of action and technical details such as which passkey was involved, and, for actions made through your browser, the IP address and the browser user-agent. We use this log to protect your Bad Vault, to investigate misuse and to respond to valid legal process from competent authorities (section 10). How long we keep it is set out in section 16.
• Mobile app wallet — in the Bad Place mobile app, your recovery phrase is generated on your device and kept in the device's secure storage, encrypted with a key derived from your wallet password. If you turn on the optional cloud backup, the encrypted copy is stored in your own iCloud Keychain or in the app's private folder in your Google Drive — in your cloud account, not on our servers. The app wallet never reaches our servers.
• Linked addresses — a wallet address linked to your account is a link proved with a signature; a signature proves control and grants us none. When you set up a Bad Vault, it signs a message that links its EVM address to your account, so that we can show you your balances, positions and trades. Like other linked addresses, it can appear on your public profile (section 11).
• Because nothing we hold can decrypt a wallet, we cannot move your funds, freeze your wallet, reverse a transaction, or restore access if you lose your recovery phrase — and, for Bad Vault, all of your passkeys.

Your account is an identity for social and platform features. On its own it cannot spend your funds — even with Bad Vault, spending needs one of your passkeys or your recovery phrase. Anyone who tells you that Bad Place support can recover a lost recovery phrase is attempting to defraud you.

Creating an account requires an email address. You may additionally link third-party accounts, each of which is optional unless stated otherwise.

• Email — required to register, verify your account and sign in with a one-time code.
• Two-factor authentication — if you enable it, we store the shared secret encrypted with a server-held key.
• Google Sign-In — optional. We receive your email address, Google account identifier and profile picture.
• Apple Sign-In — optional. We receive your Apple account identifier and the email address Apple releases to us. If you use Apple Private Relay, that address is a relay address and we never see your real one; we match your account on the Apple identifier, not the email.
• X (Twitter) — optional, and required for certain social and reward features. We receive your public handle, profile picture, banner, the date your X account was created and your public follower count. We use the account date and follower count to decide whether you can use certain features — for example, the Creator Program requires a minimum number of followers. If X does not provide them, or the follower count is out of date, we may read them through Xquik (section 10).
• Push notifications — a device token, only if you allow notifications.

Linked accounts can be disconnected at any time from Settings. Disconnecting stops future collection from that service; it does not retroactively erase data already received, which is handled under the retention rules in section 16.

Several features generate or analyse images and text using AI models operated by third parties on our behalf. Using them is your choice.

What is sent: the prompt you write, the options you select, any reference image you upload, and — for ranking and recommendation features — the text of content you publish and, where enabled, the first image attached to a post (a photo, a Cook image or a video's cover frame).

Who processes it. Each of the following acts as a processor for us and is contractually restricted to processing your data for our purposes only:

• Google (Gemini) — image generation, prompt interpretation, and embeddings (numerical representations) of the text and, where enabled, the images of posts you publish, used for feed ranking and interest matching.
• Anthropic (Claude) — text generation and automated safety review of prompts and content.
• xAI (Grok Imagine) — image generation and image editing in the Cook feature.
• AtlasCloud — image generation and image editing in the Cook feature.
• OpenAI — text embeddings, where configured as the embedding provider in place of Google.

Reference photographs you upload are used for generation and safety review and are not retained as source images after processing completes. Generated output that you keep is stored on our media infrastructure and linked to your account.

AI providers are added, removed and swapped as the product evolves. When that happens this section is updated, and material additions are announced under section 23. If you do not want your content processed this way, do not use the AI features — the rest of the platform works without them.

Content uploaded to Bad Place passes through automated safety systems before and after publication. You are entitled to know that this happens, what it can decide on its own, and how to contest it.

• Every uploaded image is checked against known child sexual abuse material using the Canadian Centre for Child Protection's Project Arachnid service.
• Text and images are screened by automated classifiers for the categories set out in our Acceptable Use Policy.
• Automated signals also feed rate limiting, spam detection and anti-manipulation systems, which can throttle or temporarily restrict an account.

Where a decision is fully automated. Confirmed matches against known CSAM result in immediate permanent termination and, where the law requires it, a report to the competent authority. This is a deliberate exception: it is automated, it produces a legal effect for you, and there is no appeal. Every other enforcement outcome that permanently restricts an account — bans, content removals, reward disqualification — is subject to human review on request.

Your right to object. If an automated system has restricted your account, you may write to [email protected] to obtain human review, express your point of view, and contest the outcome. We will tell you the basis of the decision to the extent that doing so does not compromise the detection system itself.

Automated moderation is a filter, not an approval. Content that passes it has not been reviewed by a person and has not been declared lawful.

Where the GDPR, the UK GDPR or an equivalent law applies to you, we process your personal data only where we have a lawful basis for doing so. Ours are:

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, displaying your content and holdings, executing the platform functions you ask for, storing and delivering your encrypted Bad Vault and its passkey records, reviewing your Creator Program application and calculating and paying the creator earnings it entitles you to, and providing support. Without this data the service cannot be delivered.
• Legitimate interests (Art. 6(1)(f)) — securing the platform, preventing fraud, abuse, spam and market manipulation, checking that creator referrals are genuine (for example, that the referral was made when the referred account signed up, and that the referred account does not share a wallet with the creator), keeping a sign-in history, a Bad Vault security log and a limited record of deleted accounts so that we can investigate abuse, enforce bans and respond to valid legal process from competent authorities, ranking your feed, measuring aggregate product usage, understanding and improving the service through the website analytics described in section 14, and defending legal claims. We have weighed these against your rights and you may object at any time under section 18; for website analytics, the switch in Settings is the quickest way.
• Legal obligation (Art. 6(1)(c)) — retaining records we are required to keep, responding to valid legal process, operating the copyright notice-and-counter-notice procedure, and reporting child sexual abuse material.
• Consent (Art. 6(1)(a)) — push notifications, optional linked accounts, and any use of the AI features. You may withdraw consent at any time; withdrawal does not affect processing carried out before it.
• Substantial public interest and protection of vital interests — detecting and reporting child sexual abuse material and credible threats of violence.

We use the data described above to:

• Create, authenticate and secure your account
• Provide platform functionality and display your content and activity
• Show your transaction and position history
• Rank and personalise your feed and recommendations
• Calculate rewards, fees, referrals and distributions
• Review Creator Program applications, contact applicants, and calculate and pay creator earnings
• Send service messages, security alerts and notifications you enabled
• Detect and prevent fraud, abuse, spam and market manipulation
• Enforce our Terms of Service and Acceptable Use Policy
• Diagnose faults, measure aggregate usage and improve the product
• Comply with legal obligations and respond to valid legal process
• Establish, exercise or defend legal claims

We do not use your data for targeted advertising, sell it to third parties, build marketing profiles, or track you across other websites. We do not train our own models on your content, and we do not grant our AI processors the right to train their models on it.

We share personal data only in the situations listed here:

• Blockchain networks — transactions you submit are public by design. See section 11. On the website, requests for balances, prices, fees and transaction status go from your browser directly to public RPC endpoints that third parties operate for each network, and when you use Bad Vault your signed transactions are sent the same way; those operators see your IP address and the addresses and transactions involved. If you turn on protected mode on BNB Chain, your signed transaction is sent to the transaction relay operated by 48 Club instead of the public network — directly from your browser when you use Bad Vault, so 48 Club sees your IP address, and from our server when you use the mobile app.
• AI processors — Google, Anthropic, xAI, AtlasCloud and OpenAI, limited to the content you submit to AI features (section 6).
• Child safety organisations — the Canadian Centre for Child Protection for CSAM detection, and competent authorities where a report is legally required.
• Infrastructure and service providers — they act on our instructions under written terms. The ones that can see personal data are named here: Hetzner Online (server hosting, database and object storage, Germany), Cloudflare (content delivery, DNS, DDoS protection and inbound email routing), Resend (transactional email — sign-in codes, security notices) and Expo (push notification delivery to your device). Blockchain node providers receive the transactions and addresses we query on your behalf; they are not given your account data.
• Product analytics — PostHog (PostHog Inc., EU Cloud), on the website only, unless you switch it off. It receives the usage data described in section 14 and, if you are signed in, our internal account identifier. Your email address and wallet addresses are not sent to it.
• The user who invited you — if you joined Bad Place through someone's referral link, that user sees your username, profile picture, the date you joined through their link, your referral status and the Bad Points they have earned from you in their referral list. If they are an approved Creator Program member, they also see the date your 90-day referral period ends, the amount they have earned, per network, from the platform fees on your trades — an amount that indicates roughly how much you trade on Bad Place — and whether your referral counts toward their creator earnings and, if it does not, the reason: that the referral was made more than 7 days after you signed up, or that one of your wallet addresses is also one of theirs. They do not see your wallet addresses, your individual trades or your email address.
• X account checks — Xquik, a service we use to read public X data: to check your X account's age, to verify X tasks you complete (follows, reposts and posts you submit), and to refresh your follower count when X has not provided it. It receives your X handle or X account identifier and the identifiers of the posts concerned. These requests are made by our server, so Xquik does not see your IP address.
• GIF search — Klipy, when you search for a GIF. Your search term and an internal account identifier are sent so Klipy can return and rate-limit results. Your IP address is not sent: the request is made by our server, not by your device, so Klipy never sees where you are connecting from.
• Wallet connection services — the website offers external wallets through WalletConnect, operated by Reown (including Binance Wallet and Trust Wallet, which connect that way). When the website loads, your browser may contact WalletConnect's services, which then receive your IP address and technical information about the website and your browser, even if you do not connect a wallet. If you connect through WalletConnect, the connection passes through its relay network. If you choose Coinbase Wallet, Coinbase's wallet software is loaded and Coinbase receives comparable information. Their own privacy terms apply. Bad Vault does not use these services.
• Bridge and swap services — LI.FI when you use the bridge, KyberSwap to route certain swaps on EVM networks, and Jupiter for swaps on Solana. They receive the wallet addresses, tokens and amounts needed to quote and build the transaction and, for the bridge, the transaction hash so that its progress can be reported. These requests are normally made by our server, so the provider does not see your IP address; if our bridge service is unavailable, your browser may contact LI.FI directly, and LI.FI then sees your IP address.
• Authentication providers — Google, Apple and X, limited to what is needed to authenticate you. On the website, Google's sign-in script is loaded with the page, so Google receives your IP address and browser information even if you do not sign in with Google.
• Legal authorities — where required by law or in response to valid legal process. Where we are permitted to notify you, we will.
• Professional advisers — lawyers, auditors and insurers, bound by confidentiality.
• Corporate transactions — in connection with a merger, acquisition, financing, reorganisation, sale of assets or insolvency, personal data may be transferred as part of the business. Any acquirer remains bound by this Notice for data collected under it, and we will notify you before your data becomes subject to a materially different privacy notice.

We never share wallet-to-identity mappings, key material of any kind (we hold none in readable form, and your encrypted Bad Vault is shared with no one), your data for marketing or advertising purposes, or your data with data brokers.

Bad Place settles activity on public blockchains, currently including BNB Chain, Base, Robinhood Chain, Arc, Ethereum and Solana. This has consequences for your privacy that no policy can undo, and you should understand them before you transact.

• Every transaction — the addresses involved, amounts, timing and the contract called — is written to a public ledger that anyone in the world can read, index and archive.
• These networks are decentralised and not operated by us. We cannot erase, edit, redact or alter anything recorded on them. Neither can anyone else.
• If you publicly link a wallet address to your Bad Place profile, you are connecting your on-chain history to that profile for anyone who looks. That link is your choice; consider it carefully. Your Bad Vault address is linked to your account when you set it up (section 4).
• Third parties operate chain-analysis services that attempt to cluster addresses and attribute them to people. We do not participate in this and we do not sell them data, but we cannot prevent them from analysing public ledger data.

A request to erase your personal data reaches our off-chain systems only. On-chain records are outside the control of any party, including us.

If you send us a copyright takedown notice or a counter-notice, that document is handled differently from ordinary support mail.

• A valid notice must contain your name, address, telephone number and email address — the law requires it.
• We forward the notice, including that identifying information, to the user whose content is affected. This is required and we cannot anonymise it.
• Counter-notices are forwarded the same way to the party who filed the original notice.
• We retain notices, counter-notices and the resulting actions for as long as legally required, including for our repeat-infringer records.

If you do not want your contact details passed to the other party, do not file a notice — there is no confidential route through this process. The full procedure is set out in our Copyright & DMCA Policy.

Bad Place is operated globally and your personal data is processed in more than one country. Our primary application servers and databases are located in the European Union (Germany). Our content delivery, object storage and DDoS protection are provided by a global network with points of presence worldwide. Several of our processors — including the AI providers named in section 6, the authentication providers named in section 5 and our website analytics provider (section 14) — are established in the United States, and some of the wallet connection, bridge, swap and transaction relay services and the X data service named in section 10 may be established or process data outside the EEA.

This means your personal data may be transferred to, stored in and processed in countries whose data protection laws differ from those of your own country, including countries that have not received an adequacy decision from the European Commission or the UK government.

Where we transfer personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures including encryption in transit and data minimisation. You may request a copy of the relevant transfer mechanism by writing to [email protected].

We disclose personal data to authorities outside the EEA, the UK or Switzerland in response to legal process only where the law permits it, relying where applicable on the derogations in Art. 49 GDPR (for example the establishment, exercise or defence of legal claims).

Blockchain data is a separate matter entirely: it is replicated to nodes worldwide with no controller and no transfer mechanism. See section 11.

We keep this deliberately small. Bad Place runs no advertising cookies, no cross-site tracking pixels, and no third-party marketing or advertising SDKs. On the website we use one third-party product analytics service, PostHog, set up to work without cookies and described in full below. We do not combine anything stored on your device, or any analytics data, with third-party data for advertising or advertising measurement.

What we do use:

• Strictly necessary — keeping you signed in, authenticating your requests, load balancing, and security and anti-abuse protections. These cannot be switched off without breaking the service, and no consent is required for them.
• Functional — remembering your interface preferences, such as your chosen language, theme and selected chain.
• Local storage on your device — your session token; on the website, your wallet connection, which wallet you last selected on that device and, if you use Bad Vault, your BNB Chain sending mode and a short list of your recent Bad Vault transactions (their hashes and, until they are final, the signed transactions) so that their status can be followed after a reload; and, in the mobile app, wallet material that stays on your device and is never transmitted to us. Bad Vault stores no key material in your browser's storage: the unlocked wallet exists only in memory — in the Bad Vault frame, until Bad Vault locks, and in a Bad Vault window only while that window is open. On wallet.badplace.io, Bad Vault keeps only a counter that lets it notice an outdated copy of its settings, a list of the Bad Vaults already opened on that device and, if you decline several requests in a row, how many you declined and when it may ask you again. Your passkeys are stored by your device or passkey provider, not by us.
• Aggregate product measurement — derived from our own server logs and, on the website, from the analytics described below.

Website analytics (PostHog). To understand which parts of the website people use and where they get stuck, the Bad Place website at badplace.io uses PostHog, a product analytics service provided by PostHog Inc. We use PostHog's EU Cloud, so the analytics data is stored in the European Union; PostHog Inc. is established in the United States, and any access to the data from outside the EEA is covered by the safeguards in section 13. The Bad Place mobile apps do not use PostHog at this time, and PostHog does not run inside Bad Vault or anywhere on wallet.badplace.io. Unless you switch it off, PostHog receives:

• The pages you visit — the address of each page, with query parameters removed except campaign tags (such as utm_source) and non-personal view settings (such as the selected tab or chain), and with the wallet address or username in profile, wallet and sharing links, and the code in invite links, replaced by a placeholder. Other parts of a page address are sent as they appear; for example, a token page includes that token's public contract address. When you leave a page, how far down you scrolled.
• A fixed list of product events — for example signing up or signing in, connecting a wallet or finishing Bad Vault setup (only the kind of wallet and the setup method, never an address), the steps of creating a token, a trade being submitted, completing or failing, publishing a post, cheers, following, sharing, buying Beer, and switching analytics back on. A trade amount is sent only as a broad range, never the exact amount, and a failure only as a general category, never the error message.
• Browser and device information — browser and operating system type and version, device type, screen size, language and time zone.
• The referring site — the site that sent you to us, with query parameters removed.
• Your account, if you are signed in — events are linked to our internal account identifier only. We do not attach your email address, username, display name or wallet addresses to your analytics identity.

What it does not receive. Analytics runs in cookieless mode: it sets no cookies and stores no identifier in your browser's local storage. There is no session recording or screen recording, no automatic capture of clicks, and no capture of keystrokes or anything you type into a form. Other than through the page address described above, analytics data never contains token or contract addresses, and it never contains wallet addresses, transaction hashes, exact amounts, the text of your posts or what you type into search.

Your IP address. Your browser connects to PostHog directly, so PostHog sees your IP address. It is used only to count visitors without a cookie: together with browser information and a random value that PostHog replaces every day, it is turned into a one-way code, and the IP address is then removed before the event is stored. Once that day's random value is deleted, the code can no longer be linked back to your IP address, and an anonymous visitor is not recognised from one day to the next. PostHog does not store your IP address with analytics events and does not work out your location from it.

Legal basis and your right to object. We rely on our legitimate interests in understanding and improving the service (Art. 6(1)(f) GDPR). You can object at any time, without giving a reason, by switching analytics off in Settings. Your choice is saved on that device; from then on no further analytics data is collected, and on later visits PostHog is not loaded at all. Because the choice is stored on the device, make it in each browser you use. If your browser sends a Do Not Track signal, PostHog is not loaded in the first place. How long analytics data is kept is set out in section 16.

How to control this. You can block or delete cookies and clear site storage through your browser settings; general guidance is available at allaboutcookies.org. If you block strictly necessary storage, you will not be able to sign in or transact. We honour Global Privacy Control signals where your browser sends them; because we do not sell or share personal data for advertising, there is nothing further for such a signal to switch off.

We apply administrative, technical and physical safeguards proportionate to the risk, including:

• TLS encryption for all traffic between you and our servers
• No readable key material held — no private keys, seed phrases or key shares in readable form; a Bad Vault copy is encrypted in your browser with keys derived from your passkey or your recovery phrase, which we never receive
• Bad Vault runs on its own origin, wallet.badplace.io, separate from the rest of the website; requests it does not sign automatically are shown to you for confirmation in a separate wallet.badplace.io window; and changes to a Bad Vault — adding or removing passkeys, re-encrypting it, changing its settings or deleting it — must be signed with the Bad Vault's own key and approved with one of its passkeys (or, when you add a passkey with your recovery phrase, signed a second time with a key derived from that phrase), which our servers verify
• Two-factor authentication secrets stored encrypted with a server key
• Signature verification performed server-side; client-supplied amounts and eligibility claims are never trusted
• Rate limiting and abuse controls on authentication and write paths
• Access controls, least privilege and monitoring on production systems
• Automated safety checks on uploaded content
• Data minimisation and bounded retention

No system is perfectly secure. We cannot guarantee the security of data transmitted over the internet, and any transmission is at your own risk. Enable two-factor authentication, use an email address you control, and keep your seed phrase somewhere only you can reach. If you use Bad Vault, also keep your device PIN or password to yourself — a passkey check usually accepts it — and remove passkeys from devices you no longer control. The Bad Vault code that decrypts your wallet is delivered by us each time you use it; the Bad Vault section of our Terms of Service explains what that means and what we do if it is ever compromised.

If a breach occurs. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Article 33 GDPR, and we will notify you directly without undue delay where the risk to you is high. If an incident puts Bad Vault users' assets at risk, we may also suspend Bad Vault and will tell you how to move your assets with your recovery phrase. If you believe you have found a vulnerability, report it to [email protected] rather than disclosing it publicly.

We keep personal data only as long as we need it for the purpose we collected it for, plus any period we are legally required to retain it.

• Account data — until you delete your account, then removed or irreversibly anonymised within 90 days, except where an item below requires longer or a competent authority has asked us to preserve the account while it obtains a legal order, in which case we keep it until the request ends.
• Content you publish — until you delete it or delete your account.
• Server and security logs — 30 days.
• Sign-in history (IP address, time, sign-in method and user-agent) — 12 months from each sign-in, then deleted automatically. Where a competent authority asks us to preserve specific records while it obtains a legal order, we keep the records that still exist when we receive the request until the request ends.
• Bad Vault encrypted wallet and passkey records — while your Bad Vault is active. If you delete your Bad Vault, or replace it after a reset, it is archived: we keep its encrypted wallet and passkey records for 12 months, so that its passkeys can still open it to move assets, and then delete them automatically. When your account is permanently deleted, your active and archived Bad Vaults are deleted with it. When you remove a passkey, it stops working immediately: its encrypted copy of the unlocking key and its salt are deleted at once, and the rest of its record (identifier, public key, name and dates) is kept with the Bad Vault until the Bad Vault is deleted. Copies in database backups, if any, expire in the ordinary course.
• Bad Vault security log (action, time, IP address and user-agent) — 12 months from each entry, then deleted automatically, including after your account is deleted. Where a competent authority asks us to preserve specific records while it obtains a legal order, we keep the records that still exist when we receive the request until the request ends.
• Deleted-account record — after the 30-day restore period, when the account is permanently deleted, we keep a limited record of it for 12 months: its identifiers (email addresses, username, linked X account, wallet addresses, sign-in provider identifiers, referral codes, and the IP address and device identifier recorded when the account accepted our terms), stored encrypted together with keyed hashes that let us find the record for a specific identifier; the sign-in method, the deletion reason selected and whether the account was banned; and the dates the account was created, last signed in, last changed its username and was deleted. We use it only to respond to valid legal process, to investigate fraud and abuse and to enforce bans. It is then deleted automatically. Records covered by a preservation request from a competent authority are kept until the request ends.
• Creator Program records — your application (including one that was rejected or ended) and the record of your creator earnings are kept until your account is permanently deleted, so that we can settle earnings, answer questions about past payouts and handle new applications. Payouts already made remain on the blockchain (section 11). If you joined through a creator's referral link and delete your account, the creator's earnings records that relate to you are kept for as long as the creator's own records are, so that the creator's earnings stay correct. They contain our internal account number for you (not your username, email or wallet addresses), and for each network and each day on which you traded on Bad Place, the number of trades, the platform fees on them and what the creator earned from those fees.
• Aggregate usage measurements — 12 months, after which they are retained only in a form that cannot be linked to you.
• Website analytics events (PostHog) — no longer than we need them to understand and improve how the website is used, and in any case no longer than the data retention period of the PostHog plan we use. You can object at any time (section 14).
• Reference photographs sent to AI providers — not retained as source images.
• Consent and preference records, including your acceptance of the Bad Vault terms (the text you accepted, its language and the Bad Vault it applies to), your acceptance of this Notice when you applied to the Creator Program (the text you accepted, its version and language, and whether you applied on the website or in the app), and the IP address, user-agent and device identifier recorded when you accepted — for as long as legally required, in order to prove what you consented to and when.
• Copyright notices and counter-notices — for as long as legally required, including for repeat-infringer records.
• Enforcement records — where an account was terminated for a zero-tolerance violation, the identifiers needed to prevent re-registration are retained indefinitely. Retaining them is the entire point of the ban.
• Records needed to defend legal claims — until the relevant limitation period expires.
• On-chain transaction history — permanent and outside our control.

Wherever you live, you can ask us to:

• Access — tell you what personal data we hold about you and provide a copy.
• Rectify — correct data that is inaccurate or incomplete.
• Erase — delete your off-chain personal data and your account.
• Port — export the data you gave us in a structured, machine-readable format.
• Restrict or object — pause or stop processing that relies on our legitimate interests.
• Withdraw consent — for anything you consented to, at any time.

How to exercise them. Write to [email protected] from the email address on your account and describe what you want. We may ask for information to verify your identity — we use it only to confirm who you are and delete it afterwards. We respond within 30 days and will tell you if we need a permitted extension. Exercising these rights is free unless a request is manifestly unfounded or excessive.

Limits we will be honest about. On-chain data cannot be deleted by anyone (section 11). We may decline erasure where we are legally required to retain something, where it is needed to establish or defend a legal claim, or where deletion would let a terminated account evade a zero-tolerance ban. Deleting your account also leaves the limited deleted-account record described in section 16, which we keep for 12 months only to respond to valid legal process, investigate fraud and abuse and enforce bans. Where we decline, we will tell you why.

If you are in the European Economic Area, the United Kingdom or Switzerland, the rights in section 17 are statutory rights under the GDPR, the UK GDPR and the Swiss FADP respectively, and you additionally have:

• The right not to be subject to a decision based solely on automated processing which produces legal effects concerning you, and to obtain human intervention, express your point of view and contest the decision — see section 7.
• The right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.
• The right to receive information about the safeguards applied to international transfers — see section 13.

The right to complain. If you believe we have not handled your personal data lawfully, we would rather you told us first at [email protected] — we investigate every complaint and tell you the outcome. But you do not have to come to us first. You may lodge a complaint directly with the data protection supervisory authority in the country where you live, where you work, or where you believe the infringement occurred. In the UK this is the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner. A list of EEA authorities is published by the European Data Protection Board at edpb.europa.eu.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you specific rights.

Categories we collect. In the past twelve months we have collected: identifiers (email address, account identifier, wallet address, IP address, device identifiers); commercial information (your transaction and position history); internet and network activity (your interactions with the platform, including website usage analytics); approximate geolocation (country); security information (if you use Bad Vault, the encrypted wallet, passkey records and security log described in section 4); audio, electronic or visual information (images you upload or generate); and inferences drawn from your activity for the purpose of ranking your feed. The sources, purposes and recipients for each are described in sections 2 to 11 and section 14.

We do not sell or share your personal information as those terms are defined by the CCPA. We have not sold or shared personal information in the past twelve months, and we do not sell or share the personal information of minors under 16. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit.

Your rights. You may request to know the categories and specific pieces of personal information we have collected, the sources, our purposes and the categories of recipients; request deletion; request correction; and opt out of sale or sharing (there is nothing to opt out of, but the right stands). You may use an authorised agent, who must provide written proof of authorisation.

No discrimination. We will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right. To make a request, write to [email protected]. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days where necessary.

Other data protection laws give you comparable rights, and we apply the same process described in section 17 to requests made under them.

• Türkiye (KVKK) — you have the rights set out in Article 11 of Law No. 6698, including learning whether your data is processed, requesting correction or deletion, and objecting to results produced solely by automated analysis. You may apply to us directly and, if unsatisfied, complain to the Personal Data Protection Board (KVKK).
• Brazil (LGPD) — confirmation of processing, access, correction, anonymisation or deletion, portability, information about data sharing, and the right to complain to the ANPD.
• Canada (PIPEDA) — access to and correction of your personal information, and the right to complain to the Office of the Privacy Commissioner of Canada.
• Other US states — where a state privacy law applies to you (including Virginia, Colorado, Connecticut, Utah and Texas), you have rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling, together with a right to appeal a refused request. We do not conduct targeted advertising, sale or profiling that produces legal effects.

If a right is available to you under a law not listed here, we will honour it. Write to [email protected] and tell us which law you are relying on.

Bad Place is not directed to children. You must be at least 18 years old, or the age of legal majority in your jurisdiction if that is higher, to create an account or use the platform. We do not knowingly collect personal data from anyone under 18.

If we learn that we hold personal data collected from a person under 18, we delete it and terminate the account, keeping only the limited deleted-account record described in section 16. If you are a parent or guardian and believe a child in your care has given us personal data, write to [email protected] and we will act promptly.

Sexualised depictions of minors are handled under a separate and absolute rule set out in our Acceptable Use Policy and section 7 above. That is not a privacy matter and it is not negotiable.

Bad Place links to and interoperates with services we do not control: external wallets, blockchain explorers, decentralised exchanges and aggregators, bridges, social platforms, and any website another user chooses to link to in a post or a token description.

We do not control these services and we are not responsible for their content, their security, or how they handle your data. Opening them takes you outside this Notice and into their own terms and privacy policies, which you should read. Displaying a link, a price feed or a token is not an endorsement of the operator behind it.

Take particular care with anything that asks you to sign a transaction or reveal a seed phrase. We will never ask you to send us your recovery phrase — not by email, chat, support ticket or form. The only places Bad Place asks you to type it are the wallet import screen in the Bad Place app and a Bad Vault window whose address bar shows wallet.badplace.io; a badplace.io page never asks for it. No legitimate service will ask you for it anywhere else.

We revise this Notice as the platform evolves, as we add or remove processors, and as legal requirements change. The current version is always published at this URL with the revision date shown at the top of the page.

Where a change is material — a new category of data, a new purpose, a new class of recipient, or a reduction in your rights — we will announce it in-app and by email before it takes effect, and where the law requires your consent we will ask for it rather than assume it. Non-material changes, such as clarifying wording or naming a replacement infrastructure provider, take effect on publication. A change that would let us read or use your Bad Vault, or that adds to what Bad Vault stores about you on our servers, is always a material change.

Continued use of Bad Place after a change takes effect constitutes acceptance of the updated Notice. If you do not accept it, stop using the platform and ask us to delete your account.

For any question about this Notice, to exercise your rights, or to complain about how we have handled your data:

• Privacy and data rights — [email protected]
• Abuse, safety, copyright and security reports — [email protected]

If a message to an address above bounces, or goes unanswered for more than 72 hours, use our secondary channel, which runs on separate infrastructure: [email protected] for abuse, safety, copyright and security, and [email protected] for legal and data-protection matters. Please keep the original subject line.

By post: Cheese Art Labs L.L.C., Ukshin Hoti 51, Prishtinë, Republic of Kosovo.

We acknowledge privacy requests promptly and respond substantively within 30 days, or within the shorter period required by the law that applies to you. Complaints are investigated within a reasonable period proportionate to their complexity, and we tell you the outcome. You may also complain directly to your supervisory authority — section 18.