01Who we are
Identity Prism ("we", "us", "the Service") is a wallet reputation and sybil-defense service for the Solana blockchain. We operate at identityprism.xyz and via our Android client.
This policy describes how the Service handles information when you connect a wallet, scan an address, play games, or use supported Solana transactions and assets.
02What we collect
We are a non-custodial protocol. We never receive, see, or store your private keys, seed phrase, or signing material. The data we do process falls into four narrow buckets:
| Category | Examples | Source |
|---|---|---|
| Wallet identifier | Your public Solana address | You, by connecting |
| On-chain signals | Tx count, age, balances, NFT holdings, DeFi positions | Solana RPC / Helius |
| Gameplay data | Scores, durations, input cadence, achievement progress | Your sessions in our games |
| Abuse and session security | Client IP and its in-memory association with a wallet address | Service requests and wallet sessions |
| Diagnostics and analytics | Error events, product events, page-load timings, device or browser type | Your client and configured providers |
We do not collect your name, email address, phone number, IP-derived precise location, government ID, biometrics, or any document of any kind. We do not run KYC. We never ask.
03How we use what we collect
- To compute your composite score. Your public on-chain activity is fed through our scoring algorithm to produce a tier (Mercury → Binary Sun) and badges.
- To detect sybil behavior. Cluster patterns, transfer graphs, and gameplay cadence are analyzed to flag coordinated wallet farms.
- To derive bounded gameplay signals. Scores and input telemetry are validated server-side and contribute to the profile; they do not prove personhood or automatically create an on-chain record.
- To run leaderboards and economy features. Coin balances, staking positions, NFT mints — all powered by your wallet identifier.
- To improve the Service. Aggregate, de-identified metrics tell us which features are useful.
We never use your data to advertise to you, profile you for third parties, or train external AI models.
04On-chain data
When you mint an Identity Prism card or separately sign a supported Memo attestation, the submitted information becomes public on Solana. Ordinary scans, games, tier changes, and badges are server/application records unless you explicitly include them in one of those transactions. Submitted data may include:
- Your composite score and tier at mint time
- Earned badges
- User-reviewed Memo-program attestations
- Metaplex Core asset data and a metadata URI, which supported update flows may later change
Blockchains are immutable. Once published, on-chain records cannot be deleted by us, by you, or by anyone else. Mint with intent.
05Cookies & local storage
The client uses browser or device storage for authentication state, wallet/session state, preferences, and caches. Configured Firebase Analytics and Sentry integrations may process product or diagnostic events; we do not use advertising cookies. See our Cookie Policy for details and browser controls.
06Third-party services
We rely on a small number of infrastructure providers. Each receives only the minimum data needed for its function:
| Provider | Purpose | Data shared |
|---|---|---|
| Helius RPC | Solana indexing | Public wallet address |
| MagicBlock | Optional devnet RPC/blockhash input; games do not run on an Ephemeral Rollup | Public RPC requests when that route is used |
| Firebase Analytics | Configured product analytics | Product events and client metadata |
| Sentry | Configured error monitoring | Error and diagnostic context |
| Cloudflare | CDN, DDoS protection | Standard request metadata |
| Solana RPC nodes | Blockchain reads | Public address queries |
We do not sell, rent, or barter user data. Period.
07Data retention
The wallet-address-to-client-IP association used for abuse and session security is held in memory and evicted after approximately 24 hours. Server logs may contain operational request metadata and may be retained under the applicable logging, security, and legal policy; the implementation does not promise a fixed on-disk retention period. Other eligible off-chain records may be retained according to operational, security, and legal needs, and you may request their deletion. Data submitted to Solana follows the network's public and effectively permanent retention model.
08Your rights
Depending on your jurisdiction (GDPR, CCPA, UK DPA), you have the right to:
- Access the off-chain data we hold associated with your wallet
- Correct inaccurate off-chain records
- Delete off-chain records (on-chain data cannot be deleted by anyone)
- Export your data in machine-readable format (JSON)
- Withdraw consent by disconnecting your wallet
Email [email protected] from a wallet-signed message and we'll respond within 30 days.
09Children
The Service is not directed at and not intended for users under 13 (or under 16 in EEA jurisdictions). We do not knowingly collect data from children. If you believe a minor has connected a wallet, contact us and we'll purge the off-chain record.
10International transfers
Our infrastructure is globally distributed via Cloudflare's edge network. Off-chain data may be processed in any country where Cloudflare or our service providers maintain data centers. By using the Service, you consent to this processing.
11Security
We use transport security supplied by our hosting stack, access controls, server-side validation, and dependency checks. These measures reduce risk but do not make the Service impenetrable. Report suspected vulnerabilities through the private process described in our repository security policy.
12Changes & contact
We may revise this policy and will update the date and version on this page. Continued use after an effective update constitutes acceptance where permitted by law.
Questions, requests, or concerns:
- Email: [email protected]
- Twitter: @Identity_Prism