MoTZ Privacy Policy
Version 1.1 · Effective August 3, 2026
This Privacy Policy explains how Kyroh LLC, a New Jersey (USA) limited liability company ("MoTZ", "we", "us", or "our"), collects, uses, shares, and protects personal data when you use the MoTZ web application (at https://app.markofthezeal.com) and the MoTZ Discord bot (together, the "Service"). MoTZ is a community companion application for the Moki ecosystem on the Ronin blockchain.
This Policy is written to satisfy Article 13 of the EU and UK General Data Protection Regulation ("GDPR") and includes a courtesy section for California residents. It forms part of, and should be read together with, our Terms of Service.
1. Who We Are (Data Controller)
The data controller responsible for your personal data is:
Kyroh LLC, a limited liability company organized under the laws of New Jersey, USA. Contact for all privacy and data-protection matters, including GDPR and UK GDPR data-subject requests: kyroh@markofthezeal.com.
We have not appointed a Data Protection Officer (DPO), as we are not required to under applicable law. Please direct all privacy inquiries to the email above.
2. Data We Collect
We aim to collect only what the Service needs to function, keep it secure, and meet our legal obligations. The table below lists the categories of personal data we process.
| # | Data category | What it is | Source |
|---|---|---|---|
| 1 | Wallet address | Your public blockchain wallet address, used as your primary identifier. Under EDPB guidance on blockchain, we treat this as personal data. | You, at sign-in |
| 2 | Synthetic login identifier | An internal, system-generated identifier we assign to your account. | Generated by us |
| 3 | Display name (optional) | A name you choose to show in the community. | You |
| 4 | Discord ID and username (if linked) | Your Discord account identifier and username, collected only if you link Discord. | Discord OAuth |
| 5 | IP address and user agent | Your network IP address and browser/client details, logged for security and as legal records. | Automatically, on access |
| 6 | Acceptance records | Records that you accepted our Terms and Privacy Policy: the document version, a content hash, a timestamp, your signature, and the sign-in nonce. | Generated at sign-in |
| 7 | Asset and valuation data | Holdings and estimated valuations derived from public blockchains for your wallet address. | Public blockchains and data providers |
| 8 | Tipping-ledger entries | Off-chain records of tips you send or receive and your ledger balances. | Generated by the Service |
| 9 | Notification preferences | Your settings for notifications and communications. | You |
We do not intentionally collect special categories of personal data (such as health, biometric, or racial or ethnic data), and you should not submit them through the Service.
3. How and Why We Use Your Data (Purposes and Legal Bases)
Under the GDPR, we must have a lawful basis for each use of personal data. The table below maps our purposes to their legal bases.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and operate your account; authenticate you at sign-in | Wallet address, synthetic identifier, display name | Contract performance (Art. 6(1)(b)) |
| Provide features: asset tracking/valuations, tipping ledger, staking, games, wiki/tools | Wallet address, asset/valuation data, ledger entries, notification preferences | Contract performance (Art. 6(1)(b)) |
| Link your Discord account and resolve bot commands to your account | Discord ID/username, wallet address | Contract performance (Art. 6(1)(b)) |
| Secure the Service; detect, prevent, and investigate fraud, abuse, and exploits; maintain service integrity | IP address, user agent, ledger entries, wallet address | Legitimate interests (Art. 6(1)(f)) |
| Keep proof that you agreed to our Terms and Privacy Policy | Acceptance records | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where applicable |
| Send you notifications you have configured | Notification preferences, Discord ID | Contract performance and, where separately requested, consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing as described in Section 9. Where we rely on consent, you may withdraw it at any time without affecting prior processing; we only rely on consent where we separately ask for it.
4. Public Blockchain Data
Some data we display and process originates from public, permissionless blockchains such as Ronin. You should understand:
- On-chain data is public and immutable. Wallet addresses, transactions, and token holdings recorded on a blockchain are publicly visible and, by design, cannot be changed, deleted, or erased by us or by anyone.
- We do not control the blockchain. We read on-chain data; we do not write your personal data to any blockchain as part of sign-in, and we cannot alter or remove anything already recorded on-chain.
- Erasure applies to our records only. When you exercise a right to erasure or correction, it applies to the off-chain records we hold in our own systems and does not, and cannot, affect data on public blockchains.
5. Who We Share Data With (Processors and Recipients)
We do not sell or share your personal data for money or for cross-context behavioral advertising, we do not run advertising, and we do not use third-party analytics or tracking. We share data only with service providers ("processors") who process it on our behalf under contract, and only as needed to run the Service.
| Recipient | Role | What they process |
|---|---|---|
| Supabase | Database and authentication hosting | Account data, ledger entries, acceptance records, preferences |
| Vercel | Web application hosting | Request data, IP address, user agent |
| Upstash | Caching (Redis) | Transient session and nonce data, cached values |
| Discord | Account linking and bot delivery | Discord ID/username, messages the bot sends or receives |
| Sky Mavis / Ronin | Wallet and blockchain network services | Wallet interactions and public on-chain data |
We may also disclose personal data if required by law, legal process, or a lawful government request, or to protect the rights, safety, and property of MoTZ, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.
6. International Data Transfers
We are based in the United States, and our processing and that of our processors takes place primarily in the United States.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for such transfers, including the Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK Addendum, as applicable), and the EU-US Data Privacy Framework where a recipient is certified. You may request more information about these safeguards using the contact details in Section 12.
7. Data Retention
We keep personal data only as long as necessary for the purposes described in this Policy:
- Account data is retained while your account is active and for as long as needed to provide the Service and to meet legal obligations.
- Acceptance records are retained for the duration needed to establish and defend our legal rights (proof of agreement).
- Security logs (IP address, user agent) are retained for a limited period appropriate to security and legal-record needs.
- Deletion on request is honored subject to legal holds and to our need to retain certain records for legal, security, or fraud-prevention purposes. Public blockchain data cannot be deleted (see Section 4).
When personal data is no longer needed, we delete or anonymize it.
8. Cookies
The Service uses strictly necessary cookies only. Specifically:
- Session authentication cookies: httpOnly cookies that keep you signed in.
- SIWE nonce cookie: a short-lived, single-use cookie used to secure the Sign-In-With-Ethereum flow.
We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Because we only use strictly necessary cookies, no consent banner is required, and none is shown. These cookies are essential to the Service; disabling them will prevent sign-in from working.
9. Your Data-Protection Rights
Subject to applicable law and to legal exemptions, you have the following rights regarding your personal data:
- Access: obtain confirmation of whether we process your data and a copy of it.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your off-chain data ("right to be forgotten"), subject to legal holds and to the blockchain limitation in Section 4.
- Portability: receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
- Restriction: request that we limit processing in certain circumstances.
- Objection: object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdraw consent: where we rely on consent, withdraw it at any time.
How to exercise your rights. Email kyroh@markofthezeal.com. We may need to verify that you control the wallet address associated with the account before acting on a request. We will respond within the time required by applicable law (generally one month under the GDPR).
Right to complain. If you are in the EEA or UK, you have the right to lodge a complaint with your local data-protection supervisory authority. We would appreciate the chance to address your concerns first.
10. Your California Privacy Rights
This section is provided as a courtesy to California residents. We extend the following rights and commitments regardless of whether we meet any CCPA/CPRA applicability threshold:
- We do not sell or share your personal information for money or for cross-context behavioral advertising, and we do not use it for targeted advertising.
- You may request to know what personal information we hold about you, to access a copy of it, to correct inaccurate information, and to delete it, subject to the same limitations described in this Policy (including the blockchain limitation in Section 4 and applicable legal holds).
- We will not discriminate against you for exercising these rights.
To exercise any of these rights, contact kyroh@markofthezeal.com. We may verify your control of the relevant wallet address before responding.
11. Children
The Service is intended only for adults 18 years of age or older. We do not knowingly collect or process personal data from anyone under 18. If we learn that we have collected personal data from a minor, we will delete it. If you believe a minor has provided us personal data, contact us at kyroh@markofthezeal.com.
12. Security
We take reasonable and appropriate technical and organizational measures to protect personal data, including:
- Row-Level Security (RLS) on our database tables, so records are accessible only to authorized parties.
- Least-privilege access controls for systems and staff.
- Encrypted transport (HTTPS/TLS) for data in transit.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your wallet, keys, and devices (see our Terms of Service).
13. Changes to This Policy
We may update this Policy from time to time. When we do, we will publish the new version, update its version number and effective date, and maintain a version archive at /legal.
- Material changes will be notified to you and, where acceptance is required, re-presented for your acknowledgment (for example, through the versioned sign-in message described in our Terms).
- Non-material changes take effect when published.
The version in effect when you accept governs your relationship with us until you accept a later version.
14. Contact
For any privacy question, to exercise your rights, or for any data-protection matter, contact:
Kyroh LLC Email: kyroh@markofthezeal.com