Privacy policy
Last updated: 6 November 2026. The English text is the reference version. Nederlands: vragen in het Nederlands zijn welkom. Français : questions en français bienvenues.
1. Who is responsible
The controller of your personal data (the one who decides why and how it is used) is:
The GEOPOLCOINS / $MAIGA project team
Email: [contact email]
Website: geopolcoins.xyz
The project is run by a small team currently based in Morocco, so Moroccan Law 09-08 on the protection of personal data applies to our processing; the Moroccan supervisory authority is the CNDP (cndp.ma). Our visitors are mainly in the United States and other countries worldwide. Because the site is also used by people in the EU and the UK, we also follow the EU and UK GDPR. We have not appointed an EU representative, because our processing is occasional, small-scale and unlikely to put your rights at risk (Art. 27(2) GDPR); this may change if the project grows. We have no data protection officer because we do not process data on a large scale. For any privacy question or request, email us at the address above.
2. What we collect and why
| Feature | Data | Why | Legal basis (GDPR) |
|---|---|---|---|
| Visit counter (all main pages, and the Token Checkup widget on other websites) | Page name, day, and the website you came from (only the domain, for example x.com). No cookies, no IP address, no device or user ID. The totals are emailed to the site owner once a week. | See which tools are used. | Not personal data. Where any law treats it as such: legitimate interest (Art. 6(1)(f)). |
| Games and tournament | Pilot name or player name you choose (in MAIGA Raid: a name in the style of an X @name, not checked by us), scores, play time, hero, game type, date, and in MAIGA Raid the language team you pick (optional); optionally the wallet address you enter for prizes (old tournament only, never in MAIGA Raid). | Leaderboards, tournament results and prize payouts. | Taking part in the game (contract, Art. 6(1)(b)). |
| MAIGA Raid: log in with X (optional, only when switched on) | From your X account via Supabase Auth: X user ID, username, display name and profile picture link (and your email only if X shares it). Linked to the scores you save. We never post on X for you and get no access to your posts or messages. | Show your real X name on the leaderboard so nobody can fake it. | Your choice to log in (contract, Art. 6(1)(b)). Ask us to delete your account and scores at any time. |
| Human Override Pro request (only if you send the form) | Your email, whether you are a school, company, parent or other, the number of devices, your optional message, the consent text you agreed to, and your IP address (only against spam). Used only to contact you about Human Override Pro, never for a newsletter. Deleted on request, and at the latest 12 months after our last contact. | Answer your request. | Your consent (Art. 6(1)(a)) and steps at your request before a contract (Art. 6(1)(b)). |
| Human Override for Android, Windows, Mac and Linux (only if you install them) | Nothing. The Android app filters address lookups on the phone itself: AI addresses get "does not exist", all other lookups go to your phone's normal DNS server, never to us. Settings, PIN (salted hash only) and the counter stay on the device. The optional sensor check (only when you tap it, after you allow "nearby devices") reads the list of nearby Wi-Fi radios on the phone and shows it to you; it is not stored or sent. The optional camera and microphone guard only shows a notification on the phone when the camera or microphone starts being used; it does not record anything and sends nothing. The Windows, Mac and Linux scripts only change your own hosts file, and on Windows (only if you choose it) switch off built-in AI with official policy settings. All of them download the public block list from geopolcoins.xyz (no personal data, only what every website request carries). | Block AI on your device. | Not applicable: we receive no personal data. |
| Human Override (browser extension, only if you install it) | Nothing. Your settings, schedule, PIN (stored only as a salted hash) and block counter stay in your own browser. Once a day the extension downloads the public block list from geopolcoins.xyz; that request carries no personal data, only what every website request carries (your IP address, which our host GitHub Pages may log as described above). | Block AI sites on your device. | Not applicable: we receive no personal data. |
| Ask The Brain (only if you tap the button in Bolt) | Your question, the language and the page you asked from, a random ID made in your browser, and your IP address (only for anti-spam limits). It is answered by the AI model on our own server (Oracle Cloud, Morocco); no outside AI service sees it. Only your browser can read the answer. Question and answer are deleted after 1 day. | Answer your question. | Your request (contract, Art. 6(1)(b)). |
| Live chat (only if you send a message) | The nickname and message you type, the room (homepage or Pixel World), a random chat ID made in your browser, and your IP address (only for anti-spam limits). Every message is checked by our own server (Oracle Cloud, Morocco) before it is published: links, wallet addresses, phone numbers and handles are removed, and scam phrases, swearing and abuse are blocked, partly by a small AI model running on that server (no outside AI service). Published messages are visible to everyone and deleted after 2 days; the review copy with your IP address is deleted after 1 day; reports after 2 days. | Run a safe public chat, stop scams and spam. | Your request (contract, Art. 6(1)(b)) and legitimate interest in safety (Art. 6(1)(f)). |
| Pixel World (live, while the page is open) | Your chosen avatar, a nickname picked from two word lists (no free text), your position on the map and short emotes. Sent live through Supabase Realtime to the other visitors on the page. Not stored in a database: it disappears when you leave. | Show you to the other visitors in the world. | Your request (contract, Art. 6(1)(b)). |
| Wallet verification (optional) | Pilot name and the wallet address that signed a free message. The signature is checked; it is not a transaction. | Reserve your pilot name and prevent impersonation. | Your request (contract, Art. 6(1)(b)). |
| Prize wheel and payouts | Pilot name, wallet address, prize amount, status and transaction ID. | Pay prizes and keep a record of what was paid. Payout records (receiving wallet, amount, transaction ID) are public on our site as proof of payment, just as they are on the blockchain. | Contract (Art. 6(1)(b)); keeping records (Art. 6(1)(c)/(f)). |
| Team board | Nickname, your role, the role you look for, a short pitch. Contact details and wallets are blocked. | Public board to find team members. | Your choice to post (consent, Art. 6(1)(a)); you can ask us to remove it. |
| Factory Hub and Bot Garage community | Nickname plus what you share: coin name, ticker, meme text, description, or a bot recipe; likes and copies. | Show community creations. | Your choice to share (consent, Art. 6(1)(a)). |
| Battle of the day | Vote counts only. We do not store who voted. | Show the result. | Not personal data. |
| Free Starter Kit sign-up | Email, optional first name, business type, language, the page you came from, the consent text you agreed to and the time. | Give you the kit and send up to 5 tip emails, and later only emails you agreed to. You can unsubscribe in every email or by writing to us. | Consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Custom bot and robotics quote forms | Name, email, business name, business type, your message, language. | Answer your request and prepare an offer. | Steps before a contract at your request (Art. 6(1)(b)). |
| Customer contacts (our CRM) | For people who asked for a quote, signed up for the Starter Kit or became customers: name, company, email, phone if given, language, stage of the conversation, our notes and follow-up dates. We also add businesses we find in the public OpenStreetMap map data: business name, public business phone, website, a general business email (such as info@) and address. We do not collect personal email addresses of employees, and we stop contacting a business as soon as it asks. | Follow up on requests and serve customers. | Steps before a contract and the contract (Art. 6(1)(b)); our legitimate interest in keeping track of business contacts (Art. 6(1)(f)). Leads without activity are deleted automatically after 12 months. |
| Technical logs | When your browser contacts our database or our web host, they briefly log technical data such as your IP address and browser type. | Security, abuse prevention, keeping the service running. | Legitimate interest (Art. 6(1)(f)). |
We do not use your data for advertising, we do not build profiles, and we make no automated decisions that have legal or similarly significant effects on you. The Launch Check in the Factory is a word list that runs in your browser; it does not decide anything about you.
3. What stays on your device
Many tools work only in your browser and keep their settings in your browser's local storage on your own device. We cannot see this data. Examples: language choice, your saved bots, your bot business card on the buyer start page, recent token checks, game best scores, and, only if you choose "remember", your own AI key. See the Cookie and storage policy for the full list and how to delete it.
Your AI key (Meme Factory, Bot Garage): it is sent directly from your browser to the AI provider you pick (Anthropic, OpenAI or OpenRouter), never to us. Your idea or prompt then goes to that provider under its own privacy policy, and that provider bills you.
Meme Studio: your photo and your meme are made on your device and are not uploaded to us.
Region check (home page, HQ, Meme Factory): your browser looks at its own time zone setting to decide whether to hide buy and swap links in countries where local rules restrict crypto promotion. This happens only on your device; the time zone is not sent to us or anyone else.
4. Services that receive data from your browser
Some features load data from, or send you to, independent services. When that happens, your browser connects to them directly and they can see your IP address and browser details under their own privacy policies:
- GeckoTerminal (coin info, trending list, Token Checkup): we request public token data.
- CoinGecko, alternative.me and DefiLlama (MAIGA Radar): we request public market data, the Fear & Greed index and DeFi totals.
- memegen.link (classic meme templates in the Meme Studio and Factory).
- Your browser's speech feature: only when you press "Jean-Phil reads it" on the MAIGA Radar. We send nothing; your browser reads the text aloud. Some browsers use an online voice from the browser maker (for example Google or Microsoft) under their own policy.
- MyMemory by Translated (translated.net, Italy): only when you press Translate in the Meme Studio. The text lines of your meme and the two language codes are sent to be translated; nothing else (no picture, no name). MyMemory's own privacy policy applies.
- Jupiter (swap widget on the home page): its script loads on the home page; swaps are signed in your own wallet.
- Phantom or your wallet: only when you choose to connect or sign.
- Ko-fi: tips and digital products are sold and paid through Ko-fi, which handles payment data as its own controller. We receive the order details Ko-fi gives sellers (such as name, email and what you bought) to deliver and support your purchase.
- Discord, X, Pump.fun, Solscan, DexScreener and other links: only when you click them.
5. Who we share data with
We do not sell or rent personal data, and we do not share it for advertising. We use these service providers (processors), which process data only on our instructions:
- Supabase (database, hosted in the EU, Frankfurt): stores the data in section 2.
- YouTube (Google, privacy-enhanced mode youtube-nocookie.com): only when you tap a video on the homepage. Before that, nothing is loaded from YouTube. After you tap, YouTube receives your IP address and may store data in your browser under its own policy.
- Oracle Cloud (Oracle, region Morocco West, Casablanca): our own small server that checks live chat messages before they are published and answers "Ask The Brain" questions. It receives the message or question, nickname or language, never your IP address.
- Brevo (Sendinblue SAS, France, EU): sends the Starter Kit tip emails to people who signed up. It receives your email, first name, business type and language, and counts opens and clicks so we can see if the tips help. Every email has an unsubscribe link.
- X (X Corp., USA): only when you choose "Log in with X" in MAIGA Raid. X confirms who you are and sends us your basic profile; X's own privacy policy applies to your X account.
- GitHub Pages (GitHub Inc., USA): hosts the website and keeps short technical logs.
Public posts (leaderboards with pilot names and scores, team board, Factory Hub, community bots) are visible to everyone. Our Discord helper posts game standings (names and scores only, never wallets). We may disclose data if the law requires it, or to protect our rights or others' safety.
6. International transfers
We work from Morocco. Our database is in the European Union and our web host GitHub is in the United States. Transfers from Morocco follow Law 09-08. For data from the EU/UK, transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Third-party services in section 4 may process data in other countries under their own safeguards.
7. How long we keep data
| Data | Kept |
|---|---|
| Visit counts | Totals per page and day, no personal data; kept as statistics. |
| Team board posts | Shown for 14 days. |
| Factory Hub packs | Shown for 30 days. |
| Scores, pilot names, verified wallets, community bots | As long as the leaderboard or feature exists, or until you ask us to delete them. |
| Prize and payout records | Up to 7 years where accounting or tax rules require. The public payout list can be removed from our site on request; the blockchain record stays. |
| Starter Kit sign-ups | Until you unsubscribe, then deleted within 30 days. Sign-ups that never open an email are deleted after 12 months. |
| Custom bot requests | At most 12 months, or less if you ask. |
| Technical logs (host, database) | Short periods set by the provider (usually days to weeks). |
Data on a public blockchain cannot be deleted; see section 11.
8. Your rights (worldwide)
Wherever you live, you can ask us to:
- access the personal data we hold about you and get a copy (portability);
- correct it;
- delete it ("right to be forgotten");
- restrict or object to its use, including any use based on legitimate interest;
- withdraw consent at any time (for example remove your public post), without affecting earlier use.
Email us at [contact email] and tell us your pilot name, nickname or email so we can find your data. We may ask for proof that the data is yours (for example a signed message from the same wallet). We answer within one month (extendable by two months for complex requests, as the GDPR allows) and free of charge.
If you think we got it wrong, you can complain to a data protection authority: the authority in the country where you live or work (for example the CNDP in Morocco, any EU data protection authority, the ICO in the UK, the ANPD in Brazil, the Office of the Privacy Commissioner in Canada or the OAIC in Australia). We would appreciate the chance to fix it first.
These rights follow Moroccan Law 09-08, the EU and UK GDPR, Brazil's LGPD, Canada's PIPEDA, Switzerland's FADP, Australia's Privacy Act, Japan's APPI, Singapore's PDPA, South Korea's PIPA, India's DPDP Act and similar laws. We give the same rights to everyone, wherever you live.
9. United States (California and other states)
Under the California Consumer Privacy Act (as amended by the CPRA) and similar state laws: in the last 12 months we collected the categories in section 2 (identifiers such as a nickname, email or wallet address; commercial information for Ko-fi orders; internet activity limited to technical logs), for the purposes in section 2. We do not sell or share personal information for cross-context behavioral advertising and we do not use sensitive personal information to infer characteristics. You have the right to know, delete and correct your personal information, and we will not discriminate against you for using these rights. We honor Global Privacy Control signals, although we do no tracking that they would stop. Send requests to [contact email]; we answer within 45 days. Residents of other US states with privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have similar rights to access, correct, delete and opt out, and can use the same email; if we decline a request you may appeal by replying to our answer. We do not send marketing emails; we only email you to answer your own request or about your purchase (US CAN-SPAM and similar laws).
10. Children
This site is not meant for children. You must be at least 16 to use features that store data (or the minimum age for consent in your country, if higher), and 18 or the age of majority to take part in tournaments or prizes. We do not knowingly collect data from children under 13 (US COPPA) or under 16. If you believe a child has sent us data, email us and we will delete it.
11. Blockchain data
Prize payouts and swaps happen on the public Solana blockchain. Wallet addresses and transactions there are public and permanent, and nobody (including us) can change or delete them. Apart from payout records, which we publish as proof of payment, we do not show wallet addresses on our site. Anyone can look up a transaction on the blockchain.
12. Security
We use encrypted connections (HTTPS), strict database access rules (row level security), rate limits, automatic secret scanning and code scanning. Only the admin account can read custom bot requests and the wallet addresses entered for prizes or verification. Payout records are public by design (see section 11). No system is perfectly secure; if a breach affects your rights, we will tell the authority and, where required, you, within the legal deadlines.
13. Changes
We update this policy when the site changes. The date at the top shows the latest version. Important changes will also be mentioned on the home page.