Privacy Policy

GOXY Word Vault Protocol

Effective Date: May 26, 2026

Website: arg.goxy.ai

1. Introduction and Scope

This Privacy Policy ("Policy") describes how GOXY Word Vault Protocol ("GOXY," "we," "us," or "our") collects, uses, processes, and protects information in connection with the arg.goxy.ai website and the GOXY Word Vault Protocol skill-based word guessing game platform (collectively, the "Platform").

GOXY Word Vault Protocol is a deterministic, skill-based knowledge game deployed on the BNB Smart Chain ("BSC") Mainnet. Participation outcomes are determined entirely by players' intellectual ability to deduce correct answers to riddles and clues—not by chance, randomization, or probability-based mechanisms.

This Policy applies to all users of the Platform, regardless of geographic location. We are committed to protecting your privacy and processing any information in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") for users located in the European Union ("EU") and European Economic Area ("EEA").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Policy.

2. Data Controller Information

For the purposes of the GDPR and other applicable data protection legislation, the data controller responsible for your information is:

GOXY Word Vault Protocol

For data protection inquiries, requests, or complaints, please contact us at:

Email: 01101101.01100101+support@goxy.ai

Subject Line: "Data Protection Inquiry – arg.goxy.ai"

3. Information We Collect

3.1 Information We Do NOT Collect

We have designed the Platform to minimize data collection. We do not collect, request, or store any of the following personal identification information:

• Full legal name
• Email address
• Phone number
• Physical or mailing address
• Government-issued identification documents
• Date of birth
• Social security numbers or national identification numbers
• Financial account information (bank accounts, credit card numbers)
• Biometric data
• Photographs or likeness

We do not require users to create accounts, and we do not implement Know Your Customer (KYC) or identity verification procedures.

3.2 Information Collected Automatically

When you access the Platform, we automatically collect certain technical information necessary for the operation, security, and improvement of our services:

3.2.1 Server Log Data

Our servers automatically record standard technical information when you visit arg.goxy.ai, including:

• Internet Protocol (IP) address (which may be truncated or anonymized)
• Browser type and version
• Operating system
• Referring URL (the webpage that directed you to our Platform)
• Pages visited on the Platform
• Date and time of access
• Time spent on pages
• Error logs and diagnostic data

This information is collected for security monitoring, abuse prevention, technical troubleshooting, and aggregate analytics purposes.

3.2.2 Device Information

We may collect non-identifying technical information about the device you use to access the Platform, including:

• Device type (desktop, mobile, tablet)
• Screen resolution
• Browser language settings
• Time zone settings

3.3 Information You Provide Through Blockchain Interaction

3.3.1 Wallet Addresses

To participate in the GOXY Word Vault Protocol skill-based game, you must connect a compatible cryptocurrency wallet (such as MetaMask) to the Platform. When you do so, your public wallet address becomes visible to us and is recorded on the public blockchain.

Important Notice Regarding Wallet Addresses:

• Public wallet addresses are pseudonymous identifiers—they do not inherently reveal your real-world identity.
• We do not have the ability to link your wallet address to your personal identity unless you voluntarily disclose such information to us.
• Under certain circumstances and applicable legal frameworks, public wallet addresses may be considered personal data if they can be linked to an identified or identifiable natural person. We treat wallet addresses with appropriate care in recognition of this possibility.

3.3.2 On-Chain Transaction Data

All transactions executed through the Platform—including guess submissions, fee payments, and prize distributions—are recorded on the BNB Smart Chain public blockchain. This includes:

• Wallet addresses involved in transactions
• Transaction hashes
• Token amounts transferred (GOXY and USDT)
• Smart contract interactions
• Timestamps
• Gas fees paid

Critical Blockchain Disclosure:

The BNB Smart Chain is a public, decentralized, immutable ledger. All on-chain transaction data is:

• Publicly accessible to anyone with internet access
• Permanently recorded and cannot be deleted, modified, or erased
• Outside our control once recorded on the blockchain

We do not control the BNB Smart Chain network, and we cannot delete, modify, or restrict access to any data recorded on the public blockchain. This is an inherent characteristic of blockchain technology and participation in any blockchain-based application.

3.4 localStorage Data

We use your browser's localStorage functionality to store:

• Privacy policy consent status (whether you have acknowledged this Policy)
• Cookie/localStorage consent preferences
• User interface preferences (such as display settings)

localStorage data is stored locally on your device and is not transmitted to our servers except as necessary to honor your preferences.

4. Information We Receive from Third Parties

4.1 Blockchain Network Data

We read publicly available data from the BNB Smart Chain, including:

• Wallet balances (GOXY and USDT tokens)
• Historical transaction records
• Smart contract states

4.2 Price Oracle Data

The Platform utilizes the PancakeSwap V3 decentralized exchange protocol as an on-chain price oracle to determine the current GOXY/USDT exchange rate for fee calculation purposes. This interaction occurs on-chain and does not involve the collection of personal data.

5. How We Use Your Information

We use the information described in Section 3 for the following purposes:

5.1 Platform Operation and Service Delivery

• To enable your participation in the GOXY Word Vault Protocol skill-based game
• To process guess submissions and verify answers against smart contract logic
• To facilitate prize distribution to winning participants
• To calculate and process fee payments in GOXY tokens

5.2 Security and Fraud Prevention

• To detect, prevent, and respond to security incidents, fraud, abuse, or illegal activity
• To protect the integrity of the Platform and smart contracts
• To enforce our Terms of Service
• To comply with legal obligations

5.3 Technical Operations and Improvement

• To maintain, troubleshoot, and improve the Platform's technical infrastructure
• To diagnose and fix technical errors
• To analyze aggregate usage patterns (in anonymized or aggregated form) to improve user experience

5.4 Legal Compliance

• To comply with applicable laws, regulations, legal processes, or governmental requests
• To establish, exercise, or defend legal claims

6. Legal Basis for Processing (GDPR)

For users located in the EU/EEA, we process personal data only when we have a valid legal basis under Article 6 of the GDPR. The legal bases we rely upon are:

6.1 Contractual Necessity (Article 6(1)(b) GDPR)

Processing of wallet addresses and transaction data is necessary to perform our contract with you—specifically, to enable your participation in the skill-based game, process your guesses, and distribute prizes.

6.2 Legitimate Interests (Article 6(1)(f) GDPR)

We process server log data (including IP addresses) based on our legitimate interests in:

• Maintaining the security and integrity of the Platform
• Preventing fraud, abuse, and malicious activity
• Ensuring technical functionality and troubleshooting issues
• Analyzing aggregated, anonymized usage data to improve services

We have conducted a balancing test and determined that these legitimate interests are not overridden by your fundamental rights and freedoms, particularly given the minimal nature of data collected and our data minimization practices.

6.3 Consent (Article 6(1)(a) GDPR)

Where required by law, we obtain your consent before:

• Storing data in your browser's localStorage
• Processing any data not covered by the above legal bases

You may withdraw consent at any time (see Section 10).

6.4 Legal Obligation (Article 6(1)(c) GDPR)

We may process personal data where necessary to comply with legal obligations to which we are subject, such as responding to lawful requests from law enforcement or regulatory authorities.

7. Data Sharing and Disclosure

7.1 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for marketing or any other commercial purposes.

7.2 Blockchain Disclosure

As described in Section 3.3.2, all on-chain transaction data (including wallet addresses) is publicly visible on the BNB Smart Chain. By participating in the Platform, you acknowledge and accept this inherent transparency of blockchain technology.

7.3 Third-Party Service Providers

We may share limited technical data with trusted third-party service providers who assist us in operating the Platform, including:

• Hosting providers (for server infrastructure)
• Content delivery networks (for website performance)
• Security service providers (for DDoS protection and threat monitoring)

These providers are contractually obligated to process data only on our behalf, in accordance with our instructions, and subject to appropriate confidentiality and security obligations.

7.4 Blockchain Infrastructure

The Platform interacts with the following decentralized protocols and networks, which are not under our control:

• BNB Smart Chain (BSC) Mainnet — public blockchain network
• PancakeSwap V3 Protocol — decentralized exchange and price oracle

Interactions with these protocols occur directly between your wallet and the blockchain. We do not control these protocols, and their operation is governed by their own smart contracts and network rules.

7.5 Legal Disclosure

We may disclose information if required to do so by law or in response to valid legal process, including:

• Court orders
• Subpoenas
• Regulatory inquiries
• Law enforcement requests

We may also disclose information when we believe in good faith that disclosure is necessary to:

• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or the public
• Detect, prevent, or address fraud, security, or technical issues

8. International Data Transfers

8.1 Nature of Blockchain Data

The BNB Smart Chain is a globally distributed network. Transaction data is replicated across nodes located worldwide. By participating in blockchain-based activities, you acknowledge that your on-chain data will be processed and stored on a global network without geographic restrictions.

8.2 Transfers Outside the EU/EEA

If you are located in the EU/EEA, your personal data (such as server log data) may be transferred to, and processed in, countries outside the EU/EEA that may not provide an equivalent level of data protection.

Where such transfers occur, we implement appropriate safeguards to protect your personal data, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries recognized by the European Commission as providing adequate protection
• Other lawful transfer mechanisms under Chapter V of the GDPR

You may request information about the specific safeguards applied to your data by contacting us at 01101101.01100101+support@goxy.ai.

9. Data Retention

9.1 Server Log Data

We retain server log data (including IP addresses) for a maximum period of ninety (90) days from the date of collection, unless longer retention is:

• Required by applicable law
• Necessary for the establishment, exercise, or defense of legal claims
• Necessary for ongoing security investigations

After the retention period, server log data is either deleted or irreversibly anonymized.

9.2 localStorage Data

Data stored in your browser's localStorage remains on your device until you clear it manually through your browser settings. We do not control the retention of localStorage data on your device.

9.3 Blockchain Data

On-chain transaction data is permanent and immutable. Due to the fundamental nature of blockchain technology, we cannot delete, modify, or control the retention of any data recorded on the BNB Smart Chain. This data will persist indefinitely on the public blockchain.

9.4 Backup and Archival Data

Backup copies of server data may be retained in secure archives for disaster recovery purposes. Such backups are subject to the same retention periods as primary data and are deleted or anonymized in accordance with our data retention schedule.

10. Your Rights Under the GDPR

If you are located in the EU/EEA, you have the following rights under the GDPR with respect to your personal data:

10.1 Right of Access (Article 15)

You have the right to obtain confirmation as to whether we process your personal data and, if so, to access that data along with information about how it is processed.

10.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

10.3 Right to Erasure ("Right to Be Forgotten") (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (where processing is based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Important Limitation: We cannot delete data recorded on the BNB Smart Chain public blockchain. This is a technical limitation inherent to blockchain technology, not a policy choice. On-chain data is immutable and outside our control.

10.4 Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or object to processing.

10.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible.

10.6 Right to Object (Article 21)

You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

10.7 Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

10.8 Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

10.9 Exercising Your Rights

To exercise any of these rights, please contact us at:

Email: 01101101.01100101+support@goxy.ai Subject Line: "GDPR Data Subject Request – [Specify Right]"

We will respond to your request within one (1) month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of your request.

We may request verification of your identity before processing your request to ensure we do not disclose personal data to unauthorized persons.

11. Cookies and Tracking Technologies

11.1 Cookies

We do not use cookies for tracking, advertising, or analytics purposes.

11.2 localStorage

We use browser localStorage for the following limited, functional purposes:

localStorage data is stored entirely on your device and is not transmitted to third parties for tracking or advertising purposes.

11.3 Managing localStorage

You can clear localStorage data at any time through your browser settings:

• Chrome: Settings → Privacy and Security → Clear Browsing Data → Site Settings → View Permissions and Data Stored
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Privacy, Search, and Services → Clear Browsing Data

Clearing localStorage may reset your consent preferences and UI settings.

12. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: Use of TLS/SSL encryption for data in transit
• Access Controls: Restriction of access to personal data on a need-to-know basis
• Monitoring: Security monitoring and logging to detect and respond to potential threats
• Smart Contract Security: Deployment of audited smart contracts on BSC Mainnet
• Regular Review: Periodic review and update of security practices

Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute