ManekoraPrivacy Policy
Version 2026-10-18.2 · Last updated 18 October 2026
This Privacy Policy explains what personal data Manekora Pte Ltd (“Manekora”, “we”, “us”) collects when you use the websites at manekora.com and its subdomains, the Manekora web app and its API (the “Service”), why, who else processes it, how long we keep it and the rights you have. It is part of our Terms of Use. Its section on cookies and local storage is our cookie policy.
We are the controller of the personal data described here. Contact us at contact@manekora.com.
In short. We collect what we need to run the game and keep it safe: your wallet address, your login email from Privy, IP addresses and the records of your deposits, withdrawals and acceptance of our terms. We use analytics (PostHog) to see how the Service is used, including recordings of visits; in the EU, the UK and Switzerland only if you agree, and anyone can turn it off. We do not ask for ID documents, we do not use advertising trackers, and we do not sell your data. Anything you do on chain is public by nature. This summary is not part of the policy: the sections below govern.
1. What we collect
From you and your login
- Wallets and login: your wallet address, the wallets your Privy login links (address, type, and the wallet app for an external one), your Privy user ID, and the email address of your login when it has one (for example if you log in with email or a social account).
- Invites and referrals: the invite code you joined with, who invited you, your own code and how many times it was used, and the contact (an email or handle) you give if you ask to join the waitlist.
- Acceptance of our terms: the version you accepted, the exact message your wallet signed and its signature, the time, your IP address, the country it is in, your browser's user agent, the kind of wallet that signed and your Privy user ID. This is how we can show that you agreed.
- Deposits and withdrawals: the deposit addresses created for you, the chains, tokens and amounts, transaction hashes, the sender and refund addresses of deposits, and the recipient addresses you send withdrawals to.
- Free gas: the wallet it was sent to, when, how much, the transaction, and a keyed hash of your IP address (used to limit requests per connection; we do not keep the IP itself for this).
- Game: the names you give your Maneki (shown publicly) and the messages you send us.
Automatically
- Network and device: your IP address when your account is created, at your latest sign-in and with each sign-in request; the country of that IP address, as our hosting provider reports it; and your browser's language.
- Server logs: technical records of requests to our API (such as time, path, status and IP address), kept for security and troubleshooting.
- Human check: after several wrong invite codes from one IP address, a Cloudflare Turnstile check, which Cloudflare runs under its own privacy policy.
- Analytics and session replays: through PostHog, the pages you visit, the buttons and links you click, what you do in the app (such as logging in, using an invite code, deposits, withdrawals, minting, trades and their amounts, and errors you run into), the page or link you came from with its campaign tags (such as
utm_source), your browser, device, screen size, language, your IP address and the approximate location derived from it, and recordings of your visits: what the page showed and where you moved, clicked and scrolled, including small pictures of the charts. Recordings hide what you type into fields, the text of the login window and your email address, and never include our admin pages. Once you log in, this is linked to your wallet address (never to your email). Visitors from the EU, the EEA, the UK and Switzerland are asked first, and nothing is recorded unless they agree; browsers that send Do Not Track or Global Privacy Control are not recorded; anyone can turn it off (see Cookies and local storage).
From public blockchains
We read the HyperEVM blockchain and index the Maneki, positions, trades and transfers linked to wallet addresses, including yours, to show your portfolio, the leaderboard and the stats. This data is public by design. Deposits and withdrawals also appear on the other chains they use.
What we do not collect
We do not ask for identity documents and do not collect payment card details. We never see your wallet's private key. We use no advertising or cross-site tracking tools.
2. Public blockchain data
Transactions you sign are published on public blockchains, where anyone can see them, permanently, together with your wallet address. Neither we nor anyone else can change or delete them, so the rights described below cannot apply to data on chain. Your wallet address is shown publicly in places such as the leaderboard and a Maneki's page.
3. Why we use it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Signing you in, running your account, deposits, withdrawals and the game | Wallets and login, invites, deposits and withdrawals, game data | Performing our contract with you (the Terms) |
| Keeping the Service secure; preventing abuse of invite codes, free gas and rate limits | IP addresses and their country, keyed IP hashes, server logs, human checks | Our legitimate interest in a safe, fair Service |
| Recording that you accepted our terms, and establishing or defending legal claims | Acceptance records | Our legitimate interest; legal obligations |
| Complying with the law, including sanctions, and answering lawful requests from authorities | Any of the above, as needed | Legal obligations; our legitimate interest |
| Answering your messages and telling you about changes to the Service or these documents | Email and contact details | Performing our contract; our legitimate interest |
| Understanding how the game is used, in aggregate (for example totals on the stats page) | Game and blockchain data | Our legitimate interest |
| Learning how visitors find and use the Service, where they get stuck, and fixing problems | Analytics and session replays | Your consent in the EU, the EEA, the UK and Switzerland; elsewhere our legitimate interest in improving the Service. You can withdraw your consent or object at any time by turning analytics off. |
5. International transfers
Our servers are in Japan, and our service providers process data in other countries, including the United States. Where the law requires it, we rely on adequacy decisions or on safeguards such as standard contractual clauses for these transfers (and, for transfers from the UK, the UK's international data transfer addendum). Contact us for a copy of the safeguards that apply.
6. How long we keep it
We keep personal data only as long as we need it for the purposes we collected it for, including legal, accounting and reporting requirements, or as the law requires. How long depends on the kind of data and why we hold it. In particular:
- Account, wallet, invite and referral data: while your account exists, then only as long as those purposes need.
- Acceptance records: as long as we may need to show what you agreed to, which can be after your account ends.
- Deposit, withdrawal and free gas records: as long as legal, accounting and reporting requirements need them.
- Sign-in requests (with their IP address): deleted about an hour after they expire.
- Server logs: each part of our backend keeps only its most recent logs (about 100 MB), so older entries are overwritten as new ones arrive.
- Database backups: a few days, then overwritten.
- Analytics events and session replays: for as long as our PostHog plan keeps them (replays for a shorter time than events), then deleted by PostHog. Turning analytics off stops new ones and removes PostHog's identifier from your browser.
7. Security
We protect your data with encryption in transit, access controls that limit each part of our system to the data it needs, and secrets kept in a managed vault. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires. Keep your login and devices safe: anyone with your login can use your wallet.
8. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable form, and complain to a data protection authority. Write to contact@manekora.com to use them. To prove a request is yours we may ask you to sign a message with your wallet. Where the law requires it, we answer within one month, which can be extended by two more months in some cases.
Some data we must or may keep even if you ask us to delete it, such as acceptance records and transfer records we need for legal reasons, and we cannot delete anything that is on a public blockchain. Deleting your account ends your access to the app, but not to what your wallet holds on chain.
10. Children
The Service is not for anyone under 18, and we do not knowingly collect their data. If you believe a child has used it, tell us and we will delete their data.
11. Changes to this policy
We may change this policy. Each version has the date shown at the top of this page. When we publish a new version, the app asks you to accept it at your next sign-in.
12. Contact
Questions or requests about your data: contact@manekora.com.