GENOPOOLDOCUMENT GP-PRIV: PRIVACY POLICY
Privacy Policy
Last updated: 17 July 2026
1. Controller
The data controller is One Click Everything SAS, 9 rue des Colonnes, 75009 Paris, France (the "operator", "we"). For any privacy request, write to privacy@genopool.com.
2. What we collect, and why
Waitlist: if you file your email address, we store it with the form source, the filing time and a truncated hash of your IP address (anti-abuse; never the raw address). Legal basis: your consent, confirmed by a double opt-in email. You can withdraw at any time via the unsubscribe link or by writing to us.
Account: signing in uses a message signature from your Solana wallet (or an embedded wallet). We store your public wallet address, your chosen pseudonym, and operational game data (stable, captures, race results, invitation-code sponsorship). Legal basis: performance of the contract. A single httpOnly session cookie (gp_session) keeps you signed in; it is strictly necessary and is not used for tracking.
Technical logs: our servers keep short-lived logs (requests, errors, anti-abuse counters) on the basis of our legitimate interest in securing the service.
Local storage: your display-theme choice and a one-per-session intro flag are kept in your browser only and never leave it.
Audience measurement: we use PostHog (EU cloud) to understand how the site is used: pages viewed, referrer, approximate location, clicks on key actions. A first-party cookie and browser storage hold a random identifier so we can count unique and returning visitors across pages and sessions. That identifier is not linked to your name or email, does not follow you across other sites, and is never shared with advertisers. Your IP address is used to derive an approximate location and is not stored with events. Legal basis: our legitimate interest in measuring and improving the site; you can object at any time by blocking the posthog.com domains or writing to us.
3. What we do not collect
No advertising trackers, no cross-site tracking, no fingerprinting. Our only measurement tool is the first-party audience measurement described in section 2. Payments are made wallet-to-program in crypto: we never see card numbers, bank details or any fiat payment data, and we never hold your funds. We do not sell or rent personal data to anyone.
4. Blockchain data: public by design
Specimens, their genomes, transfers and race proofs are recorded on the public Solana blockchain. That record is public, worldwide and immutable: it cannot be edited or erased by anyone, including us. Your wallet address is pseudonymous; on our interfaces we display your pseudonym or a truncated address, and we never publish the link between the two. Think before you link your wallet address to your identity elsewhere.
5. Processors and hosting
Our servers and database are hosted by Hetzner Online GmbH in the European Union (Germany). Waitlist emails are relayed to Loops (Astro Technologies Inc., USA) to send the confirmation and access notices, under standard contractual clauses. Audience measurement events are processed by PostHog (PostHog Inc., USA), with event data hosted in the European Union (Frankfurt). Public blockchain reads and webhooks go through a Solana node infrastructure provider. Each processor only receives what it needs; the full processor list is available on request.
6. Retention
Waitlist data is kept until you withdraw or until the launch-notification purpose is exhausted. Account data is kept while your account is active and deleted or anonymised after prolonged inactivity, except where law requires longer retention. Technical logs are kept for a few weeks at most. On-chain data is permanent by nature (see section 4).
7. Your rights
Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Write to privacy@genopool.com; we answer within one month. Erasure applies to the data we control: it cannot reach the public blockchain record (section 4). You may lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.
8. Minors
The free game does not target children, and every paid feature is restricted to adults (18+). We do not knowingly collect personal data from minors; if you believe a minor has provided data, contact us and we will delete it.
9. Changes
We will update this policy as the service evolves (for example when new processors are added) and announce material changes on the site. The date above always reflects the current version.