This policy explains what FrenLoop collects, why, how long it is kept, and what you can ask us to do about it. It describes the product as it actually works.
1. Who we are
FrenLoop is made and run by CloutWars, an independent developer rather than a registered company, and is the controller of the data described below. There is no support inbox: privacy questions go to the Loop Keeper, on any screen, and Contact explains what it can and cannot do.
2. What we collect
Identity
When you create an egg we generate a random identifier and a slug (your Fren Link name). That identifier is stored in a signed, httpOnly cookie. We never ask for your name, email address or password, and there is no account to log into.
Gameplay
We store your eggs and hatched Loopy Frens, their genes and generation inputs, your Realm choice, your progress, and which players joined FrenLoop through your link.
Interactions with eggs
When someone touches an egg we record that it happened. To stop one person inflating a count, we derive a salted hash of their IP address using a salt that rotates daily.
We do not store raw IP addresses.Because the salt rotates, yesterday's hashes cannot be linked to today's. Country may be stored coarsely for the "places" statistic.
Wallet addresses
If you choose to connect a Solana wallet, we store its public address and the signature proving you control it. A public address is inherently public and is visible on the blockchain to anyone.
We never receive your private key or seed phrase. FrenLoop cannot move your funds. Transactions are built by us and signed by you.
Analytics
We run first-party analytics only, no Google Analytics, no advertising pixels, no third-party trackers. We record events such as egg created, egg shared, egg hatched, quest started and completed, and which share platform was chosen.
Ritual analytics record outcomes and fee rates only, never wallet addresses, amounts or transaction signatures.
Technical data
Our hosting provider processes standard request logs (IP address, user agent, timestamp) to serve and secure the site. These are handled by the provider under their own retention policy.
3. What we do not collect
- Names, email addresses, phone numbers or postal addresses
- Passwords
- Payment card details
- Precise location
- Contacts, photos or files
- Private keys or seed phrases
- Behaviour on other websites
4. Why we process it, and on what basis
| Data | Purpose | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Identity cookie | Run the game; know which egg is yours | Necessary for a service you requested |
| Gameplay records | Provide progression and collection | Necessary for a service you requested |
| Salted visitor hashes | Prevent one person inflating counts | Legitimate interest in preventing abuse |
| Wallet address | Enable optional rituals | Consent, you choose to connect |
| First-party analytics | Understand whether the game works | Legitimate interest in improving the product |
5. Sharing
We do not sell or rent personal data. We share it only with:
- Our hosting provider, to serve the site.
- Our database provider, to store game data.
- Solana RPC providers, when checking whether a transaction confirmed. This involves a transaction signature, not your identity.
- Jupiter, when you perform a ritual. Your public wallet address is included, as it must be to build a transaction for you.
- Authorities, where we are legally required to.
Sharing a link to a social platform is initiated by you. Those platforms fetch the preview image and apply their own privacy policies.
6. Blockchain
7. Retention
- Game data, kept while your egg is active. Accounts with no activity for 24 months may be deleted.
- Salted visitor hashes, the salt rotates daily, so they stop being linkable after 24 hours.
- Analytics events, retained in aggregate.
- Wallet links, kept until you ask us to remove them.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent.
That covers this browser and any wallet connected to it. Deleting also detaches you from the identity cookie, so the same button is the way to remove a Fren whether you reach it from the browser it was created in or from one you later connected the same wallet to.
Two things survive, and neither identifies you. Aggregate counts stay in our analytics with the link to you removed, so we still know how many eggs hatched without knowing whose. Records of who first discovered something stay as facts with nobody attached, so deleting yourself does not rewrite another player's history.
Because we hold no email address, your Fren Link (and, if connected, a signature from your wallet) is the only way we can verify a request. We may be unable to act on a request we cannot verify.
If you are in the UK or EU you may also complain to your local data protection authority.
9. Children
FrenLoop is not directed at children under 13, and under-16s in some regions require a parent's consent. If you believe a child has provided us data, contact us and we will delete it.
10. International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
11. Security
Identity cookies are signed, httpOnly and same-site. Credentials are held server-side and never sent to the browser. Traffic is encrypted in transit. No system is perfectly secure, and we do not claim otherwise.
12. Changes
We will update the date at the top of this page when this policy changes, and will flag significant changes in the product.
13. Contact
Ask the Loop Keeper, on any screen, or see Contact. Cookies are covered separately in the Cookie Policy.