1. Introduction and Scope

PUDDY Inc. ("we," "our," "us," or the "Company") operates puddystudios.com and all associated subdomains (collectively, the "Sites"). This Privacy Policy ("Policy") explains how we collect, use, disclose, and protect information in connection with the Sites and with any current or future application, game, tool, publication, website, or feature operated, published, or distributed by the Company, whether on the Sites or off-domain (including on third-party games, messaging, and distribution platforms and on public blockchain networks and content hosts), and whether now existing or hereafter developed (collectively, the "Services").

To the extent any Service is hosted, distributed, or made available by a third party (including third-party platforms, content hosts, and public blockchain networks), the data practices of that third party are governed by its own terms and privacy policy, and this Policy describes only the Company's own practices (see Sections 13 and 14).

For the purposes of this Policy and only to the extent applicable law applies that concept and assigns that role to the Company, the Company acts as the controller of personal information for which it determines the purposes and means of processing in connection with the Sites and Services, except where this Policy states that the Company is neither a controller nor a processor of certain content (see Section 14).

This Policy describes our practices. Your use of the Sites and Services is also governed by our Terms of Service. By accessing or using the Sites or Services, you acknowledge this Policy. Where your consent is required by applicable law (for example, for non-essential cookies or device permissions), we obtain it as described in this Policy. If you do not agree, do not access or use the Sites or Services. The Company may update this Policy at any time as described in Section 16.

2. Information We Collect

Information You Provide

We may collect information you choose to provide, such as your name, email address, and the contents of your message when you submit a contact or inquiry form or otherwise communicate with us, and any other information you voluntarily submit through the Sites or Services. Where you use an artificial-intelligence feature, this includes the prompts, messages, files, notes, and other material you submit to it, which are handled as described in Section 14.6.

Automatically Collected Information

When you access the Sites or Services, we and the third parties that help us operate them may automatically collect information, including without limitation:

• IP address and general or approximate location inferred from it
• Device type, device identifiers, and hardware and browser data
• Browser type and version and operating system
• Pages visited, time on each page, clickstream, and usage data
• Gameplay data and in-game state, where you use a game
• Referring and exit URLs
• Cookie, pixel, software development kit, local storage, and similar tracking-technology data
• Log, diagnostic, and other information automatically collected
• Where you elect to contribute computing capacity, the device-capability, performance, availability, and workload-verification information described in Section 14.7

Categories Under California Law

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), we may collect the following categories of personal information: identifiers (such as name, email address, IP address, and device identifiers); internet or other electronic network activity (such as usage and gameplay data); geolocation data (general or approximate location inferred from your IP address, and precise geolocation only with your permission, which for Local Applications is processed only on your device and is never received by the Company, as described in Section 14); commercial information; and inferences drawn from the foregoing. We collect these categories from you directly and automatically from your device. We use each category for the business and commercial purposes described in Section 3 and may disclose each category to the recipient categories described in Section 5. We retain each category according to the criteria described in Section 10.

Sensitive Information

Certain information may be considered sensitive personal information under applicable law, including precise geolocation. Where a Local Application uses precise geolocation, that data is processed only on your device and is never received by the Company (see Section 14). We do not use or disclose sensitive personal information for purposes that would require us to offer a right to limit such use beyond the purposes that are permitted without a limitation right under applicable law, and we do not use sensitive personal information to infer characteristics about you.

Cookies and Tracking Technologies

We use cookies, pixels, software development kits, local storage, and similar tracking technologies to operate, secure, and improve the Sites and Services and, where applicable, to enable analytics and advertising. See Section 6 for details and your controls.

3. How We Use Your Information

We may use the information we collect to:

• Operate, maintain, secure, and improve the Sites and Services
• Provide, personalize, and analyze features and functionality
• Operate games, synchronize gameplay state across devices, maintain leaderboards, and administer virtual in-game currency, points, and items (which have no monetary value)
• Operate artificial-intelligence features, including transmitting the input you submit to a model provider in order to generate a response (see Section 14.6)
• Measure, verify, schedule, and reward contributed computing capacity, and maintain the integrity of the network (see Section 14.7)
• Respond to your inquiries and support requests
• Analyze usage and optimize user experience
• Serve and measure advertising through third-party advertising networks (see Section 7)
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our terms and agreements
• Any other purpose disclosed at the point of collection or otherwise permitted by applicable law

4. Legal Bases for Processing

Where the General Data Protection Regulation, the UK GDPR, or Swiss data protection law applies, we process personal information on one or more of the following legal bases, as relevant to the processing activity:

• Legitimate interests - Operating, securing, improving, analyzing, and marketing the Sites and Services and preventing fraud and abuse, where such interests are not overridden by your rights
• Consent - For advertising, analytics, and similar cookies and technologies where required, and for any device-permission feature (such as geolocation), which you may withdraw at any time without affecting prior processing
• Performance of a contract - To provide the features and services you request
• Legal obligation - To comply with applicable laws and lawful requests

5. How We Disclose Information

We do not sell your personal information for money. The use of advertising or analytics cookies and similar technologies may constitute a "sale" or "sharing" (including cross-context behavioral advertising) as defined by certain US state laws; you may opt out as described in Sections 6, 7, and 8. We may disclose information by recipient category, including without limitation:

• Service providers, processors, and contractors that help operate, secure, analyze, or improve the Sites and Services, including without limitation hosting and infrastructure providers, content delivery networks, and analytics providers
• Third-party advertising networks
• Mapping and geocoding providers
• Third-party messaging and distribution platforms
• Payment processors
• Legal and governmental authorities, where required by law or legal process or to protect rights, property, or safety
• Successors and acquirers in connection with a merger, acquisition, financing, reorganization, or sale of assets
• Other parties with your consent or at your direction
• Other third parties acting on our behalf, in each case under their own terms and privacy policies, for which the Company is not responsible

We may also create, use, and disclose aggregated, de-identified, or anonymized information, which is not subject to this Policy, for any lawful purpose. Our liability in connection with this Policy and any third-party practices is limited as set forth in our Terms of Service.

6. Cookies, Tracking, and Opt-Out Preference Signals

We and the third parties that help operate the Sites and Services use cookies, pixels, software development kits, local storage, and similar technologies to operate the Sites and, where applicable, to enable analytics and advertising. You can manage cookies through your browser settings; disabling cookies may affect site functionality.

We use cookies and similar technologies in the following categories: strictly necessary (required to operate the Sites); functional and preference; analytics and performance; and advertising. Strictly necessary technologies do not require consent; the others are used with consent where required.

Where required by applicable law (including in the European Economic Area, the United Kingdom, and Switzerland), non-essential cookies are used only with your consent, which you may withdraw at any time.

Where we use technologies that recognize opt-out preference signals such as Global Privacy Control, and where required by applicable law, we treat a detected signal as a request to opt out of targeted advertising and of any "sale" or "sharing" of personal information for the browser or device from which the signal is sent.

7. Advertising

The Sites and Services may use third-party advertising networks to display advertising. The Company has not committed to any particular advertising program or provider and reserves the right, in its sole discretion, to add, change, or remove advertising and advertising providers at any time, with or without notice. Where used, such networks may use cookies and similar identifiers to serve and measure advertising based on your activity across the Sites and Services and other sites and over time.

Such networks act under their own terms and privacy policies, for which the Company is not responsible. Where required by applicable law, advertising that relies on non-essential cookies or similar technologies is used only with your consent, which you may withdraw at any time.

Where advertising is used, you may be able to opt out of targeted advertising through your browser and device controls, through available industry opt-out tools, through Global Privacy Control and similar opt-out preference signals where required, and by submitting a request to privacy@puddystudios.com.

8. Your Privacy Rights

United States State Privacy Rights

Depending on your state of residence (including California and other states that have enacted comprehensive consumer privacy laws), you may have the right to: know and access the personal information we collect; correct inaccurate information; request deletion; receive a portable copy; opt out of targeted advertising and of the "sale" or "sharing" of personal information; opt out of certain profiling; limit the use of sensitive personal information; and not be discriminated against or retaliated against for exercising these rights. To submit a request, or to appeal a decision regarding a request, contact privacy@puddystudios.com. We may need to verify your identity before fulfilling a request, and authorized agents may submit requests on your behalf with proper authorization. We will respond to verifiable requests within the time period required by applicable law, and may extend that period where permitted. We reserve the right to deny or limit requests as permitted by applicable law, including where an exception applies, where we cannot verify your identity to the standard required by law, or where a request is duplicative, manifestly unfounded, or excessive.

California Shine the Light

California residents may request information about our disclosure, if any, of personal information to third parties for those third parties' own direct marketing purposes during the prior calendar year. We do not currently disclose personal information to third parties for their own direct marketing. Virtual items, points, and rewarded-advertising features confer no monetary value and are not a financial incentive program; we do not offer financial incentives in exchange for personal information. To inquire, contact privacy@puddystudios.com.

European Economic Area, United Kingdom, and Switzerland

You have the right to access, rectify, erase, restrict, and port your personal data, to object to its processing, and to withdraw consent at any time without affecting prior processing. Our legal bases are described in Section 4. You may also lodge a complaint with your local supervisory or data protection authority. To exercise your rights, contact privacy@puddystudios.com.

9. International Users and Transfers

The Sites and Services are operated from the United States, and information is processed there. By accessing or using the Sites or Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on a lawful transfer mechanism recognized under applicable law, such as standard contractual clauses, an applicable adequacy decision, or another permitted safeguard or derogation, in each case where required by applicable law. You are responsible for compliance with the laws of the jurisdiction from which you access the Sites and Services.

10. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements, after which it is deleted or de-identified. Retention criteria include the nature of the information, the purpose of collection, our legal and contractual obligations, and applicable limitation periods. Where information is retained for a limited period, it is retained for no longer than necessary, up to the maximum period permitted or required by applicable law.

11. Security

We implement reasonable technical and organizational measures designed to protect your information. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot and do not guarantee absolute security. Your use of the Sites and Services is at your own risk.

In the event of a security incident affecting your personal information, we will provide notice as and where required by applicable law. We are not responsible for the security practices of, or any incident occurring at, any third party, including advertising networks, distribution or messaging platforms, content delivery networks, hosting or infrastructure providers, blockchain networks, or content hosts, each of which maintains its own security program.

12. Children's Privacy

Consistent with the Children's Online Privacy Protection Act (COPPA), the Sites and Services are not intended for, directed to, or designed to attract children under 13, and we do not knowingly collect personal information from children under 13. No portion of the Sites or Services is intended for, designed to attract, or knowingly made available to children under 13, and we do not knowingly permit children under 13 to register, transact, earn virtual items, or view advertising. You must be at least 13 years old (and the age of majority in your jurisdiction to form a binding contract) to use the Services.

Where any feature could be accessed by a child, we configure it so that no personal information is knowingly collected and no behavioral or targeted advertising is served to users we know or have reason to believe are under 18. We do not knowingly sell or share, or process for targeted advertising or cross-context behavioral advertising, the personal information of consumers we know to be under 16 without opt-in consent obtained as required by applicable law (from the consumer if 13 to 15, or from a parent or guardian if under 13).

If you are a parent or guardian and believe we have inadvertently collected personal information from a child under 13, contact us at privacy@puddystudios.com and we will take reasonable steps to delete it as required by applicable law.

13. Third-Party Links and Services

The Sites and Services may link to, embed, or integrate third-party sites, services, networks, platforms, and blockchain networks, described only by general category (including advertising networks, analytics providers, mapping and geocoding providers, third-party messaging and distribution platforms, blockchain networks, content delivery networks, hosting and infrastructure providers, and payment processors). We do not control and are not responsible for the privacy practices or content of any such third party, each of which is governed by its own terms and privacy policy. We encourage you to review those policies.

14. Application- and Network-Specific Privacy

14.1 Locally Executing Applications

Certain applications made available through the Sites or Services are locally executing applications that run entirely within your browser or device environment, including without limitation on-device astronomy and computation applications, on-device file compression applications, on-device blockchain analysis applications, and any current or future locally executing application or any successor or similar application (collectively, "Local Applications"). Files, media, inputs, device sensor data (including precise geolocation, where you grant the corresponding browser or operating-system permission), and outputs processed by a Local Application (collectively, "Local Content") are processed exclusively on your device. The Company does not collect, receive, access, transmit, store, or otherwise process Local Content; has no ability to access, retrieve, or recover Local Content; and acts as neither a controller nor a processor with respect to Local Content. Local Applications may write settings, preferences, and cached assets to browser-managed storage on your device, which remains under your exclusive control and may be cleared through your browser at any time.

14.2 On-Device Geolocation

Where a Local Application uses device geolocation or precise coordinates (granted through your browser or operating-system permission), those coordinates and any computed results are used solely on your device for the application's function and are stored only in browser-managed storage on your device. Except where you expressly direct a feature to use or share your coordinates, your coordinates are not transmitted to, or received by, the Company. This on-device treatment applies to precise device geolocation obtained through a browser or operating-system permission. It is separate from the general, approximate location that may be inferred from your IP address when you access the Sites, as described in Section 2.

14.3 Place-Name and Location Search

Certain applications offer a place-name or location search that transmits only the text query you type to third-party mapping and geocoding providers in order to return results. Such providers process the query under their own terms and privacy policies, for which the Company is not responsible. Your precise device geolocation is not transmitted to the Company or to such providers as part of this feature except as you expressly direct.

14.4 Games and Third-Party Platforms

Certain games are distributed through third-party messaging and distribution platforms and may include optional rewarded advertising served by third-party advertising networks. When you access a game through such a platform, the platform may make certain account or profile data, identifiers, and gameplay data available to operate the game, synchronize state, run leaderboards, and prevent abuse, and any advertising is served by third-party networks. In each case, that processing is governed by the applicable platform's and network's own terms and privacy policies, for which the Company is not responsible. Where this processing is carried out by the Company, the legal bases described in Section 4 apply, including performance of a contract and legitimate interests in service provision, synchronization, leaderboard operation, service integrity, and fraud and abuse prevention. Where the Company processes such data, the rights and request mechanisms in Section 8 apply; a request should include any identifier necessary to locate the relevant records.

A game whose canonical build is inscribed on a blockchain through an inscription protocol and which is also distributed as a mini application persists gameplay state (such as scores and in-game items) in browser-managed storage on your device. Where the game is loaded from a third-party content host, any storage created on that host's origin is outside the Company's control and is governed by that host's own practices. Virtual currency, points, and items have no monetary value, are non-transferable and non-redeemable, and confer no ownership or cash-out right.

14.5 Public Blockchain Networks

Content published to, inscribed on, or otherwise recorded on public blockchain networks or public content hosts is public, immutable, and outside the Company's control. The Company cannot modify, delete, or recall information once it has been recorded on a public blockchain network.

14.6 Artificial Intelligence Features

Certain features provide access to artificial-intelligence models, including third-party models made available through the Services, and to workspaces in which you may compose, store, and organize your own material (collectively, "AI Features"). When you submit a prompt, message, file, document, note, or other input to an AI Feature, that input and any context you attach to it (collectively, "AI Input") is transmitted to the applicable model provider in order to generate a response ("AI Output").

Model providers are third parties that process AI Input under their own terms and privacy policies, for which the Company is not responsible, and whose retention, logging, and human-review practices the Company does not control. You should not submit to an AI Feature any information you do not wish to transmit to a third-party model provider, and you should not submit credentials, payment-card or financial-account numbers, government identifiers, health information, or other sensitive information.

The Company does not sell AI Input or AI Output, and does not use AI Input or AI Output to train models the Company develops. Where an AI Feature retains your workspace, notes, or conversation history so that it remains available to you across sessions or devices, that content is retained while your account or workspace remains active and is thereafter handled in accordance with Section 10 and any deletion request you submit under Section 8. Where an AI Feature executes entirely on your device, Section 14.1 governs and the Company does not receive your content.

The Company may process limited operational metadata about AI Feature usage, such as request timestamps, request and unit counts, model identifiers, error codes, and abuse signals, for the purposes described in Section 3, including service operation, capacity management, billing where applicable, security, and abuse prevention.

14.7 Compute Contribution and Network Participation

Certain features allow you to contribute idle computing capacity from a device you control so that the device may process computational workloads on behalf of a distributed network ("Compute Contribution"). Compute Contribution is voluntary, requires your affirmative election, and may be paused or stopped by you at any time.

Where you enable Compute Contribution, the Company may collect and process technical information necessary to measure, verify, schedule, and reward that contribution, including without limitation device and hardware class; available processor, graphics, memory, and storage capacity; capability and performance benchmarks; operating-system and client-software versions; network throughput and latency; session and device identifiers; uptime and availability windows; workload assignment, completion, and verification records; and error and abuse signals (collectively, "Contribution Data"). Contribution Data is used to route workloads, verify that work was performed, calculate proportional rewards, maintain network integrity, and detect fraud and abuse, on the legal bases described in Section 4.

Workloads dispatched to your device are executed in an isolated execution environment and are not granted access to your files, documents, messages, credentials, or other personal content, and the Company does not use Compute Contribution as a means of accessing such content. Conversely, the content of a workload belongs to the party that submitted it, and you may not inspect, extract, retain, or interfere with it; see the Terms of Service.

Where a contribution, reward, or related transaction is recorded on a public blockchain network, that record is public, permanent, and outside the Company's control, as described in Section 14.5. A blockchain address you use is an identifier that may be associated with your activity, and the Company cannot modify, delete, or recall a blockchain record. Do not record on a public blockchain network any information you do not wish to be permanently public.

15. Open-Source Software and Required Attributions

The Sites and Services may incorporate third-party and open-source software components, including components licensed under copyleft licenses (such as the GNU Affero General Public License v3.0 and the GNU General Public License v3.0), which are governed exclusively by their own license terms. Where required by an applicable open-source license, the corresponding source code and required notices are made available at https://starmap.puddystudios.com/source.html.

Certain astronomical computations use open-source ephemeris software under its applicable license. As required by that license, the names Astrodienst, Dieter Koch, and Alois Treindl may not be used to endorse or promote products derived from this software without specific prior written permission.

16. Changes to This Policy

We may update this Policy at any time, in our sole discretion. Material changes will be posted on this page with a new "Last Updated" date. Where applicable law requires your affirmative consent for a material change in how we process previously collected personal information, we will obtain that consent before applying the change to such information. Your continued use of the Sites or Services after changes are posted constitutes acceptance of the updated Policy.

17. Governing Law and Disputes

This Policy is incorporated into and governed by our Terms of Service, including the binding arbitration agreement, class-action waiver, jury-trial waiver, governing-law (State of California), and venue (Los Angeles County) provisions therein, which apply to any dispute arising out of or relating to this Policy or our privacy practices to the fullest extent permitted by law.

18. Contact