The short version
AI vs Human has no accounts beyond your Solana wallet, no email sign-up and no advertising. It never asks for your name, email address or phone number. It learns your wallet's public address, which is already public on the Solana blockchain, and the IP address your requests come from: the game uses it to limit abuse (see Rate-limit data below), and our hosting provider logs it (see Where it is stored). There are no third-party analytics, tracking cookies or ad networks in the game.
What we store, and why
- Your wallet's public address, when you sign in. You prove the wallet is yours by signing a one-time message in your wallet; signing it sends nothing from your wallet and costs nothing. Your address is how the game finds your characters, purchases and skins.
- Your session. Signing in sets one cookie,
avh_session: it is httpOnly (no script on the page can read it), lasts 30 days or until you sign out, and only keeps you signed in. Our database stores a SHA-256 hash of its token, never the token itself, with your wallet address and when it expires. - Your game. Your characters (team, role, dimension values and unlocked roles), your daily energy, your in-game token balance, your contributions to each daily fight and what they earned, season awards, the skins you own and the one each character equips, and the Seeker Tasks you completed. Teammates see your character under a generated name, never your wallet address.
- Payment records. For each SOL order: its purchase id (
p_…), what it buys, its price in SOL, its status and the time it must be paid by; and the signature of the Solana transaction that paid it. We also record the outcome of every transaction we check, with its signature (granted, recorded for a refund, or refused, with the reason), including transactions to the game's treasury that name no order of ours; and the signature of the newest treasury transaction we have checked, so the next check starts from it. Transaction signatures are public on the Solana blockchain. We keep these to grant what you paid for, to stop a payment being counted twice, and to handle refunds. - Rate-limit data. To stop abuse, the server counts requests per minute by IP address (an IPv6 address by its /64 network), by IP address and wallet address together, and by wallet address. Each counter lasts its one-minute window; expired counters are deleted by later routine clean-ups, so one may stay stored for a while after it has expired. A sign-in message also records the IP address that asked for it; it expires after 5 minutes and is deleted the same way.
On your device
The game keeps a few entries in your browser's local storage. They never leave your device unless noted:
avh.guideSeen: that you have seen the How to play guide.avh.signedInWith: which wallet app you signed in with (Phantom, or the Seeker Wallet) and its address, to show the right icon. Removed when you sign out.avh.pendingPayments.<wallet>: a payment you started and the game hasn't seen settle yet (its purchase id and, once your wallet answers, the transaction signature), so a reload or a closed tab never loses one. The game sends the purchase id and signature back to our server to confirm the payment; the entry is removed once the payment is settled, and dropped after 7 days.avh.refunds.<wallet>: the purchase id of a payment that went through but couldn't be applied, so you can give it to support for a refund. It stays in this browser until you dismiss it.avh.skinSeen.<character>: the highest avatar look you have already seen, so a new one is celebrated once.
The AI vs Human app for Solana Seeker also keeps your wallet app's authorization and your address in the phone's secure storage (the Android Keystore), so it can reconnect without asking again. It is cleared when you sign out or switch wallets.
Where it is stored
- Supabase hosts the game's Postgres database, which holds everything listed under “What we store”. Only the game's server and its operator can read it.
- Vercel hosts the website and its server. Like any web host it keeps request logs (your IP address, the page or API asked for, the time, your browser's user agent) for a limited period, and our server's error messages, which can include a transaction signature.
- A Solana RPC provider answers the server's questions about the blockchain (for example, whether your payment's transaction landed). Your wallet app sends your transactions through its own provider, under its own privacy policy.
What we do not do
- We do not sell or rent your data, or share it with advertisers.
- We do not use third-party analytics, tracking cookies or advertising SDKs, and the game loads no fonts or scripts from other sites.
- We never see or hold your private keys. Every payment is approved by you, in your own wallet.
On-chain payments are public
A SOL payment is a Solana transaction from your wallet to the game's treasury wallet. So the game can match it to your order, the transfer also lists a reference: a random public key made for that one order, which holds no personal data and nobody controls (the Solana Pay standard). Like every Solana transaction, its sender, amount, reference and time are public on the blockchain, and nobody, including us, can change or delete it.
Keeping and deleting
Game data and payment records are kept while the game runs; payment records are also kept as long as we need them to handle refunds and keep accounts. To have the game data stored under your wallet address removed, email us from the contact below with the address; we may ask you to show you control it (for example, by signing a message). Records on the Solana blockchain can't be deleted by anyone.
Children
AI vs Human is not directed at children under 13, and we do not knowingly collect data from them. Payments need a Solana wallet, and the Terms of Service require buyers to be adults.
Changes
If this policy changes, the new version will be posted here with a new date. Wk.t202 is responsible for the data described above.
Questions, refunds or requests: wk.t202@gmail.com.