Privacy notice — Oddi Forge

What we collect

Waitlist and account. When you join we store your email address, the date you signed up, your permanent Forger number, whether you confirmed your email, your email preferences (and when and where you agreed to update emails), a random referral code and, if a friend invited you, their referral code. We only send update emails if you ticked the box for them.

Login. When you log in we set one cookie that keeps you logged in for up to 30 days. It is strictly necessary for your account to work. We store only a scrambled (hashed) version of it, and of every login link we email you.

Site improvement. To learn which version of a page works better, your browser stores a random visitor ID and the page version you were shown. We record anonymous events with that ID: page view, waitlist signup and share button clicks, together with the website or campaign that first brought you here (a domain or campaign name only). We never link these events to your email address.

Update emails. If you agreed to updates, you receive a short series of emails after you confirm (for example a welcome email). To learn which version of an email works better, we record which version you received, whether you clicked its button, and whether a friend joined with your link in the week after. We do not track whether you open our emails. Clicks are forgotten after 12 months.

Rewards. If you take part in the rewards program, we store your points: daily check-ins, the tasks you claimed and adjustments by the team. If you add a Solana wallet address, we store it so rewards can be sent to it. It is a public address only: we never ask for keys or your recovery phrase. You can remove it in your account at any time.

Support chat. When you use the chat we store your messages, our replies and, if you give them, your name and email address. If you are logged in, we take your email address (and your forum name, if you have one) from your account instead of asking. Your browser keeps a random code so you can continue the conversation. If we have your email, we also send our replies there.

Telegram. In our Telegram group our bot checks messages for scams: messages with outside links, wallet addresses or offers of "support" by private message are removed automatically, and we log the reason and your Telegram user ID for 90 days. When you mention the bot, reply to it or message it privately, our AI agent reads that message to answer it, and we keep the message and the answer like a support conversation. Telegram itself processes everything you send there under its own privacy policy.

Comments on the blog. When you comment under a post we publish the name you give and your comment, and store the date. If you are logged in, the comment is linked to your account. We do not store an email address with a comment. If you leave your email to join the waitlist and get replies, we send you a confirmation email and remember that you follow that post. Only after you click that email are you on the waitlist, and only then do we email you when someone comments on it, at most once every six hours. Every such email has a link to stop them.

Notifications. If you turn on notifications in your account or in the app, your browser gives us a push subscription: a web address at your browser maker's push service (for example Google, Apple, Mozilla or Microsoft) and two keys that let only your device read our messages. We store that for each device, with the date you turned it on and when we last sent to it, and your choices (a friend joined with your link, the daily check-in reminder). We use it only to send those notifications; the message itself travels through your browser maker's push service. You can turn notifications off in Settings in your account, per device, or in your browser's settings; logging out turns them off on that device. Everything is deleted with your account, and a device the push service reports as gone is removed automatically.

We do not store your IP address and use no third-party analytics or advertising trackers.

Why

We use your email to confirm your signup, send login links, and, if you agreed, contact you about the $ODDI launch and major project updates (GDPR art. 6(1)(a) and (b)). The anonymous events are used only to improve this website, based on our legitimate interest (art. 6(1)(f)), and are deleted after 12 months. Notifications are sent only to devices where you turned them on yourself (your consent, art. 6(1)(a)).

Where and how long

Your data is stored on our own server and is never sold. Emails are sent through our email provider (Hostinger), and the text of messages our AI agents answer is processed by Anthropic. Backups (encrypted at rest at our storage provider, Cloudflare) are kept for up to 30 days.

How long we keep what:

Your account (email, Forger number, referrals, points, wallet address): until you delete your account. Deleting it removes it at once, including the emails we logged for your address; your forum posts and comments stay in place as "removed".
Notification subscriptions and choices: until you turn notifications off on that device, log out there or delete your account.
Your consent to update emails: we record when and where you gave it (the signup form, a blog comment or your account settings), for as long as we keep your account.
Support chats: closed conversations are deleted 12 months after the last message. The link that reopens a chat stops working after 90 days without activity.
Replies our AI agents drafted: 90 days after the decision we delete your original question and your address from the draft.
Emails we sent you (the log of what went out) and anonymous site events: 12 months.
Emails to our team mailbox that the AI agents handled: the note of which ones were handled is deleted after 30 days.
Our audit log of changes made by the team: 24 months.

You can ask us to delete any of this sooner at any time.

AI assistance

Oddi Forge is run with help from AI agents (see Team). Our AI agent Brigid answers support chats, emails, forum posts and comments, and her replies are always labelled as coming from an AI agent. Before anything is sent, it is checked against fixed rules and by a second AI agent; questions about money, legal matters, privacy or security go to a person. The founder stays responsible for what we send, and the agents never ask you for wallet keys or recovery phrases. To answer, the agents' AI provider (Anthropic) processes the text of your message.

Your rights

In your account you can turn off update emails and permanently delete your account at any time. You can also request access to, correction of or deletion of your data through our contact form (choose "Privacy or data request"). You may lodge a complaint with your data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).