PRIVACY NOTICE

SITE OWNER ACTION REQUIRED: Replace YOUR_PUBLIC_CONTACT_EMAIL below with a real privacy-contact email and review this notice for your actual practices BEFORE enabling registrations. This is an implementation draft, not a legal compliance certification.

Last revised: October 31, 2026. Pandesal Panic is a community entertainment project. Playing the game does not require an account or a wallet.

What we process

When you choose to register, the authentication provider (Supabase) processes your email, a secure representation of your password, security/session information, and sign-in records. The site stores your chosen player name and, only if you choose to back up, your in-game cosmetic progress. Email is not shown to other players. A wallet sign-in uses your public wallet address and signed authentication message. Connecting a wallet without signing in reveals its public address to the website during that session; no wallet keys are collected.

Why we use it

Account details are used to register and secure your account, respond to account requests, and optionally back up your game progress across devices. The game is playable without consenting to account processing. We do not offer cryptocurrency, prizes, or financial benefits for creating an account.

Storage and third parties

Website assets are delivered by Cloudflare Pages. Account authentication and cloud game saves use Supabase. Supabase's JavaScript library is served via a CDN. Network and operational logs may be processed by those providers under their own policies. Local guest progress is stored in your browser. We do not intentionally install third-party advertising trackers in this build.

Security and accuracy

Supabase handles password authentication and verification. The game never asks for seed phrases, private keys, or a transfer approval. Your cloud save is private to your account using database access rules, but game scores are player-generated and not verified against cheating.

Retention and your options

You can play without registering. Clearing your browser data removes local progress. Cloud account data persists until deletion is requested and processed, subject to legitimate retention requirements. You may request access, correction or deletion of your account data, and ask privacy questions at the contact address below. Do not send wallet recovery phrases in these requests.

Project contact

Account/privacy requests: YOUR_PUBLIC_CONTACT_EMAIL

This notice must be updated if services, jurisdictions, retention periods or data practices change.