Policies

1. Who We Are & Scope

This Privacy Policy explains how ShadowDstudio ("ShadowDstudio," "we," "us," or "our") collects, uses, shares, and protects information in connection with shadowdstudio.xyz and every page, sub-brand, and project operated under it, including Shadow Deception, 906 Studio, SD6LAB, Good Hood ($*****) and its Upgrader, GIEME, BasedBones, and AcidShadow (collectively, the "Site" or "Services").

ShadowDstudio is currently in the process of formally incorporating. Until that process is complete, this Policy is issued by the individual(s) operating ShadowDstudio under that name; upon incorporation, the resulting legal entity will assume this Policy's obligations without any reduction in your rights under it.

We wrote this Policy to reflect what the Site actually does today, and to be upfront about features that are built but not yet switched on. Sections marked "Planned / Not Yet Active" describe functionality that exists in our codebase but is not currently reachable by visitors — we are disclosing it in advance rather than waiting for launch, and we will update this Policy again once each feature actually goes live.

2. Information We Collect Today

Information you provide

Browsing the Site does not require you to create an account or submit any personal information. If you email us at hello@shadowdstudio.xyz, we receive whatever you choose to include in that email.

Wallet & blockchain information

If you choose to connect a crypto wallet (e.g. via the Good Hood Upgrader), we read the following directly from the blockchain and from your wallet extension, with your action initiating each step:

• Your public wallet address.
• Publicly-readable on-chain data associated with that address: your $***** token balance and which Good Hood NFTs you hold (via standard, read-only smart-contract calls — we never request a transaction or spend any funds).
• A cryptographic signature ("Sign-In With Ethereum," EIP-4361) that proves you control the connected wallet. This is a free, gas-less message signature, not a blockchain transaction, and it is currently verified entirely in your browser — it is not sent to or stored on any ShadowDstudio server.

Connecting a wallet is always optional and always initiated by you clicking "Connect Wallet." We never have access to your private keys or seed phrase, and we can never move funds or assets on your behalf.

Information stored on your device

We use your browser's local storage (not traditional HTTP cookies — see our Storage & Cookie Policy for the distinction) to remember a small set of things, entirely on your own device:

• Your choice on the cookie-consent banner (accepted/declined).
• Display preferences, such as a light/dark theme selection.
• Which sections of the Site you have already visited, so a "jump to what you haven't seen yet" navigation feature can work.
• Whether you have completed wallet-ownership verification (the signature described above) during your current browser session, so you are not asked to re-sign on every page — this is cleared automatically when you disconnect, switch wallets, or close your browser tab session.

None of this device-stored information is transmitted to us; we cannot see it unless your browser sends it to our servers as part of a normal page request.

Automatically collected technical information

Like virtually every website, our hosting and content-delivery infrastructure automatically logs standard request metadata for security, abuse-prevention, and reliability purposes — for example, IP address, browser/device type, referring page, and timestamps. We do not currently layer any analytics, advertising, or behavioral-tracking product on top of these baseline infrastructure logs (see Section 6).

NFT metadata requests

If you hold a Good Hood NFT and open the "Your Cards" view, your browser fetches that NFT's metadata and image directly from IPFS or other public gateways referenced by the token itself, so those third-party gateways receive a request for that content. We do not operate those gateways and do not receive a copy of that request.

3. Planned Features & the Information They Will Collect

The following features are built into our systems but are not yet active on the live Site. We are describing them now, before launch, so you know what to expect. This Policy will be updated with a new effective date whenever any of these actually go live.

Account registration (planned)

A registration flow will let you create an account with a username and password, and optionally an email address. If you provide an email, we will send a one-time verification code to confirm it, using a third-party transactional email provider. Passwords will be stored using encryption, never in plain text.

Marketing preferences (planned)

Registration will include an optional "Subscribe to News & Updates" checkbox. We will only send you marketing communications if you affirmatively opt in, and you will be able to withdraw that consent at any time.

Abuse prevention (planned)

To prevent spam and abuse of the email-verification system, we will rate-limit signup attempts using your IP address. This data is used solely for that security purpose and is not used to build a profile of you.

Linked wallets & social accounts (planned)

If you choose to link a wallet address or a social-media account to a registered account, that link will be stored in encrypted form, referenced internally by a one-way cryptographic identifier rather than your plain account ID, as an extra layer of protection for that data at rest.

Mint & reward tracking (planned — Good Hood / $*****)

As described on the Upgrader page, pre-token rewards are calculated from on-chain, blockchain-snapshot data: the number of cards you minted, your entry timing, secondary-market activity involving your cards, and verified holdings of partner-project NFTs. This calculation reads public blockchain data; it does not require you to submit anything beyond connecting your wallet.

Community polls (planned)

Occasional community polls (for example, "should we launch a Discord?") will record an anonymous vote count only — no identifying information is attached to your vote.

Bot & abuse protection (planned)

We plan to add a privacy-preserving bot-detection challenge (Cloudflare Turnstile) to our registration flow. This may involve Cloudflare processing limited technical signals from your browser to distinguish humans from bots, without the tracking cookies or puzzles used by traditional CAPTCHAs.

Third-party wallet-connection relay (planned)

We plan to add WalletConnect as an additional way to connect mobile wallets. When active, establishing that connection routes through WalletConnect's (Reown's) relay infrastructure, which is operated by a third party and governed by its own privacy policy.

Third-party NFT indexing (planned)

We plan to replace our current direct-from-blockchain NFT lookup with a third-party NFT-indexing API (such as Alchemy or Moralis) for speed and reliability. Once active, your connected wallet address will be sent to that provider so it can return your NFT holdings to us.

4. How We Use Information

We use the information described above to:

• Operate, maintain, and secure the Site and its features (e.g. displaying your NFTs, verifying wallet ownership).
• Calculate Good Hood pre-token rewards based on on-chain activity, once that program is live.
• Prevent fraud, abuse, and unauthorized access (e.g. signup rate-limiting, bot detection).
• Communicate with you when you contact us, and — only with your opt-in consent — send marketing updates.
• Comply with applicable law and enforce our Terms of Service.
• Improve and develop the Site and future features.

5. Legal Bases for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases for each type of processing:

• Consent — for the cookie-consent choice you make, and for any future marketing communications.
• Performance of a contract — for account creation and features you specifically request, once those features are active (e.g. wallet linking).
• Legitimate interests — for baseline security logging, fraud/abuse prevention, and improving the Site, balanced against your rights and expectations.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

You can withdraw consent-based processing at any time without affecting the lawfulness of processing carried out before that withdrawal — see Section 10.

6. Cookies & Similar Technologies

Our use of local browser storage is described in full in our separate Storage & Cookie Policy, which forms part of this Privacy Policy by reference. In short: we do not currently use any analytics, advertising, or third-party tracking technology, only storage that is strictly necessary for the Site to function or that provides a feature you directly use.

7. How We Share Information

We do not sell your personal information, and we have not sold or shared any personal information for cross-context behavioral advertising in the preceding 12 months. We disclose information only in the following circumstances:

• Service providers who process data on our behalf under contract — for example, a transactional email provider for OTP delivery, once that feature is active (see Section 3).
• Public blockchains — your wallet address and any on-chain transactions you make are, by the nature of public blockchain networks, visible to anyone; this is inherent to how blockchains work and is not something ShadowDstudio controls or can reverse (see Section 8).
• Legal or safety reasons — if required by law, legal process, or to protect the rights, property, or safety of ShadowDstudio, our users, or the public.
• Business transfers — if ShadowDstudio is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to the same protections described here.
• With your direction — whenever you affirmatively choose to share information (e.g. linking a social account once that feature is active).

8. Public Nature of Blockchain Data

Blockchains are public, distributed, and permanent by design. Once information is recorded on a public blockchain (such as your wallet address, the NFTs it holds, or any transaction it makes), it cannot be altered or deleted by us, by you, or by anyone else. Please consider this before connecting a wallet or interacting with any on-chain feature — rights such as erasure and rectification described in Section 11 cannot be applied to data that is recorded directly on a public blockchain, only to the data we separately hold about you off-chain.

9. International Data Transfers

We and our service providers may process information in countries other than the one in which you reside, including the United States. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on recognized safeguards such as Standard Contractual Clauses, or transfer to jurisdictions recognized as providing adequate protection, as required by applicable law.

10. Data Retention

We keep information only as long as needed for the purposes described in this Policy, or as required by law:

• Locally-stored preferences (Section 2) persist on your device until you clear your browser storage or, for the wallet-verification flag, until you disconnect or your browser session ends.
• Account, email-verification, and rate-limiting data (once those features are active) are retained only as long as your account remains active, plus a limited period afterward for security and legal purposes, after which they are deleted or anonymized.
• Encrypted wallet/social links (once active) are retained until you unlink them or close your account.

11. Your Rights

If you are in the EEA, UK, or Switzerland

You have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; restrict or object to certain processing; receive a copy of your data in a portable format; withdraw consent at any time where processing is based on consent; and lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, contact us at hello@shadowdstudio.xyz.

If you are a California resident (CCPA/CPRA)

You have the right to: know what personal information we collect, use, disclose, and (if applicable) sell or share; request deletion of your personal information; request correction of inaccurate personal information; opt out of the sale or sharing of personal information and the use of sensitive personal information beyond what is necessary to provide the Site; and not be discriminated against for exercising any of these rights.

ShadowDstudio does not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of today; if that changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism here and honor opt-out preference signals (such as the Global Privacy Control) as required by law. You may also designate an authorized agent to submit a request on your behalf, and you may appeal a denied request by contacting us at hello@shadowdstudio.xyz.

All other users

Regardless of where you are located, you may contact us at any time to ask what information we hold about you, to request its correction or deletion, or to ask any question about how we handle your data, and we will respond in good faith.

12. Children's Privacy

The Site is intended for users who are at least 18 years old, consistent with our Terms of Service, in part because certain current and planned features involve connecting a crypto wallet and digital assets of real monetary value. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at hello@shadowdstudio.xyz and we will take appropriate steps to delete it.

13. Security

We apply reasonable technical and organizational safeguards appropriate to the sensitivity of the information involved — for example, encrypting sensitive account data (such as passwords and linked wallet/social identifiers, once those features are active) at rest. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; you are responsible for keeping your own wallet credentials, private keys, and any account password confidential.

14. Third-Party Links & Services

The Site links to and integrates with third-party services we do not control, including wallet extensions (e.g. MetaMask), NFT marketplaces (e.g. OpenSea), social platforms (e.g. X/Twitter, Discord), and blockchain infrastructure providers. Any information you provide to those third parties is governed by their own privacy policies, not this one.

15. Changes to This Policy

We may update this Policy from time to time, particularly as the planned features described in Section 3 go live. We will update the "Effective Date" above and, for material changes, provide a more prominent notice on the Site.

16. Contact Us

Questions, requests, or complaints about this Privacy Policy or our data practices can be sent to hello@shadowdstudio.xyz.