Privacy Policy

What We Collect

Gimoku collects minimal data necessary to operate the service:

• Your claimed echoes and witness activity
• Public Bitcoin records of echo deeds
• Your email address, only if you choose one of the email options below

No ID, ever. We don't read your location or your device's details (a place you choose to lock to an echo is the one exception, below). To stop abuse, some actions keep a one-way fingerprint of your internet address, never the address itself.

Signing In by Email

Sign-in is optional. It lets your collection follow you between phones and the home-screen app.

• We email you a 6-digit code. No passwords.
• We keep your email address so we can send you sign-in codes, plus your collection list.
• Your session is a random token in a cookie; we keep only a scrambled copy of it.
• Signing in never gives anyone power over an echo.

What We Don't Collect

• We don't sell your data
• We don't track you across the web
• We don't use advertising cookies

Witnessing by Email

If you witness an echo with your email instead of X:

• We email you a 6-digit code. Codes are sent through Resend and checked against a one-way fingerprint, never stored as plain text.
• Your email address is never shown publicly. The echo's record shows your echo's name if you own one, otherwise "a friend (by email)".
• We keep a one-way fingerprint of your email so the same address can't witness the same echo twice.
• We only keep your email address itself if you tick "Email me when it's sealed", and only to tell you that.
• A Cloudflare Turnstile check runs first to keep bots out.

Gifts

• If you accept a gift by email, we keep a one-way fingerprint of your email so you can prove the echo is yours later. Accepting also sets up your email sign-in, which keeps your email address so we can send you sign-in codes (see above). The echo's record shows the name you gave, never your email.
• If you give a gift and ask to hear back, we keep your email only until the gift is accepted, to tell you. Then we delete it.
• We keep a one-way fingerprint of your internet address to limit how many gifts can be sent.

Rari-tee Pre-orders

When you pre-order a tee we keep your email address, the echo, the tee size and that you confirmed you're an adult, so we can contact you when production starts. No money is taken at pre-order.

Moments

A Moment is a photo and a short caption locked to your echo, kept privately on Gimoku's server. The photo is scrambled on your phone before it's uploaded. Our file store only holds the scrambled file at a random address. Gimoku keeps the key to unscramble it and gives it only to the echo's owner and anyone they choose to share the Moment with.

Places

You can lock a place to your echo so it stands on the real map inside the Places world. This is always your choice, made on your echo's page. Gimoku never reads your location on its own. You can type a place and pick it from a list (no location permission at all), or tap "Use where I am right now", which asks your phone once and takes one reading. We keep the place at town level (rounded to about a kilometre) unless you tick "exact spot". It is shown publicly on the map, never on the DeedStone and never sealed on Bitcoin, and you can change or remove it any time. Place names are looked up through OpenStreetMap; the lookup goes through our server, not from your phone.

Payments

Card payments go through Stripe's checkout page. Gimoku never sees your card number. We keep a record of what was bought and how much was paid.

Phone Alerts

If you turn on alerts, we keep the address your phone gives us for alerts and which echoes to tell you about.

Bitcoin Records

Echo deeds are recorded on Bitcoin. That record is public and can never be changed — that's the point.

Contact

Questions? Reach out on X: @GimokuFounder