Legal

Sin DAG Privacy Notice (v3.6, 2026-10-22)

Not legal advice. Text version: privacy-v3.6. Replaces privacy-v3.5.

This notice explains what Sin DAG ("we") collects through sin-dag.com, its site accounts and its editor, why, and how long we keep it. Sin DAG is operated by SIN DAG LLC, an Illinois limited liability company.

1. What we collect

Site account (new in v2)

• Email address. You use it to sign up, log in, verify your account and reset your password.
• Password. We never store your password itself. We keep only a scrambled version (an argon2id hash) that cannot be turned back into your password.
• Display name for your profile, shown on your dashboard.
• Recovery phone number (optional). You only add it if you tick the consent box. We keep it encrypted in our database and show only the last 4 digits. We use it only for account recovery and security codes. We do not send any texts yet. No texts will be sent until we name an SMS provider ([SMS_VENDOR]) in this notice. You can always use email recovery instead.
• Consent and terms records. That you accepted the Terms of Use and this notice, that you confirmed you are 18 or older, and whether you agreed to the phone consent, with the exact text version and the time.
• Login and security logs. Sign-ins, sign-outs, password resets, failed login attempts, and the IP address and browser/device type (user-agent) used. We use these to keep accounts safe and stop abuse.
• Session cookie. A small, secure cookie that keeps you logged in. It is needed for the site to work. We do not use it for advertising.

Creator content and reports (same as v1)

• Account id for creators.
• Submissions: the chapters and assets you submit, with their credits, licences and AI details.
• Rights agreements: that you ticked the rights box, the exact text version and the time, linked to your account.
• Reports: the reason, the details you write, what was reported, your account id (or "signed out"), the time and, only if you give it, your email. We use that email only to reply about your report.
• Wallet addresses: only in a shortened, masked form. We treat these as personal data.
• Moderation logs: review decisions, notes and times.

Site visits, wallet features and sales (restored from the earlier site notice)

The Sale is currently closed. The sale items below describe records kept from past sales, and apply to new activity only if the Sale reopens.

• Visitor id. Your browser stores a random visitor id in localStorage under `sin-dag.visitor`. The site posts it to `/api/activity`, and the activity log keeps three timestamps for it: first seen, last seen and last open. An id last seen more than 30 days ago is removed. The Activity page shows counts only, never ids.
• IP address for rate limiting. For site visits and wallet features, the forwarded IP address is used only as an in-memory rate-limit key. It is not written into the activity log. (Account login logs are covered above.) Our host may keep its own logs.
• Wallet address reads. A connected wallet's address is sent to the site's read APIs to look up balances, NFTs and vesting claims. The server may keep that read in memory briefly. It is not written into the activity log.
• Sale agreements (past sales; new ones only if the Sale reopens). A sale agreement is an on-page signature stored by the site for that wallet. It is not a blockchain signature, is not mined onto chain 1404, and is not a verified identity check. The signed PDF can be downloaded only by that wallet or the seller. Equipment receipts can be downloaded from the sale history; personal-use withdrawals do not post a receipt. Traceability for personal use is requested by email, and Gabriel Dockter provides those records in person to verified legal entities.
• Contact form. The email window sends the message from this site, with your address as the reply address. A wallet address in that form is optional.

Crusader DAG saves

• Saved game. While you are signed in, your savegame.json, its time and play time, and up to 5 earlier copies are backed up to your account.
• Former unlock records. The Crusader DAG game sale has ended. Records from that unlock, if any, are still kept: the coin, amount, USD quote, time, transaction hash and the paying wallet address. We treat that address as personal data. A payment on Ethereum is public, and we can't change or delete it. A refund record (amount, paying address, refund transaction hash) is kept until the refund is sent, and then for 7 years. We may check a paying address against a sanctions list. This check makes no outside network call.
• Free unlock claim. For accounts made before the former unlock, we may still hold a fingerprint (hash) of the save used to claim it.

We don't load an analytics package or collect biometrics, camera and microphone permissions are off, and games on Sin DAG don't collect data from players, except the Crusader DAG save backup described above.

2. What stays on your device

• Autosave drafts stay in your browser's own storage on your device. They are not sent to us. Clearing your browser data deletes them.
• Game wallet key: kept in your browser's session storage only and cleared when you disconnect.
• Pending claim: if you start a vesting claim, your browser stores the wallet, contract, transaction hash and amount in localStorage under `sin-dag.pending-claim`. A dropped or reverted claim is cleared so you can claim again; the record blocks a duplicate send for the same wallet and contract.
• Pending purchase (past sales; new ones only if the Sale reopens): if you paid for BDAG, your browser stored the wallet, transaction hash, BDAG amount, USD amount and time under `sin-dag.pending-purchase`.
• Pending delivery (past sales; new ones only if the Sale reopens): when the seller sent BDAG, the browser stored the seller wallet, buyer, transaction hash, amount, purchase and time under `sin-dag.pending-delivery`.
• A refresh reads the public chain receipt, even with the wallet disconnected. Your browser does not keep a wallet signature that another browser could replay as a completed agreement.

3. Your account and your wallet are separate

• Logging in does not connect a wallet. Your site account is only for your identity and profile.
• Your account never signs anything and never moves crypto.
• We will never ask for your seed phrase or private key. Anyone who does is not us.

When you connect a wallet, your browser extension or wallet app shares your public wallet address with us directly. If you connect a phone wallet by QR code or WalletConnect, the connection runs through WalletConnect's relay service, operated by Reown, which handles your wallet address and connection data under its own privacy policy. We never see or ask for your private keys or seed phrase. Reown's privacy policy

• The site may ask your wallet to approve transactions or sign messages for specific actions: an `eth_sendTransaction` for a vesting claim (Vesting Contract 1 or 2), for an NFT mint, listing or purchase, or for a Sale purchase when the Sale is open, and a `personal_sign` signature when a sale agreement, a receipt or a seller ledger note is signed. The site no longer has a seller on/off switch or a pool raise. You approve each one yourself in your wallet, and confirming can move real ETH or BDAG. We never hold your keys or your coins.
• Your recovery phone is never used to approve any wallet or crypto action.

4. How we use it

To create and run your account, log you in, verify your email, help you recover your account, show your profile, review and publish chapters, keep a record of rights agreements and consents, handle reports and copyright notices, keep former Crusader DAG payment and refund records and save backups, keep the site safe, and meet legal duties.

For users in the EU or UK (lawful basis)

• Contract: we use your email, password hash, display name, session and account records to provide the account you asked for. We also keep save backups while you are signed in, and we keep any former Crusader DAG payment and refund records.
• Consent: we use your recovery phone only because you agreed. You can take back that consent at any time by removing the number. This does not affect what we did before.
• Legitimate interests: security logs, to protect accounts and the site.
• Legal obligation: records we must keep by law.

5. Sharing

• We don't sell your personal information.
• We don't share it for cross-context behavioral advertising (ads based on what you do on other sites).
• A reporter's identity is never shown to the creator they reported.
• For copyright notices, the law requires us to pass the notice to the creator and a counter-notice to the person who sent the notice. Those documents contain the sender's contact details.
• We may share data when the law requires it.

Service providers (processors)

These companies handle data for us, only to run the site:

• Vercel - hosts the website.
• Neon - runs our Postgres database (accounts, sessions, records).
• Resend - sends account emails (verification, password reset, security notices).
• [SMS_VENDOR] - will send recovery and security texts. Only once named here and live. Until then, no texts are sent and no phone numbers go to any SMS provider.
• Ethereum node providers - read public Ethereum data to confirm payments. They see the request, including the transaction hash and paying address, and may see our server's IP. No provider is configured yet, so this lookup is not sent.

California: Do Not Sell or Share

We do not sell or share your personal information, as "sell" and "share" are defined under California law (CCPA/CPRA). Because we don't, there is nothing to opt out of. If that ever changes, we will update this notice first and add a "Do Not Sell or Share My Personal Information" link.

6. How long we keep it

• Login, session and security logs (including IP and user-agent): about 90 days.
• Consent and terms-acceptance records: for the life of your account, plus 3 years after it is closed, as proof of what you agreed to. [OWNER/LAWYER to confirm] The IP address and user-agent on these records are kept only about 90 days; after that those two fields are cleared and the rest of the record is kept.
• Visitor activity log: visitor ids last seen more than 30 days ago are removed.
• Closed or deleted accounts: your personal fields (email, display name, phone, password hash) are deleted or de-identified within 30 days, except data under a legal hold.
• Reports: deleted 90 days after they are closed, unless under a legal hold.
• Other logs: 90 days.
• Save backups: until you delete them by deleting your account; conflict copies 90 days.
• Payment and refund records: 7 years, as long as tax and accounting law requires. If you delete your account, these records are kept and unlinked from your profile.
• [Lawyer/owner: set retention for rights-agreement records, published chapters and DMCA records. These may need to be kept longer as proof.]

7. Age

Sin DAG accounts are for people 18 and older. You must confirm you are 18+ when you sign up. The site is not directed to children under 13, and we don't knowingly collect personal information from them (COPPA). If you think a child has given us information, contact us and we will delete it. Crusader DAG is for players 18 and older.

8. Your rights and choices

You can:

• Access - ask what we hold about you.
• Correct - fix your details, or ask us to.
• Delete - delete your account at any time, or ask us to delete your data.
• Export - get a copy of your data in a common format.
• Remove your phone - take it off your account at any time.

Contact us at oosin429@gmail.com. We won't treat you worse for using these rights. We may need to confirm it's you first.

9. State privacy rights

• California: see "Do Not Sell or Share" above and your rights in section 8. [Lawyer: confirm whether CCPA/CPRA thresholds apply and add any required details.]
• Illinois (PIPA, 815 ILCS 530): if a security breach exposes your personal information covered by that law, we will notify you as it requires, without unreasonable delay.
• [Lawyer: add any other state sections that apply, or confirm none apply.]

10. Security

We use reasonable steps to protect your data: hashed passwords (argon2id), encrypted phone numbers, secure cookies, limits on login attempts, and email verification. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

11. Changes

Each version of this notice has a number and date. We will tell you about big changes, and may ask you to accept them again.

12. Contact

oosin429@gmail.com

[Intentionally omitted pending the owner's lawyer review: governing law, venue, arbitration and class-action waiver.]

Changelog from privacy-v3.5 (v3.6)

• Operator changed to SIN DAG LLC; nothing else changed.

Changelog from privacy-v3.4 (v3.5)

• §1, §4, §5, §6, §7: added the Crusader DAG $5 unlock (payment records, paying wallet address as personal data, public blockchain, overpayment refunds, sanctions screening), the account save backup and the free-unlock claim record; Ethereum node providers as processors. Contact email is oosin429@gmail.com. Payment and refund records are kept for 7 years. Nothing else changed.

Changelog from privacy-v3.3 (v3.4)

• §3: a phone wallet connected by QR code or WalletConnect uses WalletConnect's relay service, operated by Reown, under Reown's privacy policy. A browser extension or wallet app still shares the public address directly. Sin DAG still never sees or asks for private keys or a seed phrase.

Changelog from privacy-v3.2 (v3.3)

• §3: a connected wallet shares its public address from the browser extension or wallet app. Sin DAG does not use a third-party connection service, and it never sees or asks for private keys or a seed phrase.

Changelog from privacy-v3.1 (v3.2)

• §3: removed the seller sale on/off signature and the pool raise (both removed from the site in PR #47). Signing that remains: sale agreements, receipts and seller ledger notes.

Changelog from privacy-v3 (v3.1)

• Sale closed: added a status note to §1; marked sale agreements and the pending-purchase / pending-delivery records as past-sale records that apply to new activity only if the Sale reopens; §3 now says Sale purchases are requested only when the Sale is open, and names NFT mint, listing and purchase transactions (NFT market is live). Nothing deleted.

Changelog from privacy-v2

• Restored the earlier site Privacy text removed in PR #46: visitor id and 30-day activity log, IP-only rate limiting, wallet read APIs, the `sin-dag.pending-claim` / `pending-purchase` / `pending-delivery` localStorage records, sale agreements and contact form.
• Corrected a misstatement in v2 §3 ("We never ask you to sign anything"): the site does request `eth_sendTransaction` (vesting claims, Sale purchases) and `personal_sign` (seller switch, pool raise, agreements, receipts), each approved by you in your wallet.
• Retention: consent-record IP and user-agent cleared after ~90 days; rest of the record kept.
• Unchanged: [contact email] and [SMS_VENDOR] placeholders; governing-law/venue/arbitration/class-action omission; no home address.

Terms of Sale

Marketplace sales are executed by the SinDagMarket smart contract on BlockDAG chain 1404. They are final and can't be reversed or refunded. A fixed 5% creator royalty is paid to the NFT's creator on every sale made with the marketplace's buy function. It can't be changed. It doesn't apply to transfers or sales outside this marketplace. A creator selling their own NFT receives the full price, and on very small prices the royalty can round down to zero. Minting costs 1000 BDAG per collection and per NFT. It's paid to the marketplace operator's wallet (the wallet that deployed the contract) and is non-refundable. Gas fees are never refunded. Owning an NFT gives you the token and a personal, non-commercial licence to display it and to use it as a character where supported. Copyright in the artwork stays with its creator. An NFT's name and image can't change. Its description can be edited by its creator or its current owner, including after a sale. After an edit, the NFT's metadata is served on chain instead of from the original IPFS link. A creator can destroy an NFT only while they own it. Once someone else owns it, the creator can't destroy it unless it comes back to them by sale, transfer, or an approval that lets the creator take it. A creator can destroy a whole collection only if they own every remaining NFT in it and 32 or fewer remain. Destroyed NFTs can't be restored. Their records remain public on chain and on IPFS. Destroying a collection burns every NFT in it and removes the collection. An empty collection can be destroyed too. Minters must own the rights to what they mint. We remove infringing content from this site on valid notice. The marketplace operator can pause minting, listing and buying. Transfers, cancellations, destroys, description edits and reads keep working while paused. The operator can't move, freeze, change or destroy anyone's NFTs. The contract can't be upgraded. A sale fails if the creator's or the seller's wallet can't receive BDAG. NFTs here are digital collectibles. They are not investments, securities or currency, and we make no promise of value, resale or liquidity. You're responsible for your wallet, keys, approvals and taxes. We never ask for your seed phrase or private key. The service is provided as-is. To the extent the law allows, our liability is limited to the fees you paid us.

The marketplace operator is SIN DAG LLC. Sellers stay independent.

Sin DAG is an independent site. It is not affiliated with Blockdag.network. Sin DAG runs on the community chain. Sin DAG is operated by SIN DAG LLC, an Illinois limited liability company. These coins are sold by SIN DAG LLC, an Illinois limited liability company. Contact: oosin429@gmail.com.

Sale terms v3.

Effective October 27, 2026.

These terms apply to purchases on or after October 27, 2026.

Seller changed to SIN DAG LLC; nothing else changed.

The price is $0.001 per BDAG, his own ask, paid in ETH on Ethereum and delivered on chain 1404. The cap now is 2,000,000 BDAG ($2,000). Community BDAG is not listed on an exchange. No listing is promised. You may never be able to sell these coins. The coins may have no value. The price is inflated relative to a market that does not exist yet.

The deadline is 48 hours. Gabriel Dockter is liable to manually send the BDAG after a confirmed ETH purchase. You can request a full ETH refund if the coins aren't delivered within 48 hours. If the BDAG is not sent within 48 hours, contact support immediately.

A personal-use withdrawal has no public receipt. Traceability can be requested by email, and Gabriel Dockter gives those records in person to verified legal entities. An equipment receipt, such as a laptop or computer, can be downloaded from the sale history.

This page is not a CertiK audit and it is not a KYC'd token listing. A lawyer has not reviewed these terms. Nothing on this site is financial, legal, or tax advice. On the Sale tab, Purchase asks the connected wallet to send ETH, and the seller can send the matching BDAG. The dashboard can ask the connected wallet to claim unlocked coins on Vesting Contract 1 or Vesting Contract 2. That claim is a wallet transaction and is not the sale. Confirming those prompts can move real ETH or BDAG. This is the live site.

The community claim asks your wallet to send a transaction to Vesting Contract 1 or Vesting Contract 2. Sin DAG does not hold those coins. Vesting 3 and later stay on GK's site.

Chain data and pictures can be missing or wrong.

Questions: oosin429@gmail.com · Instagram · X. Copyright questions are on the copyright page.

Takedown requests and copyright questions go to oosin429@gmail.com · Instagram · X.

NFT artwork and project images are shown from outside hosts. Sin DAG does not claim to own those images.

The 1769 King James text is public domain in the United States; the UK Authorized Version remains a Crown privilege.