Privacy Notice

This Privacy Notice ("Notice") explains how NappyPods™ ("the Platform," "we"), owned and led by Coach Keewee, handles personal information when you use NappyPods.com and any NappyPods™ application, API, or agent surface. It is part of the Terms of Service (/legal/terms). If you do not agree with it, do not use the Platform.

Account data: your email, display name, user type, password hash, avatar, and the market you select. Profile content: listings, photos and other uploads, descriptions, reviews, and messages you send through the Platform. Transaction records: token balances and ledger entries, request holds, haggles, reservation records, and "marked" payment entries (bookkeeping lines only — see Terms §13). Communications: email subscription status and preferences, push-notification tokens, and your notification and content-filter settings. Technical data: device and browser signals, IP-derived session data, cookies and local storage needed for sign-in, security, and preferences, and product-analytics events (for example, which sections of the Discover feed are opened). Verification data (V4.39): when you verify with Gitcoin Passport, we store NO biometrics, NO identity documents, and NOT even your raw wallet address — only non-PII references (a salted one-way hash of the address, your humanity score and the threshold in force, and timestamps) returned by the scorer. Passkey data (V4.39): for sign-in with Face ID / Touch ID / device PIN, the biometric itself never leaves your device — we store only the public key, credential id, device type and last-used date for the credentials you enroll.

To run the Platform: accounts, listings, discovery, messaging, tokens, haggles, and the advertising that funds it (targeting is contextual and market-based — we do not sell your personal information). To keep it safe: moderation, fraud and abuse prevention, and security investigations. To communicate: transactional notices (bookings, safety, legal) and — only where you subscribed or opted in — newsletters, digests, and push notifications, each carrying a standard single-click opt-out. To improve: aggregated analytics about how the Platform is used.

With service providers that operate parts of the Platform under contract — hosting and cloud providers, CDNs and DNS (such as Cloudflare), email delivery (Resend or an SMTP relay), push delivery, payment processors for token purchases and platform fees, and the AI model providers configured by the operator for Coach features. For Passport verification (V4.39), the Gitcoin Scorer API receives the wallet address you submit for the one-time score check — nothing else about you; the score comes back and only its non-PII parts are stored (see §2). With other users: only what the Platform is for — your public profile, listings, and messages. With authorities: where the law requires or allows, and to protect the Platform and its users. We do not sell personal information.

As long as your account is active, plus the period needed for legitimate purposes: transaction and token ledgers are retained for bookkeeping and dispute windows; moderation and termination records are retained as long as needed to enforce the Terms (which survive closure); backups rotate on the provider schedules described in our deployment documentation. We may delete data earlier at our discretion — nothing obliges us to keep data beyond what we choose to keep (Terms §5).

In Settings you can: edit or remove profile content; manage notification categories, digest cadence, alert-sound profile, and the mature-content filter (hidden by default); unsubscribe from marketing email with one click (every marketing message carries the link, honored promptly — no later than ten business days); and disable push per device. You can close your account from the Platform; closure ends access, and data handling after closure follows §5. Where the law grants you access, correction, deletion, or portability rights, contact the support channel published in the Platform footer — we verify identity before acting and respond within the time the law requires.

We use reasonable administrative and technical safeguards — hashed credentials, rate limiting, magic-byte upload validation, and scoped authorization on private media. No service is perfectly secure; we disclose incidents affecting personal information as the law requires. The Platform is for users 18 and older (Terms §4): we do not knowingly collect data from anyone younger, and accounts found to belong to minors are terminated. The Platform operates from the United States; by using it you understand your information is processed in the US under US law.

Questions about this Notice: use the in-app support channel or the support address published in the Platform footer. Changes to this Notice are published at /legal/privacy and follow the Terms §2 change mechanics.