Privacy Policy

This Privacy Policy explains what information Misa (“we,” “us”) collects through the Service, how we use it, and the choices you have. By using the Service, you agree to the collection and use of information as described here.

We collect the following categories of information:

• Account information. When you create an account, we store your username, display name, and a hashed password. If you choose to sign in with an optional third-party provider (such as Discord), we also receive the identifier, email address, and avatar image that the provider shares with us.
• Profile content. Information you choose to add to your public profile, such as your display name, bio, links, and collectibles.
• Usage data. Technical data such as your IP address, browser type, pages visited, and timestamps, used to operate and secure the Service.
• Communications. If you contact us, we keep records of that correspondence.

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Authenticate your account and personalize your experience;
• Process purchases of digital items and manage wallet balances;
• Communicate with you about the Service;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations.

If you are located in the European Economic Area, we process your personal data on the following legal bases: performance of a contract with you (providing the Service), our legitimate interests (security, abuse prevention, and service improvement), and your consent where we ask for it. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell your personal information. We may share it in the following circumstances:

• Service providers. With vendors who help us operate the Service (hosting, database, analytics), under contractual obligations to protect your data.
• Legal requirements. When required by law, subpoena, or legal process, or to protect the rights, safety, and property of Misa, our users, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, we may transfer your information to the successor entity.

We retain your personal information only as long as necessary to provide the Service and for legitimate business or legal purposes, such as fraud prevention and record-keeping. When you delete your account, we delete or anonymize your personal data, subject to legal retention requirements.

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal information, and to object to or restrict certain processing. You may exercise these rights by contacting us at the address below. We will respond within the timeframes required by applicable law. Residents of California have the additional rights described in the CCPA/CPRA, including the right to know what personal information we collect and the right to request deletion.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, please contact us so we can delete it.

We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your information may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect your data.

We may update this Privacy Policy from time to time. We will post any changes on this page and update the “Last updated” date. Material changes will be communicated through the Service.

Questions or requests regarding this Privacy Policy can be sent to legal@misa.app.

This Privacy Policy is a template provided as a starting point. It is not legal advice. Review it with a qualified attorney to ensure it matches your actual data practices, infrastructure, and jurisdiction (including any GDPR or CCPA requirements that apply to you).