Privacy Policy

This Privacy Policy explains how the operator of Tessera (“Tessera”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Service. It forms part of, and should be read with, our Terms of Service and Cookie Policy. By using the Service you acknowledge this Policy.

For the personal data we process to run the Service, the Operator acts as the data controller. When a raffle creator (“Creator”) accesses or exports entrant data to run their own raffle, the Creator is an independent controller of that data and responsible for it (see Section 05).

We collect only what we need to operate the Service:

• Discord account data (when you sign in or link Discord): your Discord user ID, username, avatar, and related profile data Discord returns, plus, for eligibility checks, your membership and roles in relevant Discord servers.
• X / Twitter account data (when you link X): your X user ID and handle and related profile data, plus signals used for eligibility checks (e.g. follow / repost / verification status, follower and account-age signals). Some checks are performed via a third-party social-data provider and may be cached.
• Email address, if you provide it or a provider returns it.
• Wallet data: the public wallet address(es) you choose to link (EVM and/or Solana) and the associated chain identifier and link time. We collect these only when you verify ownership by signing a message — we never receive private keys and never custody funds.
• Reputation / verification signals from third-party providers where a Raffle requires them.
• Activity data: raffles you create or enter, entries and any multipliers, wins, and team memberships.
• Preferences: your notification opt-in choice and onboarding state.
• Technical data: authentication/session tokens and cookies (see our Cookie Policy), and limited log, device, and IP data processed by our hosting provider for security, abuse-prevention, and operation.

We do not intentionally collect special-category (sensitive) personal data, and we ask that you not submit it.

We use personal data to:

• provide, operate, and maintain the Service and your account;
• authenticate you and keep you signed in;
• verify Raffle eligibility (Discord roles/membership, X actions, wallet ownership, reputation signals);
• run draws and record and display entries and winners;
• post Raffles and winner announcements to Discord, and send you Discord notifications you have opted into;
• detect, prevent, and investigate fraud, botting, multi-accounting, abuse, and security incidents;
• comply with legal obligations and enforce our Terms;
• maintain and improve the Service.

Where data-protection laws such as the GDPR or UK GDPR apply, we rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure the Service and prevent fraud/abuse, balanced against your rights); consent (e.g. for optional notifications and non-essential cookies, where required); and legal obligation (to comply with law). You may withdraw consent at any time where consent is the basis.

We also share data as follows:

• Public display. Your username and avatar, and the fact that you entered or won, may be shown publicly on Raffle pages, in Discord posts, and in winner announcements. (We do not publish your Discord ID or X handle in public site listings, but a winning entry may mention or DM you on Discord, and Creators can see this data via export.)
• Service providers / processors. Hosting and infrastructure; Discord and X/Twitter (including a social-data provider used for verification); and wallet and verification providers — each only to provide the Service.
• Legal & safety. When required by law, legal process, or to protect the rights, property, or safety of Tessera, our users, or the public, or to prevent fraud or abuse.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell your personal data, and we do not use it for third-party advertising or cross-site tracking.

We use strictly-necessary cookies for sign-in, security, and remembering your onboarding state — not for advertising or cross-site tracking. For details and the full list, see our Cookie Policy.

We keep personal data for as long as your account is active and as needed for the purposes in this Policy, then delete or anonymise it, unless a longer period is required or permitted by law. Some records are retained longer where necessary — for example, winner and entry records for the integrity of past draws, and limited logs for security and fraud-prevention. Cached third-party verification signals expire automatically. Note that data already exported by a Creator, or already posted to Discord or X, is outside our systems (see Section 10).

We use reasonable technical and organisational measures to protect personal data, including scoped access controls and signed, HTTP-only session cookies. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and your wallet keys; we will never ask for your private keys or seed phrase.

Depending on your jurisdiction (e.g. under the GDPR/UK GDPR or US state laws such as the CCPA/CPRA), you may have rights to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• port a copy of certain data;
• object to or restrict certain processing, and withdraw consent;
• not receive discriminatory treatment for exercising these rights.

You can manage much of this in the Service: unlink Discord, X, or a wallet; toggle notifications; and delete your account from your profile settings. To exercise other rights, contact us at yvngxruddy@gmail.com. We may need to verify your identity and may decline requests as permitted by law. You may also have the right to complain to your local data-protection authority.

When you delete your Tessera account, we remove or anonymise your account data, subject to the retention exceptions in Section 07. We cannot, however, retrieve or delete: data a Creator has already exported (you must contact the Creator); content already posted to Discord or X (you must use those platforms’ controls); or anything recorded on a public blockchain, which is outside anyone’s control.

We and our service providers may process data in countries other than yours, whose laws may differ. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers. By using the Service, you understand your data may be processed in those locations.

The Service is not directed to, and may not be used by, anyone under 18 (or under the age of majority in their jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acknowledgement of the updated Policy.

For privacy questions or to exercise your rights, contact us at yvngxruddy@gmail.com.