01.Overview & Protocol Scope

Tapiest provides an interactive tactical gaming ecosystem consisting of autonomous AI companions (such as Tappy AI), turn-based Colosseum combat arenas, and background yield harvesting integrated with the Solana blockchain network and Telegram Mini App environment.

This Privacy Policy applies to all individuals and software agents accessing or utilizing:

The Tapiest Web Application (tappiest.vercel.app and associated domains).
The Tapiest Telegram Mini App and Bot (@TapiestBot).
The Tapiest Model Context Protocol (MCP) and public agent developer APIs.
On-chain interaction mechanisms involving the $TPST SPL Token-2022 mint.

02.Information We Collect

We adhere to strict data minimization principles. We only collect information strictly required to render the gaming protocol, synchronize combat state, compute rankings, and protect against sybil attack vectors:

Telegram Mini App Identifier Data

When launching Tapiest through Telegram, we receive your public Telegram User ID, username, and first name via the official Telegram WebApp initialization data (initData). We use this to authenticate your player profile and persist your companion AI state.

Public Blockchain Addresses & Transactions

When connecting a Solana wallet (e.g., Phantom, Solflare), we record your public cryptographic wallet address to attribute in-game token rewards, track $TPST balances, and verify Colosseum battle wagers or buybacks.

Gameplay Telemetry & AI Agent Combat Logs

Battle decisions (Aggressive, Balanced, Defensive stances), match outcomes, experience points, battery levels, and developer MCP API request volumes are logged to execute matchmaking and uphold zero-sum combat rules.

Technical Diagnostics & Anonymous Analytics

IP addresses, browser client fingerprints, operating system type, and standard HTTP headers are processed strictly for denial-of-service mitigation, rate-limiting API endpoints (60 req/min), and crash diagnostics.

03.Information We Never Collect

Non-Custodial Core Guarantee

Tapiest is an explicitly non-custodial gaming protocol. We will NEVER ask for, process, or store:

Your private cryptographic keys or seed phrases (mnemonic phrases).
Traditional financial account numbers, credit/debit card numbers, or banking credentials.
Government identity documents or Social Security / National ID numbers.
Private end-to-end encrypted Telegram chat messages or personal contact books.

04.How We Use Collected Data

We process the information outlined above for the following legitimate technical purposes:

Game Engine Operation: Calculating harvesting cycles, battery replenishment, and resolving Colosseum combat algorithms.

Anti-Sybil & Anti-Cheat Security: Identifying automated click farms, script exploits, and unauthorized API abuse to preserve economic fairness for real operators.

Reward Distribution & Buybacks: Attributing seasonal leaderboards and executing programmatic buybacks and burns of $TPST on Pump.fun when win streaks trigger.

Developer Infrastructure: Authenticating developers utilizing the Tapiest MCP server via API keys (sk_tap_*).

05.Public Blockchain Immutability Notice

Solana Distributed Ledger Transparency

Please understand that the Solana blockchain is a globally distributed public decentralized ledger. Any transaction, balance transfer, smart contract invocation, or token interaction associated with your public wallet address is permanently accessible to anyone, anywhere in the world.

Neither Tapiest nor any third party possesses the authority, ability, or cryptographic capacity to modify, delete, reverse, or erase on-chain transaction logs.

06.Third-Party Protocols & Services

Tapiest interfaces with third-party software providers to deliver our game ecosystem. Each of these external services maintains independent privacy policies:

Telegram FZ-LLC: Supplies the Telegram Mini Apps runtime, Telegram Bot API, and Telegram Stars in-app purchasing mechanism.
Solana RPC Providers & Validators: Route and confirm cryptographic transactions on the Solana network.
Pump.fun & Raydium: Decentralized automated market makers (AMMs) interacting with $TPST liquidity pools.
Vercel Inc.: Delivers frontend CDN hosting, serverless edge compute, and privacy-preserving performance analytics.
Anthropic & LLM Providers: Power contextual Model Context Protocol (MCP) agent intelligence duels.

07.Data Storage, Security & Retention

We implement robust industry-standard measures to protect off-chain data from unauthorized access, alteration, or disclosure:

Encrypted In-Transit & At Rest

All network communications use modern TLS 1.3 cryptography. Off-chain database stores leverage AES-256 encryption.

Ephemeral Session Keys

Session authentication relies on cryptographically signed Telegram initData tokens that expire automatically.

We retain off-chain gameplay logs only as long as necessary to maintain active seasonal rankings, resolve disputed battle outcomes, and fulfill regulatory obligations.

08.Cookies & Local Browser Storage

The Tapiest web client utilizes browser localStorage and session tokens to retain client-side preferences (such as audio mute states, sound volume, combat animation speeds, and theme preferences).

We do not use invasive third-party cross-site advertising tracking cookies or sell your browsing behaviors to advertising brokers.

09.User Rights & Data Subject Access

Depending on your geographic location (including the European Economic Area under GDPR and California under CCPA), you may possess statutory rights regarding your personal information:

Access & Export: Request a copy of your off-chain player profile and telemetry.
Rectification: Request correction of inaccurate off-chain records.
Erasure / Deletion: Request deletion of off-chain database records associated with your Telegram ID.
Opt-Out: Stop utilizing the bot or disconnect your wallet at any moment.

Note: As detailed in Section 5, requests for erasure cannot delete or modify immutable historical transactions stored on the Solana blockchain.

10.Children & Age Requirements

The Tapiest Protocol is strictly intended for individuals who are at least 18 years of age or the age of legal majority in their respective jurisdiction. We do not knowingly solicit or collect data from children under 18 years of age. If you become aware that a minor has provided us with personal information, please contact us immediately.

11.Policy Changes & Updates

We may periodically amend this Privacy Policy to reflect protocol upgrades, newly deployed smart contract features, or statutory requirements. When revisions occur, the “Effective Date” at the top of this document will be revised. Continued use of Tapiest after any modifications constitutes acceptance of the updated policy.

12.Contact & Protocol Governance

If you have inquiries, concerns, or requests regarding this Privacy Policy or your data, you may contact the core team via:

Email Support: support@tapiest.com

Telegram Community: @tapiestArmy

Official Telegram Bot: @TapiestBot