Posted at the gate · 28 August 2026
Privacy Policy
We collect what the game needs to run and to stay fair — your wallet address, your play, and basic technical data. We do not sell any of it.
Telegram@sakurafields_supportWho is responsible for your data
Sakura Fields is operated by the Sakura Fields team, who decide how the data described here is used. This policy covers the site and the game.
For anything in it, including any request about your own data, message us on Telegram at @sakurafields_support.
We never ask for a name
There is no registration form here. You do not give us a name, a date of birth, an email address or a document to play, and we do not want them.
Your account is a wallet address that proved it can sign. Everything below is what accumulates around that address while you play.
What we collect
Account: your public wallet address, the signature that proved you control it, and the session tokens issued to your browser.
If you link X: your X user ID, handle, display name, avatar and public account signals. We never receive your X password, and we do not read your private messages.
Play: everything the game has to remember — your cards, decks, duels and results, currency balances and every ledger entry behind them, streaks, quests, seasons, referrals and leaderboard placings.
Technical: IP address, approximate location derived from it, user agent, device and browser characteristics, referring page, and timestamps of requests. This is the data anti-fraud runs on.
Payments: the on-chain transaction hash, the paying address, the amount and the item. We never see a card number, and we never hold your funds.
Support: whatever you choose to tell us when you contact us.
Why we use it, and on what basis
To run the game — sign you in, keep your collection, resolve duels, pay rewards and credit purchases. This is performance of our contract with you.
To keep it fair — detect multi-accounting, bots, exploits and fake task completions, and filter a snapshot before it is used. This is our legitimate interest, and the interest of every player who does not cheat.
To keep it working and secure — logs, error tracking, rate limiting, abuse prevention. Legitimate interest.
To understand what people play — aggregated product analytics, always at the level of the population rather than the person. Legitimate interest.
To meet legal obligations, including sanctions screening and answering lawful requests.
Where we ever rely on consent — for a non-essential cookie or an optional message — you can withdraw it as easily as you gave it.
Automated fairness checks
Anti-fraud scoring runs automatically over the technical and gameplay signals above, and it can restrict an account, hold a reward or exclude an address from a snapshot.
A decision that materially affects you is reviewable by a person. Write to us and ask; explain what happened, and we will look at the ledger with you.
Cookies and local storage
We use what the game cannot run without: a session cookie and browser storage that keeps you signed in, holds your interface preferences, and carries a referral code from the link you arrived on until the moment it is used.
We also run Google Analytics, to count visits and see which pages get used. It sets its own cookies (the _ga pair) holding a random id for your browser — that is how a return visit is counted as a return rather than as a new person — and that id is never joined to your account or to your wallet address. The one URL here that carries a credential, the bounce back from signing in with X, is stripped before Google is told about it.
We do not run advertising cookies and we do not sell data to advertisers or data brokers.
Who else sees it
Service providers who process data on our instructions and nothing else: hosting, databases, logging, error tracking and analytics. They are bound by contract and may not use your data for their own purposes.
X, if you choose to link an account — the connection is made through their OAuth flow, on their terms.
Authorities, where the law requires it, and a buyer or successor if the project is ever transferred, on the same terms as this policy.
We do not sell your personal data. There is no market in it we want to be part of.
The blockchain is public and permanent
A payment in BNB, and any future on-chain claim, is a public transaction. Your address, the amount and the time are visible to anyone, forever, and neither we nor you can delete or amend them.
Anyone who can link your address to you can therefore see that activity. That is a property of the chain, not a choice we made, and it is worth understanding before you pay from an address tied to your identity.
How long we keep it
Account and gameplay data: while the account exists, and up to 12 months afterwards so that a closed account cannot be used to reset fairness limits.
Ledger and payment records: as long as we must keep them for accounting, tax and audit — usually up to seven years — because the integrity of the ledger depends on it being complete.
Technical logs: usually up to 90 days, longer where an incident is being investigated.
After the periods above we delete the data or aggregate it so it can no longer be linked to you.
Where your data is processed
Our providers may process data outside your country, including outside the EEA and the UK.
Where they do, we rely on an adequacy decision or on standard contractual clauses with appropriate safeguards, and we ask for a copy of the relevant terms to be made available on request.
Your rights
Depending on where you live, you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interest, and ask for a portable export.
Ask us on Telegram at @sakurafields_support. Because a chat handle proves nothing about who owns an account, we will ask you to sign a short message from the wallet address in question before we act — that signature IS the identity check. We answer within one month.
If you think we have handled your data badly, please tell us first — and you also have the right to complain to your local data protection authority.
Children
The game is for adults and is not directed at children. We do not knowingly collect data from anyone under 18.
If you believe a minor is using the game, tell us and we will close the account and delete the data.
How we protect it
Encrypted transport, access limited to the people who need it, server-authoritative game logic so a client cannot invent a balance, and an idempotent double-entry ledger so no reward is ever silently written twice.
No system is perfectly secure. If a breach ever affects your data, we will notify you and the relevant authority as the law requires.
Changes to this policy
If what we collect or why changes, this page changes with it, and the date at the top moves.
A change that materially affects you will be announced in the game before it takes effect.