Privacy

Four things, no more. Each is either public by design or functional to a feature you chose to use.

Wallet activity

Public, on-chain

Every mission action — founding, backing, updates, releases, refunds, token launches — is a public smart-contract event on the mission chains. We index those events into our database so the board, mission pages and Mon profiles can render them. Anyone can read the same facts straight from the chain; we hold no private copy of anything.

Dōjō session

One cookie, fn_session

Signing in to the Dōjō (https://dojo.factory.ninja) sets a single functional cookie: an HMAC-signed token containing your wallet address and an expiry. No name, no email, no tracking id. It expires after 7 days, and logging out clears it immediately.

Sensei usage ledger

On-chain + our index

AI pair usage in the Dōjō is metered in $NINJA. The ledger is the chain itself plus our index of it; your remaining credits show when you sign in. It exists to meter a resource, nothing else.

Prototypes

<slug>.factory.ninja, public

Anything you deploy from the Dōjō to its subdomain is a public web page — that is the point of the prototype gate. Anyone, including our verify fetcher, can load it over HTTPS. Do not put secrets in a prototype.

• No email address is collected anywhere on the app or the Dōjō.
• The app (app.factory.ninja) sets no cookies at all.
• No analytics, fingerprinting, advertising or tracking cookies, ever.
• No data sold, shared or brokered — there is no third party to share with.
• No custody: funds never touch a Factory Ninja wallet. All money moves between your self-custody wallet and the MissionCampaign escrow contract.

The app, the landing page and the Dōjō run on Cloudflare; the mission index lives in a Cloudflare D1 database. On-chain data lives on the mission chains — Base, Base Sepolia, Robinhood Chain and Arc, mainnet and testnet. Cloudflare sees request logs as any front-end host does; we put nothing personal behind them.

The protocol currently runs on testnets. Everything you transact — stakes, backs, launches — is experimental value held by experimental contracts. Treat it as at risk from reset, re-deploy or re-key at any time. The privacy model above does not change when mainnets arrive.

Disconnect your wallet and nothing new is recorded about you; log out of the Dōjō and fn_session is gone. On-chain history is the one thing nobody can delete — including us. That is what escrow with proof means.

Questions about any of this: @factoryninjaofc on X. Changes to this page are posted here with a new effective date — we do not email anyone, because we cannot.

The other half of the deal is in the terms.