What we keep, and what we never take.

Hoodly (“we”, “us”) operates the website at hoodly.fun and the proof-of-task service reachable through it. We are the controller for the personal data described here.

Reach us about anything in this policy, including any of the rights in section 10, at privacy@hoodly.fun.

We have not appointed a data protection officer, as we are not required to. Requests reach the people responsible directly at the email above.

Your identity here is a wallet address. We never ask for a name, a password, a phone number or a payment card, because none of them are needed to run the service — signing a message with an address proves who you are, and paying happens on a public blockchain.

Most of what we hold is therefore not about you as a person at all: it is about your machines and the work they report. The parts that do identify you are your wallet address, anything you voluntarily type into your profile, and the payments you make.

These are not aspirations. There is no code in the product that does any of them.

• No analytics. No Google Analytics, no Plausible, no Posthog, no pixel, no heatmap, no session recording.
• No advertising and no profiling. We do not build behavioural profiles, and we run no automated decision-making that has legal effects on you.
• No tracking cookies. We set exactly one cookie, and it is the one that keeps you signed in. See section 7.
• No third-party embeds. Fonts and images are served from our own domain, so loading a page does not tell any other company that you visited.
• No selling or sharing. We do not sell personal data, and we do not disclose it to third parties for their own purposes.
• No newsletter or marketing mail. An email address in your profile is used for service matters only.

This is the complete list, mapped to how the product works rather than summarised into vague categories.

Your account

Your profile — all optional

Company name, website, X handle, email address and timezone. You type these in yourself and can clear them at any time in dashboard settings. The company name is printed on receipts you generate, the timezone formats dates in your exports, and the email is only used to reach you about the service. Legal basis: performance of a contract, and your consent for fields you were not required to provide.

Your machines and their work

The contents of a proof, a task description or a telemetry payload are whatever you choose to send. We do not inspect them and we cannot know whether they contain personal data. If your robots handle anything sensitive, see section 5.

Payments and balances

Security

Request counters per robot, per account and per wallet address, held in one-minute windows and deleted automatically after an hour. They exist to stop runaway loops and abuse. Legal basis: legitimate interests in keeping the service available.

A proof only has to be a payload whose hash you can reproduce later. It does not have to be readable, and it does not have to contain the underlying data at all.

If your robots record anything about identifiable people — camera frames, voices, badge scans, delivery addresses — the cleanest approach is to keep that material in your own systems and submit a hash of it as the proof. Verification works exactly the same way: whoever holds the original can re-hash it and compare. The chain gets a fingerprint; nobody gets the content.

Please only put into a proof what you are comfortable having stored by us and fingerprinted publicly and permanently. Where you act as a controller for that data and we process it for you, section 8 applies.

Anchoring a proof means sending one transaction on Robinhood Chain. Its data field carries exactly this, and nothing else:

HOODLY:v1:<robot id>:<task id>:<proof hash>

So what becomes public and permanent is two random identifiers and a cryptographic hash. The proof content itself never leaves our database, and a hash cannot be reversed into the data it was made from.

Payments are also on-chain, because that is what a blockchain payment is: the transfer you make from your wallet to burn tokens or fund gas is public, as is the address it came from.

One cookie, hoodly_session. It holds an opaque random token, is marked HttpOnly so no script can read it, and expires after 30 days or when you sign out. Its only purpose is to keep you signed in between requests.

It is strictly necessary to provide a service you explicitly asked for, so no consent is required and there is no cookie banner. We set no analytics, advertising or preference cookies, and no third party sets cookies through our pages.

Signing out revokes the session server-side, so the token becomes useless even if the cookie is kept.

We use as few providers as the service allows. Each one is bound by a data processing agreement and may only act on our instructions.

These providers are established in or operated from the United States. Where personal data is transferred outside the European Economic Area, it is done on the basis of the European Commission’s Standard Contractual Clauses together with the safeguards those providers publish. Our database region determines where the data itself is stored; we will tell you the current region on request.

Beyond these, we disclose personal data only where we are legally obliged to, or where it is necessary to establish or defend legal claims.

For your own account data — your wallet address, your profile — we are the controller.

For what your robots send us, the roles usually reverse. If a proof, a task description or a telemetry payload contains personal data about your staff, your customers or anyone else, you decide what is collected and why, which makes you the controller and us your processor. In that case we process it only to run the service for you, we do not use it for our own purposes, and we will assist you with requests from the people concerned. Get in touch if you need a data processing agreement on that basis.

Please note the permanence in section 6 before instructing us to process anything that would be difficult to publish a fingerprint of.

If the GDPR applies to you, you have the following rights. Write to privacy@hoodly.fun and we will respond within one month.

• Access. A copy of what we hold about you. Much of it is already visible in the dashboard, and tasks can be exported as CSV at any time.
• Rectification. Correction of anything inaccurate. Profile fields are editable directly in settings.
• Erasure. Deletion of your account and its data. Deleting an account removes its robots, fleets, tasks, telemetry, events, sessions and activity log, because those records are tied to it. Subject to the limits below.
• Restriction and objection. You can ask us to stop processing data we rely on legitimate interests for, and we will unless we have compelling grounds that override yours.
• Portability. Your data in a machine-readable format. The API and the CSV export already provide this; ask us for anything they do not cover.
• Withdrawing consent. Where processing rests on consent, such as an optional profile field, clearing the field withdraws it. This does not affect processing that already happened.
• Complaint. You may lodge a complaint with your local data protection supervisory authority.

Two honest limits. First, we cannot erase blockchain records, for the reason in section 6. Second, we must keep the credit ledger for as long as accounting and tax law requires, even after an account is closed — so a request to erase everything will leave the payment history in place until that period expires.

• Secrets are stored as hashes. Robot API keys and session tokens are only ever kept as SHA-256 digests. Neither can be recovered from our database, which is also why a lost API key has to be rotated rather than looked up.
• No password to steal. Sign-in is a signature from your wallet, so there is no credential of yours in our database to leak or reuse elsewhere.
• Signatures cannot be replayed. Each sign-in message carries a one-time nonce that is consumed on verification.
• Encryption in transit. The site and API are served over HTTPS only; the database connection is likewise encrypted.
• Access is limited. Data is reachable only through our API routes, which check ownership on every request, and by the small number of people who operate the service.
• Rate limits and quotas. Abuse of write paths is capped, which protects both availability and the integrity of your records.

No system is perfectly secure. If a breach ever affects your personal data and poses a risk to you, we will notify the competent supervisory authority within 72 hours and inform you without undue delay.

Hoodly is a tool for operating robot fleets and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will delete it.

We will update this page when the product changes what it stores. The date at the top always reflects the current version.

If a change materially affects how we handle your personal data, we will say so prominently in the dashboard before it takes effect, and by email where you have given us one.