Privacy Policy

Who we are

Gully Labs LLC (Oregon, USA) runs GullyStudio and is responsible for the personal data its services handle. Questions or requests about your data: [email protected].

• gullystudio.xyz, the GullyStudio site
• the developer portal at dev.gullystudio.xyz and the docs at docs.gullystudio.xyz
• the Studio Console at dev.gullystudio.xyz/console
• the Gully Game SDK (gully-labs/gully-game-sdk)
• the games GullyStudio makes and publishes

What we collect and why

• The site, portal and docs. gullystudio.xyz, the developer portal and the docs are static sites with no account, no form and no analytics of our own. To show live figures, your browser reads public data from Gully Chain’s RPC endpoints and indexer.gullychain.xyz, which we run; those requests carry your IP address, like any web request.
• Studio Console sign-in. When you sign in with Gully ID, the Console receives your Gully ID account identifier, name and picture, and tokens to call Gully services for you. The tokens stay on our server in memory, never in your browser, and end when your session ends (after 12 hours at most) or the server restarts. When you connect Gully Pay or Offers, the Console also asks Gully ID for your email address to sign you in there; it does not store it.
• Your projects. For each project the Console stores what you enter or link: the project name, its links to your Gully ID app, Gully Pay store, Offers placement, quest creator and arcade game, the repository and download links, build records (platform, status, version, commit, CI run and artifact links, duration) and a hash of the build token. They are stored on our server under your Gully ID account identifier, so only you can see them.
• Email. If you write to [email protected], we get your email address and what you send, and use them to answer you.

Cookies and browser storage

• __Host-gsc: the Studio Console session cookie (HttpOnly, Secure, SameSite=Lax). It holds a random session id, nothing else, and expires after 12 hours.
• Local storage keeps the project you last opened in the Console, and session storage caches public figures for a few minutes so pages load faster. Neither leaves your browser.
• The site, portal and docs set no cookies.

Games

Our games sign you in with Gully ID and read and write public data on Gully Chain. On-chain data (your address, scores and prizes recorded on chain, transactions) is public and permanent, and we cannot delete it. A game that collects anything more says so in the game.

Who else processes data

We do not sell personal data or share it for advertising. These providers process some of it to run the services:

• Cloudflare carries all traffic to our sites (DNS, CDN, TLS and security), so it sees your IP address and requests.
• OVHcloud hosts the servers that run the sites and the Studio Console.
• Google Fonts serves the fonts of our sites, so Google sees your IP address when your browser loads them.
• Gully services. The Console calls Gully ID (privacy policy), Gully Pay and Offers for you, with your sign-in.
• GitHub hosts the Game SDK and our public repositories; the developer portal reads public release data from it in your browser.

We may disclose data when the law requires it, to protect our users or services from fraud or abuse, or to a buyer if Gully Labs is sold, under this policy.

How long we keep it

Sessions end after 12 hours at most. Projects stay until you delete them in the Console, or until you ask us to delete them. Server logs are kept only as long as needed to run and secure the services, then deleted or overwritten. Emails are kept as long as needed to answer you.

Your rights

Wherever you live, you can ask us at [email protected] to see, correct, export or delete the personal data we hold about you, or to stop using it. You can delete a project yourself in the Console at any time. Depending on where you live (for example under the GDPR in the EU or UK, or state laws in the US such as California’s), you may have further rights, including to object, to restrict processing and to complain to your data protection authority. We cannot delete anything that is on a public blockchain.

Security, location and children

Traffic is encrypted with TLS, the Console accepts changes only from its own site with a CSRF token, and build tokens are stored only as hashes. Our servers are rented from OVHcloud, and Cloudflare processes data in many countries. The services are not meant for anyone under 18, and we do not knowingly collect data from children.

Changes and contact

When we change this policy we update the date at the top, and for a material change we say so on gullystudio.xyz before it takes effect. Gully Labs LLC, Oregon, USA. Questions, requests or complaints: [email protected].