Who this policy covers
Plemu Labs LLC, a Wyoming limited liability company, is responsible for personal information it processes in operating the Plemu website and landing pages, web application, Seeker/Android application, related support and Plemu-operated blockchain interfaces. Contact support@plemu.xyz for privacy questions and requests. This policy covers those Services, including their current demonstrations and Devnet beta. Business correspondence address: 30 N. Gould St., Suite R, Sheridan, WY 82801, United States.
Our technology-provider role does not mean that no personal information is processed. IP addresses, public wallet addresses, transaction histories, device information and correspondence can be personal information. Independent wallets, RPC providers, validators, explorers and other services are responsible for their own processing; this policy does not make Plemu the operator of every component of a permissionless network.
This policy explains processing; it is not consent obtained merely by visiting a page or connecting a wallet. Optional permissions and consent, where required, must be requested for the relevant purpose. The terms of service are available at https://plemu.xyz/toc.
Information and where it comes from
You provide information when selecting local files, saving preferences or drafts, connecting a wallet, approving a transaction or contacting support. Local files do not automatically become information held on Plemu’s servers. The sections below distinguish information kept on your device from information sent over a network.
Network requests disclose connection information to their recipients, such as IP address, request time, requested address, browser or app headers, device/browser characteristics and error or security information. Our hosting and infrastructure providers can process this information to deliver and secure the website and related services. Public HTTP and DNS checks identify Vercel as the current website host; actual account log settings and contractual transfer arrangements require deployment-specific verification.
When you connect a wallet or use an onchain feature, information can include a public wallet address, wallet/provider selection, authorization state, balances, holdings, signed challenges, transaction messages, public signatures, receipts, quotes and transaction status. Public blockchain records and provider responses are additional sources. Support messages can include your email address and anything you choose to send.
Website and web app storage
The public landing page does not use analytics or browser preference storage. The Devnet web app can remember saved catalog favorites, sound/motion preferences and your selected wallet only after you choose Allow saved preferences. Until then, those controls work in memory for the session. Existing optional records are not read or migrated before opt-in. The current local creator draft is session-only; downloading its JSON creates a file on your device and does not publish it or upload a game.
Privacy choices in the footer lets you enable or withdraw optional saving. Turning it off removes Plemu’s specifically named optional browser records and prevents later writes; it does not clear unrelated site data or essential transaction-recovery records. Legacy demonstration records and older third-party wallet records can also be removed through browser site-data controls. Withdrawal does not require you to stop browsing, local gameplay or explicit wallet access.
The site separately stores a minimal privacy-choice record and a terms-version/time acknowledgment so it can apply your choices. These records are distinct from optional persistence and are not advertising consent. If storage is unavailable, optional saving stays disabled and terms acknowledgment can remain in memory for the session. The current wallet connection is requested explicitly; the web mobile-wallet authorization cache is memory-only and does not persist wallet authorization tokens in browser storage. Remembering a selected wallet does not authorize automatic connection or a new signature.
Browser game imports use only files you explicitly select. Imported game bytes are held in the current tab and passed to an isolated local player; they are not uploaded. Curated bundled games and player files are downloaded from the app’s own host. The player has no access to the parent app’s wallet or browser storage. Player persistence and multiplayer/network play are disabled in this integration. Supported saves are imported or downloaded explicitly, rather than synchronized to Plemu servers.
Before submitting a wallet-signed Devnet transaction, the web app saves and reads back the exact signed bytes, public wallet address, signature, operation type and expiry metadata in a local recovery record. One unresolved record per wallet prevents accidental replacement by another request. This record is necessary for the requested operation and is separate from optional preferences; turning optional saving off does not delete it. Confirmed, failed or expired operations can be cleared by the status-check flow, and clearing site data removes the local copy. Signed bytes are not private keys, but anyone receiving valid bytes may submit that transaction before it expires.
Camera and device permissions
The current public landing page and Devnet web app do not request camera or microphone access. Local imports use a file picker only after you select Import a game. Fullscreen, gamepad and audio behavior depend on browser capabilities and your explicit player actions.
Earlier Pixel Mirror demonstrations processed video frames locally after a separate camera permission and did not upload or retain them on Plemu servers. Any permission retained from an earlier version can be revoked in browser or operating-system settings. A future feature requiring a new device permission must request it separately.
Seeker app: files, saves and local preferences
Imported ROMs, save states, recovery copies, favorites, library/recent-game metadata, preferences, local access records and transaction-recovery records are stored in the app’s private storage. Imports use Android’s document picker for the files you select. The current app does not upload imported ROM files or save states, provide cloud-save synchronization or enable Android app backup.
Clearing app storage through Android Settings or uninstalling removes the app’s local data, including its copies of games, saves and recovery data. Files originally selected from another folder remain in that original location. Different beta/private packages have separate app storage. Keep important lawful backups before clearing storage or changing devices.
Seeker app: wallet authorization and recovery
A separate compatible wallet handles Mobile Wallet Adapter authorization and signing. Plemu does not request or store your seed phrase or wallet private key. The app can remember its wallet connection across launches: the authorization token is encrypted using Android Keystore and stored in app-private no-backup storage; the public account address and selected Android wallet package are remembered separately.
Restoring a saved session does not itself open an approval prompt or authorize a new transaction. The account is remembered until a user-initiated action checks authorization. Disconnect & forget removes the app’s saved connection. If secure authorization storage is unavailable, the app uses a volatile session instead of persisting the token in plaintext. The wallet provider retains and handles its own records and permissions.
A bounded local recovery journal can contain public signatures, status, signed transaction messages and expiry information for interrupted operations. This journal is distinct from private keys and authorization secrets. For supported trades the app verifies and submits wallet-signed transaction bytes to its configured RPC; other supported actions can use wallet-managed submission. Signed bytes sent to a provider, including for simulation, can expose transaction information and may be broadcast by that provider.
RPC requests and public blockchain records
Market, balance, ownership, history and transaction checks send relevant public addresses, account identifiers, signatures and request data to the configured Solana RPC provider. Market screens may request public data even without a connected wallet. The provider receives connection information, including IP address, and can correlate requests. RPC endpoints can vary by product or deployment; the current beta uses Devnet.
Approved transactions and program activity can publish wallet addresses, holdings, transfers, token and access receipts, pack requests and rewards, randomness results, market fills, fees and burn events. Anyone can inspect, copy, index or combine public records, including linking them to information outside Plemu. A pseudonymous wallet is not necessarily anonymous.
Plemu cannot rewrite independent public blockchain history or ensure that validators, explorers, indexers and other recipients delete their copies. Clearing app data, disconnecting a wallet or making a request to Plemu does not erase those copies. Devnet may reset, but that is not a privacy deletion mechanism or guarantee. These technical limits do not remove our duties or your legal rights concerning processing under our control. Avoid putting names, contact details, secrets or other unnecessary personal information into public transaction fields.
Price references and external services
To display indicative USD figures, the Seeker app may automatically request the public SOL-USD ticker from Coinbase at api.exchange.coinbase.com without a connected wallet. That request includes ordinary HTTP connection information and app headers. The ticker request does not attach a wallet address, transaction, ROM/save content or account login. The app uses a short in-memory quote cache and falls back when a reference is unavailable.
The current website build serves its typefaces, including the wallet-interface font, with the website. The wallet library’s previous automatic Google Fonts import has been removed. Independent wallet extensions or apps and external links can still make their own network requests under their own practices.
External author, source-code, explorer, faucet, wallet-install and other links open services with their own practices. Explorer links can include a public address or transaction signature. Wallet authorization may display app identity or a logo from Plemu’s website, causing a normal network request. Content and software download requests, where offered, also disclose request and connection information to the relevant host.
Support and diagnostics
If you email support@plemu.xyz, we receive the address, message, attachments and technical details you provide. Send only what is necessary; never send a seed phrase, private key, full authorization token or unnecessary identity document. Public transaction details may help investigate an issue, but can also link your email identity to a wallet.
The Seeker app’s Copy diagnostics action copies basic app/build, device model, operating-system, graphics, screen and network-label details to the clipboard. That generated text excludes imported game names, file paths, wallet addresses, signatures and RPC credentials. Copying does not automatically send it to support; you decide where to paste it. Other information or screenshots you choose to send may contain additional personal data.
The reviewed app and web source do not include an advertising network, cross-site advertising tracker or automatic user crash-upload service. This does not mean there are no infrastructure access/security logs, provider records or local development logs. Any added analytics, automatic diagnostics, account, cloud-save or upload feature requires an updated notice and any permissions required before it starts.
Purposes and legal bases
We process information to deliver requested pages and features, maintain settings and drafts, connect wallets, show public account information, facilitate user-authorized protocol interactions, recover interrupted actions, respond to support, prevent abuse, maintain security and meet applicable legal obligations. We do not use wallet connection as customer KYC or ask for identity documents for financial onboarding.
Where GDPR, UK GDPR or similar lawful-basis requirements apply, processing necessary for a service you request can rely on performance of the relevant contract or steps you request before it. Proportionate security, troubleshooting and support administration can rely on legitimate interests in operating and protecting the Services, subject to your rights and the required balancing assessment. Processing required by a specific applicable law relies on that legal obligation.
Optional camera access and nonessential storage or other optional processing rely on consent where required. You can withdraw consent for future processing without affecting processing already lawfully performed. Declining an optional permission may disable that feature, rather than prevent unrelated browsing or local gameplay. We do not rely on these terms or this notice as a general consent.
Recipients and disclosure
Information can be received by hosting, delivery, infrastructure and support/email providers needed to operate the Services; the wallet, RPC, price or content provider used for a feature; and the public when you interact with a public blockchain. A provider acting on our instructions should receive information limited to its service and be bound by appropriate obligations. A provider acting independently applies its own privacy notice.
We may disclose information where legally required, to respond to valid legal process, protect rights and security, or investigate abuse, subject to applicable law and proportionality. A corporate transaction can require limited disclosure with appropriate protections and notice where required; it does not authorize unrestricted new uses of your information.
Plemu does not sell personal information or share it for cross-context behavioral advertising in the described Services, and does not use camera frames for advertising. Public blockchain disclosure is explained separately and should not be mistaken for a private disclosure to Plemu alone. We do not promise that independent recipients will never process public information for their own purposes.
Retention
Optional browser favorites, sound/motion settings and selected-wallet preferences are retained only after opt-in, until replaced, withdrawn or cleared. Earlier optional drafts, profiles and demo records are also removed by the named-record withdrawal mechanism. Current local browser imports, player state and creator drafts remain in the current tab unless you explicitly download a file; a reload or tab closure can discard them. The privacy-choice record and versioned terms acknowledgment remain until replaced or site storage is cleared. The pending transaction journal retains one unresolved operation per wallet until its confirmed, failed or expired status is checked or site data is cleared. Seeker files and preferences generally remain until removed or the app is cleared/uninstalled; Disconnect & forget removes the app’s saved wallet connection. Its local terms acknowledgment remains separate from wallet credentials.
For support messages and operational records under our control, retention is limited to the period reasonably needed for the request, service operation, security investigation, legal obligation or establishment/defense of legal claims. Relevant criteria include whether a request remains open, the sensitivity of the information, applicable limitation/retention requirements and whether deletion would impair an active security investigation. We do not claim a uniform retention period for all records.
Independent providers determine retention for their own records. Public blockchain data and third-party copies may persist indefinitely. Local deletion does not remove email already sent, provider logs, wallet records or blockchain history. Contact support@plemu.xyz to ask about records we control and the retention criteria applying to your request.
International processing and security
Plemu Labs LLC is in the United States. Hosting, email, wallet, RPC and other providers can process information in other countries, and public blockchain participants are distributed worldwide. Those countries may offer different protections. Where a restricted international transfer is our responsibility, an applicable lawful transfer mechanism and safeguards are required; public availability alone is not an exemption from data-protection rules. Contact us for details of applicable safeguards and a copy where available.
Measures used in the described products include app-private storage, Android Keystore encryption for stored wallet authorization, no-backup storage for that token, explicit wallet signing boundaries, browser camera permissions and limits on diagnostic content. No storage, encryption or network system eliminates every risk. Protect your device, browser, wallet permissions and backups; notify support if you believe information has been exposed.
Your choices, rights and requests
Depending on your location and the law that applies, you may have rights to know whether information is processed, access it, obtain a portable copy, correct it, delete it, restrict processing, object to legitimate-interest processing, withdraw consent, limit certain uses of sensitive information, or opt out of sale, sharing or targeted advertising. These rights have legal conditions and exceptions; we do not treat technical limits as a waiver of rights over data we control.
Email support@plemu.xyz with your request and enough context to locate relevant records. We may ask for proportionate verification or proof that an agent is authorized, but never your private keys or seed phrase. A request to a local app may be fulfilled through device controls where Plemu does not hold a server copy. We will explain a refusal, an applicable exception or a technical limitation and any available review or appeal route.
We respond within the deadlines required by applicable law. Where GDPR/UK GDPR applies, this is normally one month, with any lawful extension explained; where applicable US state law provides a 45-day period, that period and its lawful extension rules apply. Other local deadlines may differ. You may complain to the competent privacy regulator, including your EEA supervisory authority, the UK Information Commissioner or, where applicable, Brazil’s ANPD, and pursue available legal remedies.
California and other US state rights
Where a state privacy law applies to Plemu and your information, the categories described above include identifiers (email, IP and wallet addresses), device/network activity, transaction/receipt information, information you submit to support and local draft/profile content. Their sources, purposes, recipients and retention criteria are described in this policy. Local camera video is processed for the optional effect, without a biometric identity profile or server upload by that feature.
Applicable rights can include access, correction, deletion, portability, an authorized-agent request, an appeal, nondiscrimination for exercising rights and opt-outs of sale, targeted advertising or certain profiling. The described Services do not sell personal information, share it for cross-context behavioral advertising or use it for targeted advertising; there is no such advertising activity for a Global Privacy Control signal to opt out of in those Services. If practices change, any required notice and opt-out controls must be provided before the change.
This notice does not claim that every state statute applies regardless of its thresholds, or that public blockchain information is categorically excluded from protection. Contact support@plemu.xyz to exercise an applicable right or request review of a decision.
Children and automated processing
Use is subject to legal capacity and the local age and authorization rules for each feature, as described in the terms. A parent’s permission does not override a statutory restriction on a child’s token transactions or randomized paid features. The Services do not provide a child-account or parental-verification system. Do not send children’s personal information to support unless needed to address a privacy or safety request.
If you believe a child’s information has been processed without authorization required by law, contact support@plemu.xyz so we can investigate, remove information under our control where required and address the relevant processing. This policy does not claim that a statement of eligibility alone satisfies children’s privacy requirements.
Protocol execution, token-based access checks, randomized reward selection and interface calculations can be automated. Their effects depend on the specific feature and its use; we do not assume that automation is exempt from applicable profiling or automated-decision rules. Where processing under our control falls within such rules, applicable information, review and challenge rights remain available. Contact support@plemu.xyz about an automated outcome or to exercise an applicable right.
Changes and contact
We will identify updates with a revised version/date and give additional notice of material changes where required. A new notice does not retroactively authorize incompatible processing, replace required consent or waive your existing rights. Product and provider changes must be reflected in the notice before the relevant new processing begins.
Privacy and support contact: support@plemu.xyz, Plemu Labs LLC, 30 N. Gould St., Suite R, Sheridan, WY 82801, United States. The canonical privacy policy is https://plemu.xyz/privacy, and the terms of service are at https://plemu.xyz/toc. Offline copies bundled with an app describe their stated version; consult the website for later published versions when available.