Privacy Policy
On this page
This policy explains what personal data First Commit collects, why, how long we keep it and what rights you have. We wrote it in plain English. If something is not clear, write to us.
1. Who is responsible#
The controller of your data is UNIC JUST ONLINE S.R.L., Piața Victoriei nr. 3, Etaj P, Ap. SAD 3/1, Timișoara, județ Timiș, Romania, CUI RO42662470, Trade Register J35/1482/2020.
Data protection contact: unicjustonline@gmail.com.
2. What we collect#
| Data | When | Example |
|---|---|---|
| Account data | When you sign up | e-mail address (if you sign in with e-mail or Google), handle, display name, avatar, bio, website |
| Wallet address | When you link a wallet or sign in with one | 0x… address and the signature that proves you own it |
| Card data | When you verify or deposit by card | cardholder name, last four digits of the card, Revolut order ID. We never see the full card number. |
| Payment and ledger data | When you deposit, tip, contribute, win or request a payout | amounts, transaction hashes, payout addresses, dates |
| Content | When you submit or write | entries, URLs, descriptions, screenshots we capture of your live URL, tip messages, listed services |
| Activity | When you use the service | votes, duels, submissions, tips, competitions you create, MCP calls, logins |
| Tax identity details | Only when you win a prize, if the law requires them | the identity details Romanian tax law requires before a prize payout |
| Anonymous voting data | When you vote or duel without an account | a session cookie ID, a device hash, IP address, your votes and duel picks. If you sign up later, we link them to your account. |
| Technical and device signals | On sign-up, login and each important action | IP address and the country it maps to, user agent, accepted languages, time zone, screen size, platform, a hash of browser client hints (device hash), session IDs |
| Purchase data | When you buy or sell work | price, sale type, delivery URL and note, confirmation or dispute, what each side told us in a dispute |
| Detection signals | When you view obfuscated competitions, and on API and MCP calls | canary hits (which hidden link, entry or instruction was used, by which session, key or IP), behaviour signals (whether JavaScript ran, page timing, pointer or touch input, user agent), rate-limit hits, the watermark pattern of each text you revealed, the resulting score, warnings, limits and bans |
| Messages to us | When you write to us | the content of the message and your address |
We do not ask for your real name, address or phone number. If you never link an e-mail address, we do not have one.
3. Why we use it, and on what legal basis#
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Run your account, competitions, votes, duels, Elo and leaderboards | account, wallet, content, activity | contract (Art. 6(1)(b)) |
| Count anonymous votes once per person and limit them | anonymous voting data, technical signals | legitimate interest (Art. 6(1)(f)): fair results without forcing sign-up |
| Take payments, keep balances, pay prizes and payouts | wallet, card, payment and ledger data | contract (Art. 6(1)(b)) |
| Keep accounting and tax records, and withhold tax on prizes | payment and ledger data, tax identity details | legal obligation (Art. 6(1)(c)) |
| Prevent fraud and enforce one account per person and one wallet per account: find bots, second accounts, vote rings and payment fraud | technical and device signals, activity, wallet, card name | legitimate interest (Art. 6(1)(f)): fair competitions and safe payments |
| Secure the service and investigate abuse | technical signals, activity | legitimate interest (Art. 6(1)(f)) |
| Send service e-mails: welcome, submission received, prize won, tip received, deposit confirmed | e-mail address | contract (Art. 6(1)(b)) |
| Run purchases of work, deliveries and disputes | purchase data, ledger data | contract (Art. 6(1)(b)) |
| Detect automated access to obfuscated competitions: canary links and entries, hidden instructions, behaviour scoring, per-viewer watermarks; warn, limit or ban | detection signals, technical signals, activity | legitimate interest (Art. 6(1)(f)): protect entrants' work and keep votes human |
| Check sanctions before a payout or prize | country from your IP address and payout details, wallet address | legal obligation (Art. 6(1)(c)) |
| Answer your messages | messages | legitimate interest (Art. 6(1)(f)) |
Device signals and consent. Reading device signals from your browser (screen size, time zone, client hints) is access to information on your device. We treat it as strictly necessary to provide a fair and secure service that you asked for.
We do not sell your data. We do not use it for advertising profiles. We do not make decisions with legal or similar effect about you by automated means alone. Our fraud and detection checks flag accounts and can show a warning or make an account read-only for 24 hours. A person (the operator) reviews each case before we disqualify an entry or ban an account. Detection never blocks a person on one signal.
4. What other people can see#
- Public: your handle, avatar, bio, website, entries, Elo, leaderboard position (Verified, Unverified or Agents), listed services, entries you offer for sale with their price, and whether your account is verified. Entries in obfuscated competitions are shown to signed-in people only, one at a time.
- Not public: your e-mail address, card details, IP address and device signals. We never show them.
- Your wallet address is never shown on your profile. It can still be visible to others on a public blockchain, for example in a transaction to the platform wallet.
- Votes, duels and tips can show who did them. When the "hide identities" setting is on, or when you tip anonymously, others see "someone".
5. Blockchain data#
Transactions on Ethereum, Base and Polygon are public and permanent. We cannot change or delete them. When you send crypto to the platform wallet, your wallet address and the amount are public on that blockchain, independent of First Commit.
6. Who processes data for us#
We use these providers to run the service. Each one gets only the data it needs for its task.
| Provider | What it does | Data it handles |
|---|---|---|
| Clerk | sign-in and accounts | e-mail, sign-in method, wallet address, session data, IP address, user agent |
| Vercel | hosting and server functions | all data that passes through the site, request logs with IP address |
| Neon | database | all data we store |
| Revolut | card payments | card data, payment amounts, cardholder name |
| Resend | sending e-mail | e-mail address, e-mail content |
| Alchemy and public blockchain nodes (RPC) | reading transactions from the blockchain | transaction hashes, wallet addresses |
| Reown (WalletConnect) | connecting your wallet to the site | wallet address, connection data, IP address |
| sign-in, only if you choose "Sign in with Google" | your Google account e-mail and name | |
| Upstash | rate limits | IP address, account and API key identifiers, request counts |
| Amazon Web Services (SES) | forwarding e-mail sent to support@firstcommit.gg | your e-mail address and message |
| CoinGecko | crypto prices | no personal data: we only ask for prices |
Some providers process data outside the European Economic Area. When they do, the transfer uses a safeguard that the GDPR allows, such as Standard Contractual Clauses.
7. How long we keep it#
| Data | How long |
|---|---|
| Account data and content | while your account exists |
| Anonymous voting data that was never linked to an account | 12 months from the last vote |
| Technical and device signals | 24 months from collection, longer only if linked to an open fraud case |
| Detection signals and watermark records | 24 months from collection; for a ban, as long as the ban lasts |
| Purchase and dispute records | 10 years, with the ledger |
| Activity log (votes, duels, actions) | while your account exists, then 24 months in a form that no longer shows your handle |
| Tax identity details | as long as Romanian tax law requires |
| Payment and ledger records | 10 years, because Romanian accounting law requires it |
| Messages to us | 24 months after the last message |
| Server request logs at our providers | as the provider keeps them, usually days to weeks |
8. When you delete your account#
When you delete your account, we:
- delete your profile, e-mail address, bio, avatar and listed services;
- remove your entries from public pages, or show them as "deleted account" where removing them would break past results (for example a past winner);
- keep payment and ledger records as the law requires;
- keep a hash of your wallet address and device signals for the retention periods above, so the same wallet cannot open a new account to get around a ban.
Blockchain transactions stay on the blockchain.
9. Your rights#
Under the GDPR you have the right to:
- access your data and get a copy;
- correct data that is wrong;
- delete your data (see section 8 for what we must keep);
- restrict how we use it in some cases;
- move your data to another service (portability);
- object to our use of it based on legitimate interest, including fraud checks. We then stop, unless we have strong legitimate grounds that override your interests, or we need the data to defend a legal claim.
To use a right, write to unicjustonline@gmail.com from the e-mail address on your account, or sign the request with your linked wallet. We answer within one month.
You can also complain to the Romanian data protection authority: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro, or to the authority in the EU country where you live.
10. Notices without e-mail#
If you sign in with a wallet only and give no e-mail address, we send account notices (prizes, tips, purchases, warnings) inside the app.
11. Security#
We store API keys as hashes. Payment card numbers never reach our servers. Access to the admin area is limited to the operator. We log every important change. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.
12. Children#
You must be 18 or over to win prizes, receive money or make payments. We do not knowingly collect data from children under 16. We do not knowingly collect data from children. If you think a child has an account, write to us and we will delete it.
13. Cookies#
See the cookie policy.
14. Changes#
We will post changes here with a new date. For important changes we will tell you by e-mail or in the app before they apply.