Privacy Policy

Mode Labs is the trading name of FOCAHQ PTY LTD (ACN 689 791 875, ABN 92 689 791 875), a company registered in Victoria, Australia. We are responsible for the personal information described in this policy, and we handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where other privacy laws apply to you, such as the GDPR in the European Union and United Kingdom, we also follow those.

This policy covers modelabs.studio, Base Reality (formerly Verdict), Versus, Rotlingo, Day One, our community spaces, and our Store. The sections below describe what is common to all of them; the product sections at the end describe what each product collects on top of that.

We do not sell personal information, we do not run advertising in our products, and we do not use your personal information or your content to train AI models.

Email sign-ups. If you sign up for dispatches or request access, we store your email address, the page you signed up from, the referring page, your browser type, and the time. Access requests also store your name and the answers you give in the form, and whether you agreed to receive updates.

The Threshold. When you cross the Threshold, your browser receives a random token in a cookie. We store only a scrambled (hashed) version of that token, alongside your witness number and the time you crossed. If you choose to add a display name, we store it with your entry. If you are a citizen, your entry may be linked to your citizenship record.

Citizenship. We store your citizen number, display name (which is published on the Founding Register), membership status and dates, your Discord account identifier if you link it, and the customer and subscription identifiers from Stripe. Stripe processes your payment details; we never see your full card number.

Store orders. Physical products are sold through Shopify, which collects your name, shipping address, email, and payment details to fulfil your order. We receive your order details and email address from Shopify, and may add buyers to our updates list.

Feedback and email. If you send feedback, we store your message, the page you sent it from, your browser type, and your email address if you give it. Email you send us is delivered to our inbox and copied into our internal records so we can respond and follow up.

Analytics. We use PostHog, hosted in the European Union, to understand how the site is used. It records page views, the links you follow, and steps such as starting a checkout. We have configured it so it does not record your screen (no session replay), does not capture clicks or typing automatically, does not build a personal profile of you, strips email addresses and names from events, and does not run if your browser sends a Do Not Track signal. It uses a random identifier stored in your browser. Some pages also send similar events to our own database.

What the game records.The Algorithm Game is played in public Instagram comments. Our game system reads the comments on the game's posts and keeps your public username, the text of your move, and its time, and works out your result. The live arena page shows public usernames and public moves only. You can ask for your username to be left off the arena page by emailing contact@modelabs.studio.

Claiming your record. If you claim your record on modelabs.studio, we store: the way you signed in (your email address, or your Discord account identifier), your Instagram username, your age group (13 to 17, or 18 and over), whether you asked for email updates, the code you comment to prove the username is yours and which comment carried it, and the times of each step. We link these to the one internal record we keep for each person, so the same person is not counted twice across Instagram, Discord, email and the site. Email sign-in codes are never stored, only a scrambled (hashed) version, and they expire after 15 minutes.

The founding register. If you join the founding register, we store your place in line and the time you joined. It is free and does not sign you up for anything paid.

What is public. Only your Instagram username, whether the record is claimed, and a founding number if you become a founding citizen. Your email address and Discord identifier are never shown.

Email. We email you a sign-in code when you ask for one. We send updates only if you are 18 or over and tick the box for them, and every update has an unsubscribe link. We never send marketing email to anyone who told us they are under 18.

Removing it. You can remove your claim at any time from the claim page. That deletes your email address or Discord identifier from the claim, removes the link to your internal record, and takes you off the founding register. Your public comments stay part of the game record, as they are on Instagram.

In our Discord servers, our bot processes your Discord account identifier, roles, and the messages you post in our channels. We use this to welcome members, manage roles, record mission proof, and write summaries of community activity. Messages may be analysed by automated tools for those purposes. We keep raw message data for up to 30 days; summaries and records derived from it are kept longer. When you take part in the Game in public, we may cite your public handle in the record; see our Terms for how to ask us to stop.

• to provide each product and the features you use;
• to process purchases, memberships, and deliveries;
• to send the updates you asked for and messages about your account or orders;
• to understand how the products are used and improve them;
• to keep the products safe, including reviewing reports, moderating content, and preventing abuse;
• to respond to you; and
• to meet our legal obligations.

Where the GDPR applies, we rely on your consent (for example, for updates and optional features), on our contract with you (to provide the products), on our legitimate interests (for analytics, safety, and improving the products), and on legal obligations.

We run an internal operations system, on servers we operate in Australia, that helps our small team run every product. It holds copies of product analytics events and selected product records, such as reports, feedback, and mission submissions, so we can monitor the products, moderate content, and plan improvements. Moderation reports may be posted to a private channel that only our team can see. Access is limited to the people who run Mode Labs.

We share personal information with service providers that run parts of our products for us, only as needed for that purpose:

• Google (Firebase, Google Cloud, and Google sign-in): hosting, databases, file storage, sign-in, and automated image screening;
• PostHog: product analytics, hosted in the European Union;
• Cloudflare: network security, email routing, and connecting our Australian servers to the internet;
• Stripe: citizenship and Rotlingo Aura+ payments;
• Shopify: Store checkout and fulfilment;
• Resend: sending email;
• Sentry: crash reports for the Base Reality app;
• Expo, Apple, and Google: push notifications for the Base Reality app;
• Discord: our community servers and private team channels; and
• Apple and Google: app distribution through their app stores.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or restructure of our business, in which case we will tell you before your information becomes subject to a different policy.

Some of our service providers store or process information outside Australia, mainly in the United States, the European Union, and Singapore, and may also use other countries where they run infrastructure. We choose providers that protect information to a standard comparable to the Australian Privacy Principles.

We keep cookies to what the products need:

• a Threshold cookie on modelabs.studio that lets the site recognise you for up to one year;
• a device cookie in Versus that keeps your game identity for up to 180 days;
• sign-in cookies when you sign in to a product;
• analytics identifiers stored in your browser; and
• small settings stored in your browser, such as the game rules you have agreed to.

You can clear or block cookies and site data in your browser. Some features, such as being recognised as a witness or staying signed in, will then stop working.

We keep personal information for as long as we need it for the purposes in this policy, or as long as the law requires, and then delete or de-identify it. Records that are public by design, such as witness numbers and the Founding Register, are kept for as long as the record exists, but you can ask us to remove or change your name on them. Deleted information can remain in backups for up to 90 days.

We use reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls, and limiting who can see what. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the law requires.

• You can ask to access, correct, or delete the personal information we hold about you, or ask us to stop using it for a particular purpose, by emailing contact@modelabs.studio. We will respond within 30 days. We may need to confirm your identity first.
• Every update email we send includes an unsubscribe link that works immediately. You can also email contact@modelabs.studio to stop receiving updates.
• Some products let you delete your account or change your privacy settings yourself; see the product sections.
• Where the GDPR applies, you also have the right to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time.
• You can use a pseudonym in most of our products. Purchases need your real details.

Our products are not for children under 13, and Versus is only for people aged 18 and over. If we learn that we hold information about a child under 13, we will delete it. If you think a child has given us their information, email contact@modelabs.studio. Players aged 13 to 17 can claim an Algorithm Game record. For them we collect only what the claim needs, never send marketing email, and do not offer paid citizenship. The game never asks players for personal details or for anything risky to do in the real world.

If you have a concern about how we handle your personal information, email contact@modelabs.studio. We will reply within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the data protection authority where you live.

We will update this policy when our products or practices change and change the date at the top of the page. For significant changes, we will give notice in the product or by email before they take effect.

Account. You can sign in with your phone number, email, Google, or Apple. We store your display name, username, profile photo if you add one, region, time zone, language, and how you found Base Reality (such as an invite). We keep your phone number or email address to sign you in and to stop duplicate accounts. Your username, display name, and profile photo are visible to other users.

Proofs.When you answer a mission, we store the photo you take with the in-app camera, any caption, and when you posted. Comments and stamps you leave on other proofs are also stored. Who can see your proofs depends on your privacy setting: friends only (the default), or public. Other users who have posted that day can also see proofs on that day's Wall. We do not use the location data in your photos, so do not include anything in a photo that you do not want others to see.

Safety. Every proof photo is checked automatically by Google Cloud Vision for sexual and violent content. Reports you make, and reports about you, are reviewed by our team.

Analytics, crashes, and notifications. The app sends usage events to PostHog (European Union), linked to your account identifier but never to your email, phone number, or photos, and does not record your screen. The Base Reality website also uses PostHog and may set an analytics cookie. Crash reports go to Sentry, without screenshots. If you allow notifications, we store a push token and send notifications through Expo, Apple, and Google. The website uses Google reCAPTCHA to stop abuse.

Deleting your account. Deleting your account in the app removes your sign-in account, profile, username, proofs, photos, votes, comments, stamps, friend connections, blocks, the reports and feedback you sent, and the record that links your email or phone number to your account. Reports other people made about you are kept for safety, with your identity removed. We keep a record of the deletion request itself to show that we completed it; once your deletion is complete, the email address or phone number it came from is kept only as a one-way hashed value with a partly masked hint (such as the first letter and domain of an email), not in readable form. You can also request deletion on the Base Reality website, and we will complete it within 30 days.

Your identity. When you visit Versus, your browser gets a random device identifier in a cookie, so you can play without an account. You can choose a display name and username. If you sign in with Google, we also store your Google account identifier and email address; your email is never shown to other players.

Camera and microphone.Camera and microphone stay off until you turn them on for a mode that needs them. Face and body tracking runs in your browser. To score a round, the measurements it produces (not your video) are sent to our server, used to work out the result, and then discarded; we keep only the score and details about the round. Versus does not record your camera or microphone. Five-Second Duel uses your browser's speech recognition, which may send your audio to your browser's provider (for example, Google) under that provider's privacy policy.

Live duels.In a live duel, your video and audio go directly between you and the other player, not through our servers. Connecting directly means each player's browser can see the other's IP address. Connection details are stored briefly on our server to set up the call.

Uploads and packs. If you sign in and upload clips or images for a pack, we store the files, the source link, and the creator credit you give, on servers we operate in Australia. Packs can include videos from YouTube, Instagram, or TikTok; those load from those services, which may collect information under their own policies.

Results and records. We store your results. Showing them on public leaderboards is off by default and you can change it at any time. Hiding your profile removes your leaderboard entries without erasing your history. In a tournament, your display name is visible to others in that event.

Analytics. Versus sends a limited list of usage events to PostHog (European Union) through our own server, which does not pass on your IP address. Events never include video, audio, measurements, scores, names, email addresses, or room codes. Analytics is off if your browser sends Do Not Track or Global Privacy Control, and you can turn it off in your settings.

Storage and deletion.Versus data is stored on servers we operate in Australia. To delete your account and data, sign in and choose Delete account in Settings. It immediately removes your profile, results, packs, uploads, and sign-in links. Reports other players made about you are kept for safety, with your identity removed. If you play without signing in, you can delete the data stored for that browser at any time, without signing in, using "Delete my data on this device" on the Versus Rules & privacy page. Each browser keeps its own guest data, so repeat it on each one. You can also email contact@modelabs.studio and we will delete your data within 30 days.

Playing as a guest. Your progress is stored in your browser, not on our servers. If you vote for a course, send a suggestion, or report a card as a guest, we store what you sent with a random identifier kept in your browser.

Your profile. When you make a profile we store your username, your password (only as a salted hash, never the password itself), your birth year (to check you are 13 or older), when you agreed to our Terms, and your progress: XP, streak, finished lessons, in-game hearts and gems, and settings such as sound. We also store your course votes, suggestions, and card reports. A sign-in cookie keeps you signed in for up to one year.

What others see. Your username, XP, streak, and whether you have Aura+ appear on the public Rot League leaderboard. Nothing else about you is shown to other players.

Aura+ payments. If you buy Aura+, Stripe collects your payment details, email, and name under its own privacy policy. We receive and keep your Stripe customer identifier, your subscription status, and your renewal date. We never see your full card number.

Clips, analytics, and abuse protection. Some lessons play short YouTube clips in privacy-enhanced mode; those load from YouTube, which may collect information under its own policy. Rotlingo does not use analytics or advertising. Our server holds your IP address in memory for up to an hour to limit repeated sign-in and sign-up attempts, and does not save it.

Storage and deletion.Rotlingo data is stored on servers we operate in Australia. To delete your profile, choose Delete account on your profile page. It immediately removes your profile, progress, votes, and Aura+ record, and cancels Aura+. Suggestions and card reports you sent are kept to improve lessons, with your username removed. As a guest, choose "Delete my data on this device" on the profile page. You can also email contact@modelabs.studio and we will delete your data within 30 days.

Day One is not yet available. If you sign up for updates on the Day One page, we store your email as described under email sign-ups above. When Day One is released, we will add what the game collects to this section before release.

FOCAHQ PTY LTD, trading as Mode Labs
ACN 689 791 875 · ABN 92 689 791 875
Victoria, Australia
Privacy questions and requests: contact@modelabs.studio