Privacy Policy

Who we are

kre8 (kre8.fun, testnet.kre8.fun and the kre8 mini apps in Telegram, Farcaster and Discord) is built and run by Gully Labs LLC, Oregon, USA ("we", "us"). We decide what personal data kre8 collects and why, so we are responsible for it. Using kre8 is also governed by our Terms of Service.

Questions or requests about your data: [email protected].

The principle is simple: we collect only what we need to run kre8 for you, keep it on servers we run, and tell you here what that is.

What we collect and why

Your account and sign-in

Your kre8 account is a wallet. When you sign up with a passkey, the passkey and the keys that sign for your account stay on your device; we never see them. Social actions (posting, following, liking) are signed by a key on your device and tied to your wallet address.

If you sign in with Gully ID, kre8 receives your Gully ID identifier, display name, .gully name, avatar, linked wallet addresses and which sign-in methods you have linked. kre8 does not receive your email address from Gully ID. Gully ID is another Gully Labs product with its own privacy policy (opens in a new tab).

Your profile, posts and activity

To show your profile and feed, our social service stores, by wallet address: your profile, follows, posts and replies, likes, reports you send, the media you upload, invites, notifications and your notification preferences, your music, playlists and listens, referral records, and developer API keys and webhooks if you create them. If you order a verified badge we store your X handle, the post you used to prove it and the payment transaction.

Videos, Shorts and live streams

Our video service stores the videos, Shorts and live streams you publish, your likes and watchlist, your playback progress (how far you watched and for how long), reports, creator applications and founding-creator spots. If you ask to be reminded when a stream goes live, it stores your browser's push subscription.

Messages and chat

Live chat messages and direct messages are stored on our servers so they can be delivered and shown. Direct message text is encrypted at rest, but we hold the keys: messages on kre8 are not end-to-end encrypted. Chat metadata (who, when, which room) is stored in plain text. If a message is reported, our moderators can read it to review the report.

Payments and coins

Payments, trades, coin launches, tips, memberships, passes, .gully names, quests and offers happen on Gully Chain from your wallet, or through Gully Pay checkout. We see the transactions like anyone else (they are public, see below). Gully Pay is another Gully Labs product with its own privacy policy (opens in a new tab).

Connected accounts and mini apps

• Telegram: inside Telegram, kre8 receives your Telegram user id, username and first name (Telegram's signed sign-in data) and passes it to Gully ID to sign you in. Your kre8 account address and a device public key are saved in your Telegram cloud storage so you get the same account on your devices.
• Farcaster: kre8 receives your Farcaster id (fid), username, display name and profile picture, and a Farcaster sign-in token that Gully ID checks.
• Discord: in the Discord activity, kre8 receives your Discord id, username, display name and avatar. They are kept in memory only, never stored, and dropped when the room has been empty for 10 minutes.
• Cross-posting: if you connect TikTok, YouTube, Meta or X to cross-post, we store the access tokens they give us, encrypted, until you disconnect.

Technical data

Cloudflare passes us your IP address with each request. Our social service does not store raw IP addresses: to stop abuse and count referral visits it stores one-way hashes made with a salt that changes every day, and old salts are deleted. Rate limits are counters held in memory. Our web servers keep no access logs; our services keep short technical logs that rotate automatically (at most about 30 MB per service).

Voluntary correspondence

When you email us, we keep the email and your address so we can help you and keep a record of the conversation.

Analytics

The kre8 app counts visits with Umami, an open-source analytics tool we host ourselves (analytics.gullychain.xyz). It sets no cookies, does not store your IP address, and counts visitors with a one-way hash whose salt rotates every day. It records the page, the referring site, browser, operating system, device type, screen size, language and country, plus a few anonymous events (signed up, first swap, quest completed, bridge, creator application). Events never carry a wallet address, a name or an email. If your browser sends Do Not Track, the script does not count you.

The kre8.fun coming-soon page and these policy pages load no analytics and no script from anyone else.

Cookies and browser storage

kre8 does not use cookies. The app stores these in your browser, on your device:

• Local storage: your sign-in session (Gully ID and passkey sessions), settings and preferences, unsent posts, cached lists and the player state.
• IndexedDB: a device signing key that cannot be exported, a cache of blockchain data, and the licences for videos you download for offline viewing.

You can clear them in your browser settings at any time; you will then need to sign in again.

What is public

• On chain: Gully Chain is a public blockchain. Wallet addresses, transactions, amounts, coins, trades, tips, memberships, passes, .gully names, quest completions and referrals are visible to anyone and permanent. Nobody, us included, can make them private, change or delete them.
• On IPFS: creator audio, covers, artwork, banners and coin images and metadata are stored on our IPFS node, which is part of the public IPFS network. Anyone with the content address can fetch them, and other IPFS nodes may keep copies. We unpin content when it is deleted or taken down, but copies on other nodes may persist.
• On kre8: your profile, posts, published media, followers and public activity are visible to everyone who uses kre8 and to search engines.

Who processes data for us

We run kre8's services on our own servers. These providers process data for us:

Your browser also contacts some services directly when you use these features: the public IPFS gateway ipfs.io (for images), Arbitrum and PublicNode RPC endpoints (when you bridge, with your wallet address), the RedStone price API (for USD prices), Google Cast (only when you cast), and Telegram, Farcaster or Discord (only inside their apps). They receive your IP address and what the request needs, under their own policies.

We do not sell personal data, share it for cross-context behavioural advertising, or use it to train AI models.

When we access or disclose your information

• To help you, when you ask us for support.
• To review reports and keep kre8 safe: our moderators look at reported content, messages and the related account activity.
• To investigate abuse or security problems, using logs and metadata.
• When the law requires it: we disclose data only under a valid legal order or request, or in an emergency where someone's life or safety is at risk. We report child sexual abuse material to NCMEC as US law requires.
• If the business changes hands: if Gully Labs LLC or kre8 is sold or merged, your data goes with it under this policy, and we will tell you.

Your rights

You can ask us at [email protected] to:

• see the personal data we hold about you and get a copy of it;
• correct it;
• delete it, or your whole account's off-chain data;
• stop or restrict a use of it, or object to it.

Depending on where you live (for example the EU, the UK or California) you have these rights by law, and you can complain to your data protection authority. We will answer within the time the law sets, and we will not treat you differently for using your rights. We may need to check that the request comes from the account's owner, for example by asking you to sign a message with the wallet.

We cannot delete anything that is on a public blockchain or held by other IPFS nodes, and we may keep records the law requires (for example of payments or of reports to authorities).

How we secure your data

All traffic to kre8 is encrypted (HTTPS). Passkeys and signing keys stay on your device. Direct messages and cross-post tokens are encrypted at rest. Access to our servers is limited to the Gully Labs team. To report a security problem, write to [email protected].

Deleting content and data retention

• Posts: when you delete a post, it is hidden from everyone at once; the record stays in our database until you ask us to delete your account's data.
• Videos: deleting a video deletes its files. Live stream recordings are deleted within 48 hours unless they are saved as a video. The original upload files are not kept after processing.
• Backups: the video service's database and media are backed up daily and backups are kept for 14 days.
• Other data is kept while your account is active and as long as needed to run and secure kre8, then deleted. Some records expire on their own: unpaid verification orders after 7 days, developer API usage records after 30 days, referral links after 90 days.

Location of data

Our servers are OVHcloud virtual servers, and Cloudflare serves traffic from its global network. Your data may be processed outside your country, including in the United States, where Gully Labs LLC is based. Where the law requires it, we use appropriate safeguards for those transfers.

Children

kre8 is only for people who are at least 18. We do not knowingly collect data from anyone younger. If you believe a minor is using kre8, tell us at [email protected] and we will delete their data.

Changes and questions

When we change this policy we update the date at the top, and for a material change we also say so in the app before it takes effect. Questions, requests or complaints: [email protected].