Metora: Privacy Policy

Metora is operated by STUDIO BOKO SPAIN S.L.. Under the GDPR we are the data controller, which means we decide what is collected and why, and we are the ones accountable for it.

For anything in this policy, including any request about your own data, write to hello@finalbosu.com.

• Your sticker: the name you write on it, which everyone sees on Metora, and your email address, which is never shown.
• Your choice about news: whether you ticked the box, and when you confirmed it by email.
• Your Fragment hunts: which Fragments you found and when, and which relays you watched to the end, for the prize draw.
• Verification, if you choose it, for each account you verify with: your user ID and username on Discord or X, your account ID on Google, and which Memo account you connected. The first account's Discord or X username shows on your sticker.
• Memo collectors: which Memo account you connected, or the one your Discord or X account is linked to.
• On this device: a cookie that remembers your sticker, and your sound setting.
• Technical: your IP address, browser and device, and server logs. An IP address counts as personal data under EU law even though it does not carry your name.

The GDPR requires a legal basis for every purpose. Ours are these:

Ticking the news box is never needed to take part in the draw.

Verifying is optional. If you choose it, you sign in on Discord's, X's or Google's own page. They decide what they collect there, so their own privacy policies cover that part, at discord.com/privacy, x.com/privacy and policies.google.com/privacy.

Discord and X send us your user ID and username, never your email address, your messages or your followers. Google sends us your account ID only.

Connecting Memo happens on Memo, where you are signed in: it asks you to confirm, then tells us which Memo account is yours and nothing else. For Discord and X we check once whether a collector linked that account in Memo. Either way we keep which Memo account it is, so we can send its collector a Fragment after the campaign. Signing in with Memo on another device works the same way: Memo tells us which account is yours, and when a sticker is connected to it, that device gets the cookie that remembers your sticker.

Discord, X and Google do not process data for us, which is why they are not in the list below, and we send them nothing about you.

We do not sell your data and we do not share it with advertisers. We do rely on other companies to run Metora, and they process data on our instructions:

• Vercel: hosting, the network that serves every page, and a check that tells people from automated scripts by reading signals from your browser.
• Supabase: the database that holds stickers and hunts, in Ireland.
• Kit: only if you tick the news box. Kit receives your email, sticker name and Fragment count, sends the email to confirm it, and later the news.

Some of the companies above are based in the United States, so some data reaches servers outside the European Economic Area. Where that happens it is covered by the European Commission's standard contractual clauses or by an adequacy decision, which are the mechanisms EU law provides for sending data abroad.

Metora uses no analytics or advertising cookies. Only these:

Metora keeps anonymous counts of how it is used: how many visits there are and which kind of site they came from, how long a visit plays, and how many people open the clips, the prize card, the sticker form or the archive terminal, read to its end, follow it to the Keshuma Archives, or start verifying. Each count is a daily total, linked to nobody.

The counts set no cookie and store nothing on your device, so they run for everyone. We use them to see how the campaign did and to plan the next one.

Wherever you live you can ask us for a copy of your data, ask us to correct it, or ask us to delete it, including taking your sticker down. If you are in the EU, the EEA or the UK you also have the right to restrict how we use it, to receive it in a portable form, to object to processing we base on legitimate interests, and to withdraw consent at any time without that affecting what we did before you withdrew it.

Write to hello@finalbosu.com and we will answer within one month.

If you think we have handled your data badly you can complain to a supervisory authority. Ours is the Spanish Agencia Española de Protección de Datos at www.aepd.es, and you can also complain to the authority where you live.

The prize draw is for people aged 18 or older. Metora is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child left a sticker, write to hello@finalbosu.com and we will take it down.

We update this policy when what we do changes. The version number at the top moves every time. If a change affects what we collect or why, we will say so on Metora rather than quietly swapping the text.