Privacy & Cookie Policy

Who We Are and What This Policy Covers

This Privacy & Cookie Policy explains how Autonomous Worlds Ltd, a company registered in Malta (company number C 87413) ("we", "us", "our"), handles information when you visit https://taurion.io (the "Site"). We are the data controller responsible for the Site.

The Site is a static, informational website: a marketing and game-encyclopedia ("Codex") resource for Taurion, a fully decentralised, on-chain sci-fi MMO. You can read pages and view 3D models and images — that is all. The Site has no user accounts, no logins, no payment forms, no contact forms and no newsletter. We do not ask you to create an account or submit personal details, and we do not run any tracking before you consent.

You can reach us about privacy at:

• Email: [email protected]
• Post: Autonomous Worlds Ltd, 64, Excalibur, Triq B. Bontadini, Birkirkara BKR 1732, Malta

What This Policy Does Not Cover: The Game and the Blockchain

The Taurion game itself is not part of this Site. The game is fully decentralised and runs on the Xaya blockchain (on the Polygon network), accessed through a separate game client and your own cryptocurrency wallet.

We do not operate the game through this website, we do not hold your funds, and we do not process or have access to your wallet or its transactions via the Site. Any activity you carry out on-chain is public by design and governed separately by the rules of the relevant blockchain protocols and the software you choose to run. Please review the terms and documentation for the game client and your wallet provider before taking part. This policy applies only to your use of the website.

The Only Data We Process: Privacy-Respecting Analytics

The single form of data processing on this Site is website analytics, provided by Google Analytics 4 (the gtag.js library, operated by Google LLC and Google Ireland Ltd, together "Google").

Crucially, analytics load only after you give explicit opt-in consent via our cookie banner. No analytics, tracking scripts or non-essential cookies run before you choose "Accept". If you decline or simply ignore the banner, none of this processing takes place.

When analytics are enabled, Google collects on our behalf:

• The pages you view and the referring site that sent you;
• Your approximate location (country/region level), which Google derives from your IP address;
• Your device and browser type, and your language;
• On-page interactions (such as clicks and scrolling).

About your IP address: Google processes your full IP address only transiently to derive an approximate location, with IP-anonymisation applied. Your full IP address is not stored by us and is never exposed to us. We see only aggregated, pseudonymous reports — we cannot identify you as an individual from them.

We do not:

• Collect special-category (sensitive) data;
• Run advertising or build profiles to make decisions about you;
• Sell your data, or share it for cross-context behavioural advertising.

Cookies and Local Storage

A cookie is a small file stored on your device; local storage is a similar browser mechanism. Here is exactly what the Site uses:

Name	Type & storage	Purpose	Category	Set when	Lifetime
tn-consent	First-party cookie	Records your own cookie choice (Accept/Decline) so we can honour it	Strictly necessary	When you choose Accept or Decline	~12 months
_ga	Third-party (Google Analytics)	Distinguishes individual visitors	Analytics	Only after you click Accept	Up to ~24 months
_ga_<id>	Third-party (Google Analytics)	Maintains session state	Analytics	Only after you click Accept	Up to ~24 months

The strictly necessary tn-consent cookie does not require consent, because it is essential to the Site working as you expect — it exists purely to remember and respect your own cookie choice. The Google Analytics cookies are never set unless you opt in.

How You Control Cookies and Consent

On your first visit, a cookie banner appears with "Accept" and "Decline" options. This opt-in model applies to every visitor, worldwide:

• Accept — analytics cookies and scripts are enabled.
• Decline (or ignore the banner) — no analytics cookies or scripts are ever set.

You can change your mind at any time using the "Cookie settings" link in the footer.

You can also manage or delete cookies directly in your browser. Most browsers let you block or remove cookies and clear local storage via their settings — search your browser's help pages for "cookies". Note that clearing the tn-consent cookie will cause the banner to appear again on your next visit. You may also install Google's Analytics Opt-out Browser Add-on.

Legal Bases for Processing (EU/UK GDPR)

Where the EU GDPR or UK GDPR applies, we rely on the following legal bases:

• Analytics cookies and the data they collect — your consent (Article 6(1)(a)), which you give via the banner and can withdraw at any time. This also satisfies the consent requirement under the EU ePrivacy Directive and UK PECR for storing non-essential cookies.
• The strictly necessary tn-consent cookie — our legitimate interests (Article 6(1)(f)) in operating the Site securely and honouring your choices, together with the necessity of it for the service you have requested. It is essential, so no consent is required.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

International Transfers

Google may process analytics data in the United States and other countries outside the UK and EEA. Where it does, such transfers are protected by appropriate safeguards, including the EU–US Data Privacy Framework (and its UK extension) and/or the European Commission's Standard Contractual Clauses (SCCs). You can ask us for more information using the contact details above.

How Long We Keep Data

We do not store analytics data ourselves beyond the aggregated reports Google provides. The underlying user- and event-level data is retained by Google under Google Analytics' configurable retention setting, which can be set between 2 and 14 months, after which Google automatically deletes it. The tn-consent cookie lasts about 12 months; _ga / _ga_<id> last up to about 24 months unless you clear them sooner.

Your Rights

Depending on where you live, you have rights over your personal data. We honour these requests regardless of your location.

Under the EU/UK GDPR, you may:

• Access the personal data we hold about you;
• Request rectification (correction) of inaccurate data;
• Request erasure (deletion);
• Request restriction of, or object to, processing;
• Request data portability;
• Withdraw consent at any time (via "Cookie settings").

Under the California CCPA/CPRA, you may:

• Know what personal information is collected and how it is used;
• Request deletion and correction of your personal information;
• Opt out of any sale or sharing of personal information — note that we do not sell or share your personal information for cross-context behavioural advertising;
• Exercise these rights free of any discrimination in service.

Because we collect only pseudonymous analytics and hold no account or contact details, we may be unable to identify you within that data — but we will always help you control collection through the consent banner and your browser.

To exercise any right, email us at [email protected]. You also have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office (ICO) or your local EU Data Protection Authority.

Children

The Site is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data to us, please contact [email protected] and we will take appropriate steps to delete it.

Third Parties

We rely on a small number of third parties:

• Google (Google LLC / Google Ireland Ltd) — website analytics, only after you opt in. See Google's Privacy Policy.
• Our hosting / CDN provider — serves the Site's pages, models and images to your browser and may process technical connection data (such as your IP address) transiently to deliver content and maintain security, as is standard for any website.
• The Xaya / Polygon blockchain — relevant only to the separate game, not to this Site, and governed by its own protocols as described above.

Changes to This Policy

We may update this policy from time to time to reflect changes to the Site or to legal requirements. The current version is always available on this page, with the effective date shown at the top. Please check back periodically.

Contact Us

If you have any questions about this Privacy & Cookie Policy or your personal data, contact us at:

• Email: [email protected]
• Post: Autonomous Worlds Ltd, 64, Excalibur, Triq B. Bontadini, Birkirkara BKR 1732, Malta