Your data deserves clarity.

This policy applies to everyone who uses the DAOasis website, joins a DAOasis waitlist, uses the DAOasis Companion App, takes part in DAOasis learning, quests or community features, or contacts us directly.

It covers the DAOasis website at this address and the DAOasis Companion App. It does not cover independent third-party services you may choose to connect to DAOasis — your device manufacturer, a health platform, a wallet provider or an app store. Those services have their own privacy policies, and the information they hold is governed by those policies rather than this one.

The DAOasis legal entity responsible for information described in this policy is DAOasis Global Ltd, registered in the United Kingdom. Its company number and registered office are on the public register at Companies House, under the company name.

DAOasis is being built in stages, and being straight about the stage matters more than sounding finished. As at the date of this policy:

• This website collects personal information in one place only: the early-access sign-up form. It has no account system and no login. What the form collects, why, and who processes it is set out directly below.
• This website sets no cookies and runs no analytics. There is no tracking pixel, no advertising tag and no third-party measurement script anywhere in it. The only thing stored in your browser is a single preference recording whether you chose the light or dark appearance. See the Cookie Policy.
• The Companion App is in development. Its core architecture is built and end-to-end flows are still being completed. The sections below describe how information will be handled as each part of the app is released.
• Device and health-platform integrations are not live yet. Apple HealthKit and Google Health Connect are the priority integrations identified for the app's first release. Nothing reads from a health platform until you connect it and grant permission.

The rest of this policy is written to cover DAOasis as described across this website, including functionality that is still being built. Where that is the case it is labelled. This is deliberate: a policy that only described a website collecting nothing would be accurate today and useless the moment the app ships.

The early-access sign-up

The sign-up form on the home, App and Sanctuary pages is the only place this website asks for personal information.

• What is collected. Your email address (required), your first name if you choose to give it, and the interests you tick — Companion App, Sanctuary, Community or Investor / partner. Nothing else, and nothing is sent until you press the button.
• Why. To email you when early access opens, and to tell you about the parts of DAOasis you ticked. It is not used for advertising and is not sold or shared with advertisers.
• Who processes it. The list is run on MailerLite, an email service provider based in the European Union, which stores the details and sends the emails on our behalf. It acts only on our instructions, under the data processing terms that form part of its service agreement, and it may not use the list for its own purposes.
• How long it is kept. For as long as you stay subscribed. If you unsubscribe, your name and interests are deleted within 30 days; only your email address is kept, on a do-not-email list, so that you are never added again by mistake. If you have not opened any email from us for 24 months, we remove your details entirely. You can ask for your details to be deleted at any time.
• How to unsubscribe. Every email has an unsubscribe link. You can also write to info@daoasis.xyz with the subject line “Unsubscribe”, or ask for your details to be deleted.

If the form is not yet connected to MailerLite on the page you use, pressing its button instead opens your own email app with your details written out. In that case nothing reaches this website or MailerLite unless you send that email, and it is then handled as ordinary correspondence.

The categories below describe what DAOasis expects to collect to operate the product described on this website. Not every category applies to every person: much of it depends on which features you use and what you choose to connect.

Identity and contact information

Your name or chosen display name, email address, and any other contact details you give us — for example when you join a waitlist, register interest in the Sanctuary, or write to us.

Account information

Login credentials and authentication data, account settings, and records of the permissions you have granted or withdrawn. Passwords are stored in hashed form and are never readable by us in plain text.

Wellness and activity information

The participation data the Companion App is designed around — steps, breathing sessions, hydration, sleep, nutrition logging and general activity. Covered in more detail in section 04 and in full on the Health Data page.

Quest and participation information

Quests started and completed across the six daily habits (Move, Rest, Breathe, Hydrate, Nourish and Learn) and community challenges, streaks, progress along the Bangkok-to-Phuket journey, and how each action was verified — automatically through a connected platform, manually logged by you, or recorded on the honour system.

Learning activity

Lessons started and completed across the two learning tracks, progress through depth levels, and assessment results where a lesson includes one.

Community activity

Content you post, comments, reactions, group membership, and reports you submit or that are submitted about your content.

Referral activity

Where you were referred by an existing member, or referred someone else, the record connecting those accounts.

Device and technical information

Device model and operating system, app version, language and region settings, general location inferred from IP address at country or region level, crash reports and diagnostic logs, and IP address.

Usage information

Which features you use and when, screens viewed, session length and frequency, and interactions with notifications.

Transaction information

Records of DRC earned and converted, and — only if you choose to use on-chain functionality — the wallet address you connect and the transactions associated with it. See section 08.

Communication information

Messages you send to support or to any DAOasis address, and records of our replies.

Preferences

Notification settings, appearance choice, communication and marketing preferences, and language.

This is the category that matters most, so it gets its own treatment.

The Companion App is designed to work with wellness metrics: steps, breathing, hydration, sleep, nutrition and learning. Some of that can be read automatically from a health platform if you connect one. Some of it you log yourself. Some of it is recorded on the honour system, and credited accordingly.

Depending on where you live, some of this information may be treated in law as sensitive personal information, special category data, or health data — even when it is a step count rather than anything clinical. DAOasis treats the whole category as sensitive regardless of whether a particular law requires it, because that is the right default for a wellness product.

What that means in practice:

• Wellness information is used to run the experience you asked for — tracking progress, crediting participation, moving your journey forward — and to improve the product.
• Connecting a health platform is always a choice, is never required to use DAOasis, and can be disconnected.
• Wellness information is not sold. It is not shared with advertisers or data brokers, and it is not used to build advertising profiles.
• Where the law requires your explicit consent before this category of information can be processed, we will ask for it separately and clearly, rather than burying it in a general acceptance.

Information reaches DAOasis in five ways.

Each use below is tied to something the product actually does.

• To provide the service — running the app, showing your progress, keeping your data consistent across your devices.
• To operate accounts — creating and authenticating your account, honouring your settings, responding to your requests.
• To recognise participation — recording quests, lessons, streaks and journey progress, and calculating the DRC that recognises them.
• To support quests and learning — verifying that an action happened, at the level of confidence the action allows, and unlocking what follows.
• To provide insights — showing you patterns in your own participation. These are informational reflections of your own data, not medical or diagnostic assessments.
• To communicate with you — service messages, changes to terms, security notices, and marketing only where you have opted in and can opt out.
• To improve the product — understanding which features work, where people get stuck, and what to fix, using aggregated and de-identified information wherever that is sufficient.
• To maintain security and prevent abuse — detecting fraudulent participation, protecting against attempts to game reward mechanics, investigating breaches of the Terms of Use.
• To comply with legal obligations — meeting requirements that apply to us, responding to lawful requests, and keeping records we are required to keep.

Where the law requires a legal basis for each use — as it does under the UK and EU General Data Protection Regulation and comparable regimes — we rely on performance of a contract with you, your consent, our legitimate interests, and compliance with legal obligations, as appropriate to the purpose. The specific mapping of legal bases to purposes is Pending legal review.

DAOasis Reward Credits (DRC) are the in-app mechanism that recognises participation. Operating them requires keeping a record of what you did: which quests you completed, which lessons you finished, how a given action was verified, and the resulting credit. Without that record there is no way to recognise participation at all.

Those records are also used to protect the integrity of the system — to identify attempts to generate credit for activity that did not happen, which would devalue the recognition for everyone who did the work.

DRC is a recognition mechanism inside the DAOasis experience. It is not money, it is not a deposit, it is not a security, and it carries no monetary guarantee. That is a product fact rather than a privacy one, but it matters here too: participation records are operational records, not financial account statements.

$DVT is the DAOasis Value Token — the on-chain layer of the ecosystem. Converting DRC into $DVT, and anything you do with $DVT afterwards, is voluntary. You can use the Companion App fully without ever touching it.

If you do choose to use on-chain functionality, we may process the wallet address you connect, the record of conversions you have requested, and transaction references needed to confirm that an action completed.

Two things worth understanding about public blockchains

• Transactions on a public blockchain are public and permanent. Anyone can read them, and neither DAOasis nor anyone else can edit or delete them. A wallet address is pseudonymous rather than anonymous: if it is ever linked to you, the history attached to it is linked too.
• A deletion request cannot remove an on-chain record. We can delete what we hold in our own systems. We cannot delete what is written to a public ledger, because nobody can. This is a genuine limit, and it is better stated plainly than discovered later.

DAOasis does not take custody of your wallet and does not hold your private keys or recovery phrase. No one at DAOasis will ever ask you for them. The specific chain, wallet connection method and infrastructure to be used are Technical architecture to be confirmed.

DAOasis does not write health or wellness data to a blockchain. See Health Data for the full position, including the direction we are exploring and the fact that it is a direction rather than a feature.

This website currently sets no cookies and runs no analytics. There is no advertising tag, no tracking pixel and no third-party measurement script in it.

One item is stored locally in your browser: your choice of light or dark appearance. It never leaves your device, is not readable by anyone else, and exists only so the site remembers how you like to read it. A second, session-only note records that the home page's opening animation has already played, and is cleared when you close the tab. The early-access sign-up sets no cookie and loads no third-party script.

If analytics or additional cookies are introduced, the Cookie Policy will be updated before they go live, and consent will be requested first where the law requires it.

DAOasis does not sell personal information, and does not share it with advertisers or data brokers. Information may be shared in the following circumstances.

• Service providers. Companies that operate parts of the service on our behalf under contract — hosting, storage, email delivery, customer support tooling, crash reporting — and only to the extent needed to do that work.
• Technology providers. Platform and infrastructure providers involved in delivering the app and website.
• Analytics providers. None are used today. If any are introduced, this policy and the Cookie Policy will name the category before they go live.
• Payment providers. Where paid features are introduced, a specialist provider will process payment details directly, so that card and bank information does not reach DAOasis systems.
• Legal and professional advisers. Lawyers, accountants, auditors and insurers, where they need the information to advise us and are bound by professional confidentiality.
• Authorities. Where we are legally required to disclose information, or where disclosure is necessary to protect the rights, safety or property of DAOasis, our members or the public. We will not disclose more than is required.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, information may be transferred as part of the transaction. If that happens, this policy will continue to apply to the information transferred until the recipient provides notice of a different policy.
• With your direction. Where you ask us to share something, or connect DAOasis to another service yourself.

For the early-access list, DAOasis uses MailerLite to store sign-up details and send email (see section 02). The other processors DAOasis engages are Processor list to be confirmed. A current list will be published here once the app's production infrastructure is finalised.

Wellness and health-related information is covered in section 04 of this policy. It also has a page of its own, written to be understood rather than merely complied with.

DAOasis applies technical and organisational measures appropriate to the sensitivity of the information it handles. The principles we design to:

• Encryption of data in transit, and of stored data where appropriate.
• Access limited to the people who need it for their role, rather than granted broadly by default.
• Authentication controls on internal systems, and separation between development and production environments.
• Collecting less rather than more, so that there is less to protect.
• Reviewing the security of providers before engaging them.
• Logging and monitoring, so that unusual access can be detected and investigated.
• A defined process for assessing and reporting incidents, and for notifying affected people and regulators where required.

Two honest qualifications. First, no service can guarantee absolute security, and any policy claiming otherwise should be read sceptically. Second, DAOasis does not currently hold any security certification, and this page will not imply one. Where a formal certification or independent audit is obtained, it will be stated here with its scope and date. Current status: Security review and certification status to be confirmed.

You have a part in this too: use a strong and unique password, keep your device updated, and be careful what you connect. If you use a wallet, nobody from DAOasis will ever ask for your private key or recovery phrase — any message that does is fraudulent.

Information is kept for as long as it is needed for the purpose it was collected for, and then deleted or anonymised. How long that is depends on the purpose:

• Account information — for as long as your account is active, and for a limited period afterwards to handle recovery, disputes and legal obligations.
• Wellness and participation information — while your account is active, because your history is the product. Deleting your account removes it, subject to the limits below.
• Communications — for as long as needed to resolve the matter and keep a reasonable record of it.
• Legal, financial and tax records — for the period the applicable law requires, which may be longer than any of the above.
• Security and abuse-prevention records — for as long as needed to protect the service, including a limited record of enforcement so that a suspension cannot simply be re-registered around.
• Aggregated and de-identified information — may be kept indefinitely, because it is no longer about an identifiable person.
• On-chain records — cannot be deleted by anyone, as explained in section 08.

Specific retention periods are Retention schedule to be confirmed. They will be published here once set, rather than stated approximately now and quietly corrected later.

DAOasis is being built as an international product with a planned physical pilot in Phuket, Thailand, and a team distributed across several countries. Information may therefore be processed in a country other than the one you live in, including by service providers located elsewhere.

Where information is transferred out of a jurisdiction that restricts international transfers, we will use a transfer mechanism recognised by the applicable law — for example an adequacy decision, standard contractual clauses, or another approved safeguard — together with additional measures where they are needed.

The countries in which DAOasis and its providers process information, and the specific transfer mechanisms relied on, are Hosting locations and transfer mechanisms to be confirmed.

Depending on where you live, you may have some or all of the following rights. Which of them apply to you, and how they apply, is determined by your local law rather than by this page — so this section describes them without claiming that every one is available to everyone.

• Access — to be told what information we hold about you and to receive a copy.
• Correction — to have inaccurate or incomplete information put right.
• Deletion — to ask us to delete information, subject to the limits in section 13.
• Restriction — to ask us to limit how we use information while a question about it is resolved.
• Objection — to object to certain uses, including any use based on our legitimate interests.
• Portability — to receive certain information in a portable format, or to have it sent to another provider.
• Withdrawing consent — where we rely on your consent, to withdraw it at any time. Withdrawal applies going forward and does not undo processing already carried out lawfully.
• Marketing preferences — to opt out of marketing at any time, in the app, in your settings, or using the unsubscribe link in any marketing email. Service and security messages are not marketing and will continue.
• Complaint — to complain to your local data protection authority. We would rather you came to us first, but that right does not depend on doing so.

Exercising a right

Contact us using the details in section 19. We will respond within the period required by the applicable law. We may need to verify your identity first, so that we do not disclose your information to someone who is not you.

There are limits worth knowing in advance. Some information must be kept to meet legal obligations. Deleting participation history removes the record that recognises it. And records already written to a public blockchain cannot be deleted by anyone.

DAOasis is designed for adults. The Companion App involves wellness tracking, learning about digital ownership, community features and — for those who choose it — a token layer, and it is not built for children.

The minimum age for a DAOasis account is Minimum age to be confirmed. This is being set with legal advice, because the answer depends on the jurisdictions DAOasis operates in, on the age of digital consent in each, and on whether any part of the ecosystem is subject to additional restrictions.

We do not knowingly collect information from children below the applicable minimum age. If you believe a child has provided information to DAOasis, contact us using the details in section 19 and we will look into it and delete what we should not hold.

The DAOasis website and app may link to, or let you connect, services operated by other companies — health platforms, wearable manufacturers, app stores, wallet providers, community platforms and social networks.

Those services are independent of DAOasis. We do not control them and we are not responsible for their privacy practices. When you follow a link or connect a service, the information you give them is governed by their policy. It is worth reading, particularly for anything that will be handling your wellness data.

Connecting a service is always a choice, and can be disconnected — in DAOasis, and in the other service's own settings.

This policy will change, because DAOasis is being built. Each version carries a version number and a date at the top of the page, so you can tell what you are reading.

Where a change materially affects how your information is handled, we will give notice before it takes effect — by email, in the app, or prominently on this website — rather than changing the page quietly. Where a change requires your consent, we will ask for it rather than assume it.

Continuing to use DAOasis after a change takes effect means the updated policy applies to you.

Questions about this policy, or about how your information is handled, should go to the DAOasis privacy contact.

Until the privacy address is published, general enquiries can be routed through the Contact page, which lists every pathway currently available.