Privacy Policy
Effective: October 19, 2026
Notch Ventures Pte. Ltd. publishes this Privacy Policy (the "Policy") to protect the personal data of Baro users and to handle related inquiries. This Policy applies to www.baro.quest and to Baro's quest, campaign, profile, and reward services.
1. Processing Principles
The Company processes only the minimum information necessary for X or Telegram login, quest participation and verification, wallet address registration, reward claims, service security, customer support, and website analytics and ad performance measurement. The Company does not use personal data beyond the purposes described in this Policy or permitted by applicable law, and does not sell users' personal data.
Wallet addresses, on-chain transaction records, and X or Telegram user information may identify an individual when combined with other information, so the Company manages them in accordance with data protection principles.
2. Information Processed and Purposes
| Purpose | Information processed | When |
|---|---|---|
| X login and member identification | The user ID, username, display name, profile photo URL, and authentication time provided by X during login | When a user logs in with X |
| Telegram login and member identification | The user ID, username, display name, profile photo URL, authentication time, and login verification value provided by Telegram during login | When a user logs in with Telegram |
| Profile and wallet registration, reward claims | Public wallet address, connected network, wallet connection and disconnection times, signature verification results, transaction hashes, and claim or SBT issuance status | When a user connects a wallet or claims a reward |
| Quest participation and completion verification | Quests and campaigns joined, completion status, verification materials submitted by the user such as links, screenshots, and text, verification results, and appeal records | When a user joins a quest or submits proof of completion |
| Campaign phone-number mission operation | Phone number including country code, consent time, campaign, and scheduled destruction date | When a user separately consents to and submits a phone-number mission |
| Telegram channel intelligence | Public channel information such as the name, public handle, and description of public Telegram channels, public posts, post view and forward counts, subscriber counts, and post counts | When the Company collects and analyzes public channel data |
| Service security and abuse prevention | IP address, access time, browser and device information, session identifiers, error and security logs, and signals used to detect multiple accounts or automation | When generated automatically in the course of using the Service |
| Website analytics and ad performance measurement | Pages visited and time spent, activity on the page (such as clicks on outside links like the Telegram community link), referral source (previous page address and UTM values), device, browser, and operating system information, IP address and the approximate region inferred from it, cookie identifiers, X ad click identifier, and whether a sign-up or login was completed and by which method. Section 10 describes the tools and how to opt out. | When collected automatically through Google Analytics and the X Pixel as a user visits the website |
| Sign-up source measurement | The campaign values (utm_source, utm_medium, utm_campaign, utm_content, utm_term) from the first visit to an address carrying them, the path of the page visited and the time of that visit, and the sign-up method (Telegram or X) | When stored in the browser on that visit, and recorded with the account if the user signs up within 90 days |
| Customer support and rights requests | The email address, Telegram username, wallet address, inquiry content, attachments, and handling records that a user provides in an inquiry or rights request | When a user contacts contact@notch.ventures |
The Company does not request or store your private keys, seed phrases, wallet passwords, exchange passwords, two-factor authentication codes, or Telegram password. Nor does it collect your private Telegram conversations, contact lists, or the message content of private channels. Processing of public channel data follows the table above and the retention periods in Section 3.
3. Retention Periods and Destruction
The Company destroys personal data without delay once the purpose of processing has been achieved. Where necessary to handle user requests, respond to disputes, prevent abuse, or meet legal obligations, it may store the data separately for the periods below.
| Information | Retention period |
|---|---|
| X or Telegram login information, registered wallet addresses, basic profile | Until account withdrawal or a deletion request, then destroyed within 30 days |
| Sign-up source information (campaign values, first visit page and time, sign-up method) | Information recorded with an account: until account withdrawal or a deletion request, then destroyed within 30 days. Information stored in the browser: used for up to 90 days and deleted on the next visit after that, and deleted as soon as a sign-up or login is completed |
| Phone number collected for a phone-number mission | Encrypted until the relevant campaign ends and automatically destroyed afterward |
| Quest participation, completion verification, reward, and appeal records | Three years from the later of the campaign end date or the account deletion request date |
| Access, security, and abuse-response logs | 12 months from collection |
| Analytics and ad measurement information collected through Google Analytics and the X Pixel | The periods stated in Section 10 |
| Customer support and rights request records | Three years from completion of handling |
| Public Telegram channel data | 12 months from collection. Where a channel becomes private or is deleted, or a legitimate deletion or de-listing request is confirmed, the data is hidden or deleted promptly to a reasonable extent |
| Information subject to separate statutory retention | The period prescribed by the relevant law |
Electronic files are deleted in a manner that prevents recovery. On-chain information already recorded on a blockchain network cannot be deleted or modified by the Company; Section 6 applies to such records.
4. Disclosure to Third Parties and Campaign Organizers
As a rule, the Company does not provide users' personal data to third parties. It may do so to the extent necessary where the user consents, where there is a legal basis, where there is a lawful request from an investigative or supervisory authority, or where there is an urgent need to protect the life or property of the user or a third party.
Some campaigns may require the Company to pass a user's public wallet address, quest completion status, or reward receipt status to the campaign organizer in order to pay rewards or verify completion. In that case, the Company will separately state the recipient, purpose, items provided, retention period, and the effect of refusing consent on the relevant campaign screen, and will obtain separate consent where required. If you refuse consent, you can still use Baro's general services, but you may not be able to join campaigns for which that disclosure is essential.
The Company may provide campaign organizers with aggregate statistics that do not identify individuals for the purpose of measuring campaign performance.
The Company allows X Corp. to collect website visit information directly to measure the performance of its X ads. Section 10 applies to this collection. Website analytics (Google Analytics) is entrusted to Google LLC as a processor under Section 5.
5. Third-Party Services and Processors
Baro may integrate with X or Telegram login, third-party wallet connections, and blockchain networks. Where you use X, Telegram, MetaMask, WalletConnect, or another external service directly, that service's handling of personal data is governed by the provider's own terms and privacy policy.
The Company entrusts the following work to external specialists in order to operate the Service, and applies contractual and technical controls so that processors do not use personal data beyond the purpose of processing.
| Processor | Entrusted work | Information processed | Location and retention |
|---|---|---|---|
| Vercel Inc. | Website and application hosting, content delivery, security, and processing of service operation logs | IP address, access, device, and browser information, request and error logs, and data transmitted in the course of providing the Service | The United States and the countries and regions where Vercel's global infrastructure operates, for as long as necessary to provide the Service and respond to security and availability issues |
| Google LLC | Website usage analytics (Google Analytics) | Pages visited and time spent, activity on the page (such as clicks on outside links like the Telegram community link), referral source (previous page address and UTM values), device, browser, and operating system information, IP address and the approximate region inferred from it, cookie identifiers (such as _ga), and whether a sign-up or login was completed and by which method | The United States and the countries and regions where Google's infrastructure operates. Deleted according to the Google Analytics data retention setting (up to 14 months) |
Google Analytics is processed by Google LLC as shown in the table above. The Company also places X Corp.'s X Pixel on the website to measure the performance of its X ads; Section 10 sets out the information X Corp. collects through the X Pixel, the purpose, the retention period, and how to opt out.
If the Company engages additional processors in future for data storage, customer support, error analysis, or other work, it will update this Policy with the processor's name, the work entrusted, the country or region of processing, and other necessary information before processing begins.
6. Cross-Border Processing and On-Chain Disclosure
6.1 Processing in Singapore
Baro is operated by a Singapore entity. When users in Korea or other countries and regions use the Service, the information described in Section 2 may be transmitted to and accessed by the Company in Singapore over secure networks for service operation, quest management, customer support, security, and dispute handling. The Company carries out such cross-border processing only where the lawful procedures and safeguards required by applicable law are in place.
You may direct inquiries or exercise your rights in relation to cross-border processing at contact@notch.ventures. If you do not agree to cross-border processing, you may refrain from using features that require it — such as wallet connection, quest participation, and reward claims — or request deletion of your account.
6.2 Processing via Vercel
The Baro website is served using Vercel Inc.'s global infrastructure. As a result, your IP address, access, device, and browser information, request and error logs, and data necessary to provide the Service may be processed in the United States or in other countries and regions where Vercel's global infrastructure is located. The purposes are service provision, security, incident response, and performance, and you may raise inquiries or exercise your rights using the methods in Section 7.
6.3 Processing via Google and X
Information collected through the analytics and ad measurement tools described in Section 10 is sent over the network from your browser to the companies below each time you visit the website, and is processed in the United States and elsewhere.
| Recipient | Country | Information transferred | Purpose and retention |
|---|---|---|---|
| Google LLC | The United States and the countries and regions where Google's infrastructure operates | Pages visited and time spent, activity on the page (such as clicks on outside links like the Telegram community link), referral source (previous page address and UTM values), device, browser, and operating system information, IP address and the approximate region inferred from it, cookie identifiers (such as _ga), and whether a sign-up or login was completed and by which method | Website usage analytics and ad performance measurement. Deleted according to the Google Analytics data retention setting (up to 14 months) |
| X Corp. | The United States and the countries and regions where X's infrastructure operates | Pages visited (including the first landing page) and time spent, activity on the page (such as clicks on outside links like the Telegram community link), previous page address, X ad click identifier (twclid), cookie identifiers (such as _twclid), device and browser information, IP address, and whether a sign-up or login was completed and by which method | X ad performance measurement. The period set in X Corp.'s privacy policy |
Each company's contact details and processing practices are set out in the Google Privacy Policy (policies.google.com/privacy) and the X Privacy Policy (x.com/privacy). Section 10.4 sets out how to refuse or limit this processing and what each method does, and refusing it does not limit your use of the Service.
6.4 Blockchain Records
When you connect a wallet or claim a reward, your wallet address, transaction hashes, token or SBT holdings, and related transactions may be recorded on a public blockchain such as the GIWA testnet. Such records can be viewed publicly and, due to the nature of blockchains, may be preserved permanently or be impossible to delete or modify.
The Company operates so as not to write names, email addresses, Telegram user IDs, private keys, seed phrases, or sensitive personal data into on-chain metadata. You likewise must not enter personal or sensitive information into on-chain memos, transaction data, or submissions.
7. Your Rights and How to Exercise Them
To the extent recognized by applicable law, you may request access to, correction or deletion of, or suspension of the processing of your personal data, withdraw consent, or ask for an explanation of the processing. Send your request to contact@notch.ventures.
The Company will verify the requester's identity and handle the request without delay, and will explain the reason where the law restricts processing of the request or permits refusal. Account deletion and wallet disconnection apply to the off-chain profile and account information the Company holds, and cannot delete or reverse on-chain transactions, SBTs, or public blockchain records that have already been finalized.
8. Automated Verification and Appeals
The Company may use automated rules, public on-chain data, public information provided by external services, and security signals to assess quest completion, reward eligibility, multiple accounts, bot or macro use, and other possible abuse. The results may affect whether a quest is treated as complete, whether a reward is withheld or paid, and whether an account is restricted.
If you disagree with such a result, you may request a review at contact@notch.ventures. The Company will carry out further checks or human review to a reasonable extent.
9. Security Measures and Incident Response
To keep personal data secure, the Company operates appropriate safeguards including access rights management, least-privilege access, authentication and access controls, protection of data in transit and at rest, security updates, log management, management of internal handlers, and incident response procedures.
Where the Company becomes aware of a personal data breach or security incident, it takes measures to limit the impact and, where required by applicable law, notifies or reports to users and the relevant authorities. If you discover account takeover, phishing, wallet impersonation, or unusual activity, please notify the relevant third-party provider and the Company immediately.
10. Cookies, Local Storage, and Behavioral Information
10.1 Cookies and Local Storage for Essential Features
The Company uses cookies and your browser's local storage to keep you logged in, secure the Service, and provide essential features. If you block or delete them, some features — such as login, security, and saved settings — may not work properly.
10.2 Collection and Use of Behavioral Information, and Collection by Third Parties
Behavioral information is information about online activity, such as website visit records, from which a user's interests or usage patterns can be inferred. The Company installs the tools below on www.baro.quest. Information collected through Google Analytics is processed by Google LLC on the Company's behalf under Section 5, and through the X Pixel the Company allows X Corp. to collect information about your visits to the website automatically.
| Tool (provider) | Information collected | Purpose | Retention |
|---|---|---|---|
| Google Analytics 4 (Google LLC) | Pages visited and time spent, activity on the page (such as clicks on outside links like the Telegram community link), referral source (previous page address and UTM values), device, browser, and operating system information, IP address and the approximate region inferred from it, cookie identifiers (such as _ga), and whether a sign-up or login was completed and by which method | Improving the Service through visit statistics, and measuring ad performance | Deleted according to the Google Analytics data retention setting (up to 14 months). Aggregate statistics that do not identify individuals may remain afterward. The _ga cookie in your browser lasts two years by default |
| X Pixel (X Corp.) | Pages visited (including the first landing page) and time spent, activity on the page (such as clicks on outside links like the Telegram community link), previous page address, X ad click identifier (twclid), cookie identifiers (such as _twclid), device and browser information, IP address, and whether a sign-up or login was completed and by which method | Measuring the performance of X ads | The period set in X Corp.'s privacy policy. X Pixel cookies in your browser, such as _twclid and _twpid, last up to about 13 months (390 days) |
The Company does not send phone numbers, email addresses, names, Telegram or X user IDs, or any other information that directly identifies you to these tools. For sign-ups and logins, only the fact of completion and the method (Telegram or X) are passed on.
The Company uses the collected information only for the purposes above, and Google LLC processes it on the Company's behalf as a processor under Section 5. X Corp., however, processes this information under its own privacy policy; in particular, if you are logged in to X in the same browser, X may link this information to your X account through its own cookies. For details, see the Google Privacy Policy (policies.google.com/privacy) and the X Privacy Policy (x.com/privacy).
10.3 Sign-Up Source Information
When you first visit the website through an address carrying campaign values (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the Company stores those values, the path of the page visited, and the time of the visit in your browser's local storage. This information is used for up to 90 days only and is deleted as soon as you complete a sign-up or login. Information older than 90 days is not used and is deleted from the browser on your next visit.
If you sign up with Telegram or X within that period, the Company receives this information during login and records it with your account together with the sign-up method. The purpose is to measure which channels members sign up through, and the information recorded with the account is kept and destroyed together with the account under Section 3. When an existing member logs in, the information received is not recorded with the account and is deleted once login is complete.
10.4 How to Opt Out
You can refuse or limit analytics and ad performance measurement using the methods below. Installing the Google Analytics Opt-out Browser Add-on stops information from being sent to Google Analytics. X's settings stop X from using this information for personalized ads, but do not stop the X Pixel from sending it. To stop the sending itself, you can use your browser's tracker blocking or an ad-blocking extension; blocking cookies and site data keeps the identifiers used to recognize repeat visits from being stored. Refusing analytics and ad performance measurement does not limit your use of Baro. If you block all cookies and site data in your browser, however, some features such as staying logged in (Section 10.1) may not work.
- Google Analytics: install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout) to stop collection. You can change ad personalization settings for your Google Account in My Ad Center (myadcenter.google.com).
- X: you can turn off personalized ads under Ads preferences in your X account settings. If you have no X account or are not logged in, you can opt out of interest-based ads from X in your current browser through the Digital Advertising Alliance's opt-out page (optout.aboutads.info). See the X Help Center article "Your privacy controls for personalized ads" (help.x.com/en/safety-and-security/privacy-controls-for-tailored-ads) for details.
- Chrome (desktop): delete "Cookies and other site data" under More > Delete browsing data. Blocking third-party cookies alone does not block the cookies this site stores (such as _ga for Google Analytics and _twclid for the X Pixel); to block them, add baro.quest to the sites not allowed to save data under More > Settings > Privacy and security > Site settings > Additional content settings > On-device site data.
- Microsoft Edge: block or delete cookies under Settings and more > Settings > Privacy, search, and services > Cookies.
- Safari (iPhone): turn on "Block All Cookies" under Settings > Apps > Safari > Advanced, or delete data with Settings > Apps > Safari > "Clear History and Website Data".
Deleting cookies and site data in your browser also deletes the sign-up source information described in Section 10.3. Menu names may differ depending on your browser version. Questions or complaints about the processing of behavioral information may be sent to contact@notch.ventures.
11. Minors
Baro is intended, as a rule, for users aged 19 and over. The Company does not knowingly collect personal data from users under 19, and where it learns that a minor is using the Service it may take the measures required by applicable law and the circumstances.
12. Changes to This Policy and Contact
The Company may amend this Policy in line with changes to the law, service features, processors, cross-border processing, or security policy. Where a change is material, the Company will announce the change and its effective date in the Service before it takes effect.
This Policy takes effect on October 19, 2026. This revision adds the website analytics and ad performance measurement tools (Google Analytics and the X Pixel) and sign-up source information. The previous Policy took effect on August 12, 2026, and you can request a copy at contact@notch.ventures.
Questions about the processing of personal data, deletion requests, exercising your rights, or this Policy may be sent to the Baro operations team at contact@notch.ventures.