Privacy Policy

Oysterworld Inc.

Effective Date: March 1, 2026 · Last Updated: March 4, 2026

Oysterworld Inc. ("Oysterworld," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your data when you use our products and services, including ClawPhones, OpenClaw, Puffy Health, and ClawGlasses (collectively, the "Products"), as well as our websites, mobile applications, and related services (collectively, the "Services").

Our Products operate within a Decentralized Physical Infrastructure Network (DePIN) model. Under this model, you retain ownership of your data. We do not sell your personal data to third parties without your explicit consent.

By using our Products or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of our Products and Services.

1. Information We Collect

We collect the following categories of information in connection with your use of our Products and Services:

1.1 Sensor Data

Our Products incorporate hardware sensors that may collect data including, but not limited to:

• Temperature data — ambient and surface temperature readings from device sensors
• Location data — GPS coordinates, Wi-Fi positioning, and approximate geolocation
• Motion data — accelerometer, gyroscope, and inertial measurement readings
• Biometric data — heart rate, blood oxygen levels, sleep patterns, and other health-related metrics collected through wearable devices (ClawGlasses, Puffy Health)

1.2 Device Data

We collect information about the devices you use to access our Services, including:

• Device model, manufacturer, and operating system version
• Unique device identifiers and hardware serial numbers
• Firmware and software versions
• Network connection type and status
• Battery level and charging state

1.3 Usage Analytics

We collect data about how you interact with our Products and Services, including:

• Feature usage frequency and duration
• App session data and navigation patterns
• Error logs and crash reports
• Performance metrics and diagnostics

1.4 Account Information

When you create an account, we may collect:

• Name and email address
• Account credentials (stored in hashed form)
• Communication preferences
• Wallet addresses (for DePIN participation)

1.5 Information by Product

Product	Primary Data Types
ClawPhones	Device data, usage analytics, location, motion
OpenClaw	Usage analytics, device data, network contributions
Puffy Health	Biometrics, motion, temperature, health analytics
ClawGlasses	Location, motion, sensor data, usage analytics

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and improving our Products and Services — delivering core functionality, personalizing your experience, and developing new features
• DePIN network operations — facilitating decentralized infrastructure contributions, verifying node participation, and distributing rewards
• Health and wellness insights — processing biometric and sensor data to provide you with health analytics and recommendations (Puffy Health, ClawGlasses)
• Safety and security — detecting fraud, preventing abuse, and ensuring the integrity of our network and services
• Analytics and research — understanding usage patterns to improve product performance, conducted using aggregated and de-identified data wherever possible
• Communications — sending service-related notifications, updates, and responding to your inquiries
• Legal compliance — fulfilling our legal obligations and enforcing our terms of service

We process your data based on the following legal bases under the GDPR: performance of a contract, legitimate interests, your consent, and compliance with legal obligations.

3. Data Sharing & Disclosure

We do not sell your personal data to third parties without your explicit consent. This is a foundational principle of our DePIN model and our commitment to data ownership.

We may share your information in the following limited circumstances:

3.1 Service Providers

We engage trusted third-party service providers who assist us in operating our Products and Services (e.g., cloud hosting, analytics, customer support). These providers are contractually obligated to protect your data and may only use it to perform services on our behalf.

3.2 DePIN Network Participants

When you participate in the DePIN network, certain anonymized or aggregated sensor data may be shared with other network participants as part of the decentralized infrastructure. Individual personal data is not disclosed without your consent.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal process (subpoenas, court orders, or government requests)
• Enforcement of our terms of service or other agreements
• Protection of rights, property, or safety of Oysterworld, our users, or the public

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.

3.5 With Your Consent

We may share your data with third parties when you have provided explicit, informed consent to do so.

4. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption — data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access controls — role-based access controls and multi-factor authentication for internal systems
• Infrastructure security — regular security audits, penetration testing, and vulnerability assessments
• Data minimization — we collect only the data necessary for the stated purposes
• Decentralized architecture — our DePIN model distributes data processing, reducing single points of failure and centralized risk

While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents in accordance with applicable laws.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

5.1 Rights Under the GDPR (European Economic Area, United Kingdom)

If you are located in the EEA or UK, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — withdraw previously given consent at any time
• Lodge a complaint — file a complaint with your local data protection authority

5.2 Rights Under the CCPA (California, United States)

If you are a California resident, you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected
• Delete — request deletion of personal information we have collected from you
• Opt-out of sale — direct us not to sell your personal information (note: we do not sell personal data)
• Non-discrimination — exercise your privacy rights without receiving discriminatory treatment
• Correct — request correction of inaccurate personal information

5.3 Exercising Your Rights

To exercise any of the rights described above, please contact us at [email protected]. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling your request.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account data — retained for the duration of your account and for up to 30 days following account deletion
• Sensor and biometric data — retained for up to 24 months from the date of collection, unless you request earlier deletion
• Usage analytics — retained in aggregated, de-identified form for up to 36 months
• DePIN network data — anonymized contributions are retained on the decentralized network as needed for network integrity
• Legal and compliance records — retained as required by applicable law

When data is no longer needed, we securely delete or anonymize it in accordance with our data retention procedures.

7. Children's Privacy

Our Products and Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children under this age.

If we become aware that we have inadvertently collected personal data from a child under the applicable age, we will take prompt steps to delete such data. If you believe that a child has provided us with personal data, please contact us at [email protected].

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you through the Products, by email, or through other appropriate channels
• Where required by law, obtain your consent to material changes

We encourage you to review this Privacy Policy periodically. Your continued use of our Products and Services after the effective date of any changes constitutes your acceptance of the updated policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Oysterworld Inc.
Email: [email protected]

For data protection inquiries or to exercise your privacy rights, please include "Privacy Request" in the subject line of your email. We will acknowledge your request within 48 hours and respond substantively within 30 days.