Privacy Policy

1. Information We Collect

We collect only the information needed to operate the website, waitlist, Founding Crew, and Contributor Pilot expression-of-interest flows. Details may include:

• For the waitlist: the verified email and optional display name returned by Google after sign-in.
• Coach number, Coach Card assignment, source, timestamp, duplicate-waitlist status, Google-verification status, and the time the identity was linked.
• Founding Crew details: your name, email, optional Telegram username, selected reply channel, interests, primary direction, optional time zone, participation rhythm, optional short note, form confirmations, and a hashed private evidence key. Starter Mission evidence may include a short outcome summary, an optional public URL, mission and application references, and optional consent to an anonymized impact receipt.
• For Google sign-in: the provider name, verified email, optional display name, an HMAC-protected provider identifier linked to the waitlist reservation or, when requested, a Founding Crew or Contributor Application ID, plus essential session data. BAIS does not persist the Google access token, refresh token, or raw private access code.
• Contributor Pilot details: your name, email, optional Telegram username, preferred contact method, primary track, time zone, weekly capacity, motivation, a description of a finished result, an optional portfolio URL, and the form confirmations, including that you are at least 18.
• Technical security data such as a hashed IP address and limited user-agent data.
• Cookie and browser-storage preferences.
• Campaign, referral, and advertising click attribution if optional measurement consent is enabled.
• Messages you send to BAIS contact addresses.

2. How We Use Information

• To reserve or return one early-access waitlist status for the same verified Google identity across browsers.
• To send BAIS early-access updates, launch information, and operational notices.
• To operate Founding Crew onboarding, connect a Starter Mission result to the correct application, review evidence, return an Impact Receipt through the selected contact, and record whether an anonymized impact receipt may be published.
• To let you reopen the same waitlist reservation, Founding Crew application, or Contributor application reference on another browser after Google verifies your identity, without revealing or storing a raw private access code.
• To review possible fit for the Contributor Pilot, contact you through the contact method you selected, secure the form, and maintain the records needed to operate the intake.
• To prevent duplicate signups, abuse, spam, and fraud.
• To improve website quality and measure conversion if optional analytics are enabled. Founding Crew and Contributor Pilot analytics never include names, contact details, links, IP or user-agent data, evidence, or free-text answers.
• To respond to privacy, legal, support, and safety requests.

3. Legal Bases

Depending on your location, we process personal information based on your consent, our legitimate interest in operating a secure website and expression-of-interest process, the need to perform requested website services, and legal obligations that may apply to us.

4. Email Communications

Signing in with Google alone does not reserve a waitlist spot or subscribe you. When you select Enter Arena after sign-in, you agree to receive BAIS early-access updates at the verified Google email and can unsubscribe at any time. Founding Crew and Contributor Pilot contacts are separate: they are used only for the selected program's onboarding, mission, evidence, review, and related operational communication and do not subscribe you to the waitlist or marketing messages.

5. Cookies And Browser Storage

The current website uses essential browser storage for the Coach Card experience, cookie preferences, and a short-lived HttpOnly Google sign-in session required to reserve or reopen a waitlist spot and used by optional Founding Crew, Contributor, and Brain Lab access flows. Crew access uses a separate essential session. An active Crew member may explicitly choose a 30-day remembered session on that device; the browser receives an HttpOnly cookie and BAIS stores only a hash of its random session token in protected server storage. If an eligible user explicitly launches Brain Lab, the browser and delivery network may cache the Unity build and Unity may keep local scene save files in browser-managed IndexedDB storage. Google Analytics 4 and its cookies are blocked unless you enable optional Analytics and the website has a valid GA4 configuration. Google may then process pseudonymous page, event, campaign, browser, approximate-location, and device-category data under its own privacy terms. Marketing measurement remains a separate optional choice. See the Cookie Policy for details.

6. Sharing Information

We do not sell personal information. We may share limited information with service providers that help us:

Google authenticates waitlist users under its own terms and privacy policy. BAIS requests only identity scopes needed for sign-in, such as verified email and an optional display name; it does not request access to contacts, files, or social activity.

For a new or legacy-linked waitlist reservation, the private BAIS website Telegram bot sends the administrator the verified Google email, Google-verification status, reservation ID, Coach number, Coach Card assignment, source, referral source, optional share ID, time, and current waitlist total. It does not send the protected provider identifier, session or CSRF token, IP hash, or user-agent data, and repeat access to the same reservation does not create another alert. New waitlist alerts and private-admin status replies allow copying and forwarding; copies can persist. Manual referral confirmations store the owner and friend record IDs, confirmation time, and Telegram admin, update, and message IDs in the private waitlist record. BAIS does not promise an automatic deletion schedule for waitlist alerts.

For Contributor Pilot, Founding Crew, Starter Mission evidence, and Crew check-ins, a dedicated private Telegram bot sends the configured BAIS careers administrator all non-secret answers submitted in the relevant form. Depending on the form, this can include identifiers, both entered contact fields, the selected reply channel, tracks or interests, time zone and availability, free-text motivation, result or evidence summaries, public or private review URLs, tool disclosures, form confirmations, locale, and submission time.

Telegram alerts never contain the Founding Crew private access code, Crew Key, stored secret hashes, CSRF or session tokens, IP hash, or user-agent data. Careers-bot messages are intentionally copyable in the configured private administrator chat so exact IDs can be used with operator commands. The read-only /crew_members command can return the current active Crew-membership record count and corresponding email list to that same administrator. Each alert or command response is scheduled for deletion after about 24 hours, subject to Telegram service behavior, but a copied or forwarded Telegram-side copy can persist outside BAIS control.

When transactional Crew email is enabled, BAIS sends localized membership-activation and accepted-check-in messages through ImprovMX's authenticated SMTP service using STARTTLS. The recipient email, sender, subject, localized message content, and SMTP delivery metadata are transmitted to ImprovMX and the recipient’s mail provider. BAIS keeps only the notification kind, internal source ID, attempt/result timestamps, and provider delivery ID in the private Crew notification journal; it does not place the recipient email or message body in that journal. Repeated operator commands do not intentionally send the same successful notification twice.

• host and secure the website;
• authenticate required waitlist and optional program access through Google;
• store waitlist, Founding Crew, Starter Mission evidence, and Contributor Pilot expression-of-interest data;
• deliver the administrator alerts described above through Telegram;
• send operational or email updates;
• measure website performance, campaign attribution, and conversion quality if optional measurement is enabled;
• respond to lawful requests or protect BAIS users and systems.

7. International Visitors

BAIS may be accessed by visitors from the United States, the European Union, Ukraine, Moldova, and other countries. Your information may be processed in countries other than your own. We aim to use reasonable safeguards when information is transferred internationally.

8. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information. You may also withdraw consent where processing is based on consent. To make a request, email contact@baisgame.com.

9. Children

The website is not directed to children under 13. Founding Crew and Contributor Pilot intake are available only to adults aged 18 or older. If we learn that an expression of interest was submitted by someone under 18, we will remove it.

10. Security And Retention

We keep waitlist information, including the verified Google email and HMAC-protected provider identifier, only as long as needed for early-access operations, launch communication, duplicate prevention, security, legal compliance, and dispute handling. Founding Crew applications, associated Starter Mission evidence, provider-to-Application-ID links, and Contributor Pilot expressions of interest are automatically deleted from BAIS server storage no later than 90 days after submission unless a separate ongoing-membership consent and retention notice later applies. Google sign-in sessions expire after no more than 12 hours. Crew sessions normally expire after no more than 12 hours; a Crew member who explicitly selects “Remember me for 30 days” receives a session that expires after no more than 30 days and can be revoked earlier by signing out, rotating the Crew Key, or requesting deletion. Minimal technical notification records without application answers or evidence may remain only while a Telegram deletion or delivery outcome is unresolved.

Dedicated Founding Crew and Contributor Telegram alerts are scheduled for deletion after about 24 hours when the Telegram Bot API permits it. Telegram service behavior and administrator-account state are outside BAIS server storage, so an API deletion can fail or a copy may persist outside our control.

You may request earlier deletion by emailing the privacy address above and including the application reference or verified waitlist email if available. The operator removes the applicable local record, provider link, and associated evidence and attempts to delete recorded Telegram alerts through their immutable dedicated-bot routes. If Telegram deletion fails or delivery is uncertain, applicant answers and evidence are still deleted locally while only the minimum reconciliation record is retained; BAIS cannot guarantee deletion of a Telegram-side copy. No online service is perfectly secure, so do not send wallet seed phrases, passwords, government ID, tax, banking, or sensitive financial information through this site.

11. Crew Epochs And Signal Cards

Ongoing Crew membership is activated only after separate membership terms are recorded. The private Crew ledger may store a random internal member ID, the application reference, contact details copied from the application, a hash of the private Crew Key, a random Signal ID, contribution titles and summaries, private evidence text or HTTPS links, AI/tool disclosures, review decisions, verified epochs, and publication settings. The Crew Key itself is not stored in readable form.

Contribution evidence is removed from the Crew ledger after its 90-day evidence window while the minimum accepted epoch, track, title, decision, and audit information needed to operate the program may remain until membership is withdrawn or deletion is completed. A deletion request immediately unpublishes the Signal Card and revokes Crew access while exact private records are removed through the operator process.

Signal Cards and the Signal Grid are opt-in and publish only the random Signal ID or chosen alias, verified active epochs, optional joined epoch, verified tracks, and separately approved Impact Receipt titles. They do not publish email, Telegram, time zone, private evidence, pending or unsuccessful submissions, reviewer notes, or Contributor-readiness information. Public URLs, screenshots, search caches, and social-platform previews may persist outside BAIS control after unpublishing, so no sensitive information should be placed in a public alias or receipt title.

A Crew check-in Telegram alert contains the Application ID, member name and email, and all non-secret check-in fields needed for administrator review, including the contribution reference, internal signal reference, track, epoch, title, outcome, evidence type and submitted evidence text or URL, tool disclosure, optional mission reference, public-receipt choice, locale, and time. It never contains the Crew Key, CSRF or session tokens, IP hash, user-agent data, stored secret hashes, or review notes, and is scheduled for deletion after about 24 hours when the Telegram Bot API permits it.

12. BAIS Game Android App

The current BAIS Game Android app does not require an account and does not collect or transmit personal information or other user data from the device to BAIS or third parties. It does not include advertising, analytics, payments, digital-asset or NFT transactions, user-to-user communication, or precise-location collection.

Game configuration, progress, and simulation save data are stored locally on the user's device and are not sent to BAIS. Users can remove this local data through the device's app-storage controls or by uninstalling the app.

If a future app release adds data collection, sharing, accounts, online services, advertising, analytics, payments, or other relevant functionality, BAIS will update this policy and the Google Play Data safety declaration before or with that release.

13. Brain Lab Experimental Web Build

Brain Lab access uses the existing short-lived Google session and the verified waitlist record to decide whether the signed-in Coach reservation has a confirmed referral signal. An approved one-time pre-cutover cohort may retain that signal through a private owner-side entitlement containing fixed batch metadata and SHA-256 hashes of random internal referral record IDs. It does not imitate Google verification, contain the friend's email or Google subject, or leave protected BAIS storage. The access response does not expose the email, Google subject, Coach number, legacy-cohort status, protected referral hashes, session token, or CSRF token.

The Unity scene runs locally in the browser after an explicit launch. The build may use browser cache and IndexedDB-backed local files for performance and scene saves. This pilot does not connect that local scene progress to the Google account or send simulation save files to BAIS. You can remove those local files through your browser's site-data controls.

Consent-aware Brain Lab analytics may record bounded operational events such as page state, launch result, release ID, download size, fullscreen or exit use, and runtime error category. They do not include the user's account or Coach identifier.

14. Changes

We may update this Privacy Policy as BAIS evolves. Material changes should be reflected by updating the date above and, where appropriate, notifying affected users.