Privacy Policy | Frak

Last updated: November 5, 2026

1. Introduction

Frak Labs places particular importance on protecting users' privacy.

The Frak platform has been designed around a data minimization principle, aimed at limiting the collection and storage of personal information as much as possible.

Unlike many digital services, Frak does not require the creation of an account based on personal information such as:

  • name
  • email address
  • phone number

Use of the application relies on a biometric credential associated with a unique digital wallet.

This policy explains:

  • which data is used;
  • how it is processed;
  • what rights users have.

Data is processed in accordance with the General Data Protection Regulation (GDPR).

2. Data controller

The data controller is:

Frak Labs - 40, rue BEZOUT - 75014 PARIS

SIRET 953 585 783 000 12

RCS PARIS B 953 585 783

NAF code 6209Z

Contact: contact@frak-labs.com

3. Account creation and user identifier

Access to the Frak application relies on the creation of a digital wallet.

This wallet is generated from a biometric authentication process carried out on the user's device.

This process creates a unique identifier corresponding to a wallet address

Frak does not collect or store:

  • name
  • phone number
  • biometric data

Users may add an email address. It is optional and used only to recover access to their account. It is never used to send unsolicited messages.

Biometric authentication is performed using the WebAuthN (FIDO) protocol. This standard ensures that biometric data is stored exclusively on the user's device, via the operating system's security mechanisms (Face ID, Touch ID or equivalent), to which Frak never has access.

Frak never has access to this biometric data.

4. Data used by the platform

Although Frak does not collect personally identifiable information, certain technical data may be used to operate the service.

This data includes, in particular:

  • wallet address (user identifier)
  • information related to recommendations
  • information related to rewards
  • interactions with partner brands

This information is used, in particular, to:

  • identify the origin of a recommendation
  • allocate a reward
  • ensure the security of the service.

Frak Game

Frak runs a game with a cash prize. Users join a game by entering its code in the Frak application, or by signing up with a friend's referral code while a game is open.

During the game, users earn tickets: 1 for joining, 2 more for certifying their Instagram account, 1 for each friend who signs up with their code, 1 for each friend who reaches a wallet through a brand they shared, and 3 for each purchase at a partner brand, their own or one made by a friend they referred.

At the end of the game, tickets are drawn using a public random number (drand), so anyone can check the draw. A drawn user must have certified their Instagram account and follow @frak_fr within 24 hours, otherwise the next drawn ticket takes the turn. Frak reviews the winner before announcing them.

To run the game, Frak processes:

  • the games joined, when they were joined and the code used;
  • the friends who signed up with the user's code, and the friend whose code the user used;
  • the purchases and shares that earned tickets (the partner brand and the date, not the content of the order) and the ticket count;
  • the result of the draw;
  • the rewards earned, their status (locked, unlocked, expired) and what unlocked them.

Instagram

Users can add their Instagram account to Frak in two ways:

  • declare it: the user types their Instagram username in the application. Frak stores it as typed, without checking it. If one of their tickets is drawn, they have 24 hours to certify their account;
  • certify it: the application gives the user a one-time code, which they send in a private message to Frak's Instagram account, @frak_fr.

Frak never asks for the user's Instagram password and never accesses their account.

When a user messages @frak_fr, Instagram (Meta Platforms) provides Frak with:

  • an identifier that Instagram assigns to the user for Frak's account only;
  • their Instagram username;
  • the content of the message, used only to read the code it contains;
  • whether they follow @frak_fr, and when this was last checked.

Frak uses this data to link the Instagram account to the Frak wallet and to check that the user follows @frak_fr, which a drawn user must do to win. Frak checks again when the user opens the game or Instagram page in the application, and when one of their tickets is drawn.

This data is not used for advertising and is not shared with partner brands.

Instagram processes messages under its own privacy policy: https://privacycenter.instagram.com/policy

5. Data recorded on the blockchain

Certain information related to transactions or rewards may be recorded on a blockchain infrastructure.

This data is:

  • public or pseudonymized depending on the technology used
  • linked only to the wallet address

Frak Labs does not control the blockchain infrastructure and cannot modify or delete data recorded on it.

6. Analytics data

To improve the user experience and the operation of the platform, Frak may analyze certain technical data related to use of the application.

This data may include:

  • navigation within the application
  • interactions with features
  • use of sharing mechanisms
  • events related to purchases or rewards

These analytics are performed via OpenPanel, a self-hosted analytics solution based in Europe.

Analytics data:

  • is anonymized;
  • does not allow users to be directly identified;
  • is used solely to improve the service.

7. Sharing data with partners

Certain information may be shared with partners when necessary to provide the service.

Partner brands

When a recommendation leads to a purchase, certain technical information may be transmitted to the partner brand in order to:

  • identify the origin of the recommendation
  • validate the allocation of the reward.

Payment services

Financial operations associated with rewards may be carried out by specialized partners, including Monerium.

These partners may process certain data necessary to execute payments.

Processing of this data is subject to their own privacy policies.

8. Data hosting

The technical data used by Frak is hosted within the European Union.

Frak does not transfer personal data outside the European Economic Area.

To check that a user follows @frak_fr, Frak sends their Instagram identifier to the Instagram API operated by Meta Platforms.

9. Retention period

Technical data required to operate the platform is kept only for the duration necessary to run the service.

Anonymized analytics data may be retained for statistical purposes.

Frak Game and Instagram data are kept as long as needed to run the game, and afterwards only what is needed to justify a reward or a prize that was paid.

10. Security

Frak implements technical measures to protect the data used by the platform.

These measures include, in particular:

  • encryption of communications
  • application-level security mechanisms
  • limiting the data collected.

11. User rights

In accordance with the General Data Protection Regulation (GDPR), users have rights over the personal data concerning them.

However, to the extent that Frak does not directly collect personally identifiable information, the exercise of certain rights may be limited.

Any request may be sent to: contact@frak-labs.com

To delete only their Instagram data, users can write to contact@frak-labs.com with their Instagram username. A declared username can also be removed at any time from the application.

12. Policy updates

Frak may update this policy to reflect:

  • changes to the service
  • regulatory changes

Users will be informed of any material change.

13. Contact

For any question regarding data protection:

contact@frak-labs.com