This policy covers the THE MOON BOY website (themoonboyxrp.com), the Moon Base Telegram Mini App, and the @orion_tmbx_bot Telegram bot. They are one product operated by the same team, so one policy covers all three.
The short version: we store what is needed to run a game account and nothing else, we never ask for or hold your private keys, and everything you do on the XRP Ledger is public by the ledger's own design — not because of anything we do.
What we never have
Your seed phrase or private keys. There is no code path in this project that asks for them, and no place to store them if you sent them. Every transaction — linking a wallet, buying an NFT, trading $TMBX — is signed by you in Xaman on your own device. If anyone claiming to be from THE MOON BOY asks for a seed phrase, they are stealing from you.
What we collect
From Telegram
When you open the Mini App or message the bot, Telegram gives us your numeric user ID, username and first name. The user ID is your account key — without it there is no way to hand you back your own base. We do not receive your phone number or your contacts.
Your XRPL address, if you link one
Linking is optional and always your action. Once linked we store the address and, refreshed from the public ledger, your $TMBX balance, whether you hold TMBX/XRP LP tokens, and which THE MOON BOY NFTs you hold. Those reads decide your holder tier, your liquidity bonus, and whether a Land Plot or Orion Agent unlocks its in-game feature. All of it is already public on the XRP Ledger; we read it, we do not create it.
Your game state
Energy, taps, tap power, Moon Dust, monthly score, buildings, completed tasks, daily-bonus streak, reactor heat, your mission log, and who referred you.
Messages to your Orion agent
If you own an Orion Agent NFT and chat with it, the text of those messages and the replies is stored against your account, with a timestamp, so the conversation has memory. Do not put anything sensitive in them.
Trading and DCA settings
If you configure a DCA strategy we store its action, amount, and whether it is active. We do not store payment card details — there are none; everything settles on the XRP Ledger.
Server logs
Our web server records ordinary access logs — IP address, timestamp, the URL requested, user agent — for roughly two months. They exist to block abuse (automated scanners and credential probes hit this server daily) and to count traffic. They are not linked to your game account.
What we do not do
- No analytics or tracking. No Google Analytics, no Meta pixel, no third-party tracker of any kind on this site or in the Mini App.
- No advertising cookies. This site sets no cookies at all. The Mini App stores one value on your own device — which leaderboard rank you last saw, so it does not congratulate you twice. It never leaves your device.
- We do not sell or rent your data. Not to anyone, for any price.
Who else sees your data
- Telegram — the platform the bot and Mini App run on, under Telegram's own privacy policy.
- Google — messages you send to your Orion agent are sent to the Gemini API to generate a reply. Do not send anything you would not want processed by a third-party AI service.
- Xaman (XUMM) — when you link a wallet or sign a transaction, Xaman receives the request and your address, under its own policy. We never receive your keys through it.
- The XRP Ledger — a public, permanent, worldwide ledger. Any transaction you sign is visible to anyone forever. That is a property of the blockchain, not a choice we make, and it cannot be undone by us or by you.
There is no other recipient. No data broker, no advertising network, no analytics vendor.
How long we keep it
Your account data is kept while your account exists, because deleting it would delete your base. Server logs roll off after roughly two months. Ask us to delete your account and we remove your game record, your linked address and your agent chat history.
Two things we cannot delete, and want to be honest about: anything already written to the XRP Ledger, which no one can erase; and data already held by Telegram, Google or Xaman under their own policies — you would need to ask them directly.
Children
This product is not intended for anyone under 13, and Telegram's own terms set a minimum age as well. We do not knowingly collect data from children.
Contact
For a copy of your data, a correction, or deletion, reach us in the official Telegram community: t.me/themoonboyXRP. Say what you are asking for and which Telegram account it concerns.
Changes
This page describes the system as it actually is, so when the system changes this page changes with it, and the date at the top moves. Material changes will be announced in the Telegram community rather than made quietly.