Dark Forest OSOpen app →

DFOS Privacy Policy

Last Updated: March 4, 2026

This Privacy Policy describes the personal information that Metalabel, Inc. ("DFOS," "we," "us," or "our") collects, how we use and share it, and the choices available to you. This Privacy Policy applies to information we collect when you use our website, applications, and other online products and services (collectively, the "Services"), or when you otherwise interact with us.

Information We Collect

Information You Provide

  • Account information, such as your name, email address, and username, and other information you provide when you register for an account.

  • Profile information, such as your display name, bio, avatar, and other information you add to your profile.

  • Space and community information, such as the spaces you create, join, or administer, and your roles and permissions within those spaces.

  • Content you publish, including text, images, audio, video, files, and other materials you upload, post, or distribute through the Services.

  • Transaction information, such as details about purchases, sales, subscriptions, and other transactions you conduct through the Services.

  • Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online.

  • Usage information, such as information about how you use the Services and interact with us.

  • Marketing information, such as your preferences for receiving our marketing communications.

Decentralized Identifiers and Cryptographic Data

When you create an account, the Service generates a Decentralized Identifier (DID) and associated cryptographic key pair on your behalf. Your DID is a globally unique identifier that is not controlled by DFOS. We store your DID and its association with your account. DFOS currently generates and manages cryptographic signing keys on your behalf --- private keys are encrypted at rest using hardware-backed encryption (AWS KMS) and are only decrypted momentarily during signing operations, after which they are cleared from memory. As self-custody options become available, you may choose to manage your own keys. Content you create on the Service is cryptographically signed using your DID, and we store these signatures as part of the content record.

Data Collected Through Integrations

When a Space Administrator authorizes an Integration (such as an API connection, MCP server, or third-party application), that Integration may access and process data within the applicable space, including posts, messages, member profiles, and other content. What data is accessed depends on the permissions configured by the Space Administrator. DFOS logs Integration activity --- which Integrations accessed what data, when, and on whose authorization --- for security and auditing purposes.

Automated Account Data

If you operate an Automated Account, we collect information about the Operator, the nature and purpose of the automation, and logs of the account's activity on the Service. Automated Accounts are issued DIDs, and their actions are cryptographically signed just like human accounts. Information about an Automated Account's identity, Operator, and automated status may be shared with Space Administrators whose spaces the account participates in.

Information We Obtain From Third Parties

  • Social media information. We may maintain pages on social media platforms. When you interact with our pages on those platforms, the platform provider's privacy policy will apply.

  • Third-party sign-in. If you sign in using a third-party service (such as Google or Apple), we may receive information from that service, such as your name and email address.

Automatic Data Collection

We and our service providers may automatically log information about you, your device, and your interaction with our Services, including:

  • Device data, such as your operating system, browser type, IP address, unique identifiers, and general location information.

  • Online activity data, such as pages or screens you viewed, how long you spent on a page, navigation paths, and whether you have opened our marketing emails or clicked links within them.

  • Push notification tokens, such as device identifiers used to deliver push notifications to your device, if you have enabled push notifications.

We collect personal information automatically via cookies, pixel tags, local storage technologies, web beacons or similar technologies (collectively, "Cookies"). Please see our Cookie Policy below for more information.

How We Use Your Personal Information

To Operate and Support the Services

We will use your personal information to perform our contractual obligation under our Terms of Use towards you, such as to:

  • Provide, operate, maintain, secure and improve our Services.

  • Facilitate the creation and management of spaces, including managing membership, permissions, and space settings.

  • Process transactions, including subscription payments and space-level transactions.

  • Communicate with you about our Services, including by sending you announcements, updates, security alerts, and support and administrative messages.

  • Provide support, and respond to your requests, questions and feedback.

Improve, Monitor, Personalize, and Protect Our Services

It is in our legitimate business interests to improve and keep our Services safe for our users, which includes:

  • Troubleshooting, testing and research and to keep the Services secure.

  • Investigating and protecting against fraudulent, harmful, unauthorized or illegal activity.

  • Providing customized Services and communications that may be relevant or of interest to you.

  • Conducting research and development to analyze and improve the Services and to develop new features.

  • Creating anonymous, aggregated data from your personal information.

Marketing

Direct marketing. We may from time-to-time send you direct marketing communications via email as permitted by law. Where required by law, we will only send you marketing emails with your consent. You may opt out of our marketing communications as described in the "Privacy Choices" section below.

To Enforce Our Agreements and Comply With Legal Obligations

We may use your personal information in our legitimate business interests to enforce and comply with our terms and policies, to ensure the integrity of our Services and to defend ourselves against legal claims or disputes. Some processing may also be necessary to comply with a legal obligation.

How We Share Your Personal Information

Other DFOS Users

When you participate in Spaces or use community features, certain information may be visible to other users. This may include your display name, profile information, username, and any content that you choose to share within a Space. What is visible to other members depends on the Space's settings and your own profile visibility preferences.

Space Administrators

Space Administrators may have access to information about Space members as needed to manage their Space, such as your display name, username, profile information, membership status, and activity within the Space. Space Administrators do not have access to your email address or other account-level contact information. Space Administrators are responsible for their own use of this information and must comply with applicable laws.

Service Providers

We share your personal information with third-party companies and individuals that provide services on our behalf or help us operate our Services. These service providers include:

  • Clerk --- authentication and identity management
  • Stripe --- payment processing and subscription billing
  • Amazon Web Services (AWS) --- cloud infrastructure, database hosting, and cryptographic key management (KMS)
  • Stream --- real-time chat infrastructure
  • Vercel --- web application hosting and deployment
  • Imgix --- media content delivery and image processing
  • Resend --- transactional email delivery
  • OneSignal --- push notification delivery
  • CustomerIO --- customer data synchronization and communications
  • Anthropic --- AI-powered features and integrations

These service providers are contractually required to use your personal information only as necessary to provide their services to us.

Professional Advisors

We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Authorities and Others

Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for compliance, fraud prevention, and safety purposes.

Business Transfers

We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction such as a merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. In such a case, we will make reasonable efforts to require the recipient to honor this Privacy Policy.

Privacy Choices

Opt-Out of Marketing Communications

You can opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the emails you receive from us.

Notification Preferences

You can control how and when DFOS contacts you through your notification settings. This includes preferences for push notifications, email notifications, and in-app notifications across categories such as space activity, replies, mentions, and announcements. You can adjust these preferences at any time through your account settings.

Online Tracking Opt-Out

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals. We currently do not respond to "Do Not Track" or similar signals. To find out more, please visit http://www.allaboutdnt.com.

Privacy Rights

Depending on your location, we offer you the following choices:

  • Access. Request information about our processing of your personal information and access to your personal information.

  • Deletion. Request that we delete the personal information that we maintain about you. Upon account deletion, we remove your account and disassociate your personal information from active services. Cryptographic proof records (such as your DID, public keys, and content signatures) are retained as immutable audit records by design --- this is a feature of the platform's architecture, not a failure to delete.

  • Correction. Request that we update or correct inaccuracies in your personal information.

  • Transfer. Request a machine-readable copy of your personal information.

  • Restriction. Request that we restrict the processing of your personal information.

  • Objection. Object to our reliance on our legitimate interests as the basis of our processing.

  • Complain. Complain to a data protection regulator.

Please note that we do not sell or process your personal information for interest-based advertising purposes.

To make privacy-related requests, please contact us at info@dfos.com. You are entitled to exercise all rights described in this section free from discrimination.

Limits on Your Choices

In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations.

Data Within Spaces

Space Data Responsibilities

Space Administrators control the settings and policies of their Spaces, including who can join, what content is visible, and how member information is used within the Space. DFOS processes Space data on behalf of Space Administrators to provide the Service.

Data Retention When Leaving a Space

If you leave a Space, the Space Administrator determines what happens to content you contributed. Content you posted may remain within the Space at the Space Administrator's discretion, and your DID will remain associated with that content. Whether your profile information (such as your display name and avatar) remains visible to other Space members alongside that content depends on your profile visibility settings and whether you share membership in other spaces with those members. You may request removal of your content from the Space Administrator.

Space Administrator Communications

Space Administrators may send communications, such as announcements, to members of their Space using the platform's email delivery infrastructure. When Space Administrators use these tools, DFOS delivers the communications on their behalf --- Space Administrators do not have access to your email address or other contact information. You can control your notification preferences, including communications from spaces, through your account settings.

Integrations and Your Space Data

When a Space Administrator authorizes an Integration for their space, content and data you contribute to that space may be accessed and processed by the Integration. This can include posts, messages, reactions, your profile information as visible within the space, and metadata about your activity. Space Administrators are responsible for informing members when Integrations are authorized and what data they can access. If you have concerns, contact your Space Administrator directly.

AI and Automated Processing

Content within spaces may be accessed by Automated Accounts or processed through Integrations that use artificial intelligence. DFOS does not use the content of private spaces to train its own AI or machine learning models. When a Space Administrator authorizes a third-party Integration, that third party's data practices are governed by their own privacy policy, not ours. We encourage Space Administrators to review the privacy practices of any Integration before authorizing it.

Integration Transparency

DFOS logs Integration activity within spaces --- which Integrations are active, what types of data they've accessed, and when --- for security and auditing purposes. As the platform evolves, DFOS intends to provide Space Administrators with direct visibility into this activity. Members can ask their Space Administrator which Integrations have access to their space, or contact us at info@dfos.com.

Data Portability

Your Right to Export: You may request a complete export of your personal data and content at any time by using export tools or by contacting us at info@dfos.com. Your export will include your profile information, content you've created (with cryptographic signatures intact), a list of your space memberships, and your transaction history where applicable. We will fulfill export requests within thirty (30) days.

What Exports Include and Exclude: Your export includes everything that is yours: your identity, your content, your settings, your transaction records. It does not include other members' data, membership lists of spaces you belong to, or content created by others. This limitation exists to protect the privacy of other members, particularly in private spaces where the membership itself may be sensitive.

Cryptographic Portability: Because your content is signed with your DID, exported content retains its proof of authorship. Anyone who receives your exported content can independently verify that you created it and when, without contacting DFOS. Your content's provenance does not depend on our servers. That's by design.

Cross-Border Processing of Personal Information

As we are based in the United States, you will provide your data directly to us in the United States. Please note that the United States, and other countries to where we may transfer your personal information, may not offer the same protections to your information as the data protection laws where you are based.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for personal information and we will comply with applicable data protection laws.

Third-Party Services

Our Services can contain links to websites and other online services operated by third parties. These links and integrations are not an endorsement of or representation that we are affiliated with any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. Third parties process your personal information in accordance with their own privacy policies.

Information Security

We use reasonable organizational, technical and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration and destruction of personal information. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.

Children

Our Services are not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information through our Services from a child under 18 without the consent of the child's parent or guardian as required by law, we will delete it.

Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws or until you withdraw your consent (where applicable).

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements.

Cryptographic proof metadata --- including your DID, public keys, and content signatures --- is retained permanently by design as part of the platform's verifiable identity and content authenticity architecture. This data enables independent verification of content authorship and is not subject to deletion requests, as it does not contain personal information beyond your public cryptographic identifier.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you, for example through posting the Privacy Policy on our Services or by email. Any modifications will be effective upon our posting the new terms and/or upon implementation of the new changes on our Services.

How to Contact Us

DFOS is a product of Metalabel, Inc., which is the entity responsible for the processing of your personal information and is the data controller in respect of such processing.

You can reach us by email at info@dfos.com or by mail at:

Metalabel, Inc.

120 Walker Street, #4-B

New York, NY 10013

Cookie Policy

This Cookie Policy explains how DFOS uses cookies and similar technologies in connection with our Services. If you have any questions or concerns, please contact us at info@dfos.com.

1. What Are Cookies and Similar Technologies?

  • Cookies are text files that websites store on a visitor's device to uniquely identify the visitor's browser or to store information or settings in the browser.

  • Local storage technologies, like HTML5, provide cookie-equivalent functionality but can store larger amounts of data.

  • Web beacons, also known as pixel tags or clear GIFs, are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

2. How Do We Use Cookies?

We and our service providers automatically log information about an individual's interactions with our Services and communications, such as device information and online activity information.

3. What Types of Cookies Does DFOS Use?

Essential Cookies. These cookies are strictly necessary to provide you with services available through our Services and to use some of its features.

Functional Cookies. These cookies help us understand how our Services are being used and help us customize and improve our Services. DFOS uses first-party analytics only --- we do not use third-party tracking or advertising cookies.

4. How Can I Control Cookies?

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Services may be inaccessible or not function properly.