Authentication
JoyFlick uses Privy for authentication and embedded wallet creation. All information below is confirmed from the live site HTML source, Terms of Service, and Privacy Policy.
Privy Integration
| Property | Value | Source |
|---|---|---|
| Auth domain | privy.joyflick.com | HTML iframe src |
| Privy App ID | cmll1ogwd003w0cksy6vq9bp2 | iframe URL path |
| Embedded wallets | Yes | iframe URL path contains /embedded-wallets |
| CAID | 55f4bc11-de67-4408-95dd-842c50c70cc4 | iframe query parameter |
The Privy integration is loaded as an embedded iframe from:
privy.joyflick.com/apps/cmll1ogwd003w0cksy6vq9bp2/embedded-wallets?caid=55f4bc11-de67-4408-95dd-842c50c70cc4
Auth Methods
The Privacy Policy (Section 1, "Registration Data") mentions:
- Email and password registration
The ToS (Section 4.1) states wallets are controlled "through the authentication method(s) associated with your account."
What is not publicly visible: The specific login methods enabled in the Privy dashboard (e.g., email OTP, Google OAuth, social logins) cannot be confirmed from the HTML source alone. The Privy configuration is loaded client-side and the available methods are determined by the Privy app settings.
Wallet Architecture
Non-Custodial Design
Per ToS Section 4.1:
"The Platform is designed so that a cryptographic wallet is created for you via Privy (or another provider we designate). You control your wallet through the authentication method(s) associated with your account. We do not act as a custodian of your digital assets and do not have unilateral access to transfer your assets."
Key points:
- Wallets are non-custodial — Elympics does not hold user funds directly
- Wallet creation is handled by Privy's embedded wallet infrastructure
- Users control wallets through their auth credentials
- Deleting a platform account does not delete the underlying wallet (ToS Section 10.3)
Platform Controls
Per ToS Section 4.4:
"The Platform may use smart contracts, session keys, permissions, or other technical controls to enable gameplay, entry fees, prizes, and refunds."
This means the platform has delegated transaction authority via session keys — allowing it to initiate on-chain actions (entry fees, prize distribution) on behalf of the user without requiring per-transaction wallet approval. The on-chain settlement target is the Battle Wallet smart contract, which holds player funds non-custodially and enforces match settlement rules.
Supported Asset
- USDC on Base (ToS Section 4.2)
- Contract address:
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913(confirmed in HTML) - "USD" display values in the UI are representations of USDC balance, not bank deposits (ToS Section 4.2)
Session Flow
Not publicly visible. The JWT/session token flow between the Next.js frontend, Privy, and Elympics game servers is not exposed in the public HTML source. What can be inferred:
- User authenticates via Privy (login method configured in Privy dashboard)
- Privy creates/unlocks an embedded wallet for the user
- The platform obtains session keys or permissions to execute on-chain transactions on the user's behalf
- Game sessions likely require an additional auth token for the Elympics game server infrastructure
The specific token format, refresh mechanism, and server-side validation are internal implementation details.
Verification
Per ToS Section 2.5, the platform may perform:
- Age verification
- Location verification
- Identity verification (KYC)
- Sanctions screening
Third-party providers are used for verification (Privacy Policy Section 3, "Verification Providers"). The specific KYC provider is not named publicly.
Data Processing
Per Privacy Policy Section 1:
- Wallet Authentication Data — information used to create and authenticate the wallet via Privy
- Blockchain and Transaction Data — public wallet addresses, top-up records, withdrawal history
- Registration Data — email address and password
Contact for privacy matters: privacy@joyflick.com (Privacy Policy Section 4).