Moment of Zen — Privacy Policy

This Privacy Policy explains how 3LOGIC LLC ("3LOGIC," "we," "us," or "our") collects, uses, shares, retains, and protects information in connection with Moment of Zen (the "Service"), and describes the choices and rights available to you.

Moment of Zen is a digital experience provided by 3LOGIC and accessible through momentofzen.art, including through NFC tags and QR codes associated with 3MAGIC™ figurines and other products. The Service includes webpages and digital content about the values and teachings represented by those products, Dharma Wisdom Cards, Apple Wallet and compatible digital wallet passes, subscription and update services, and related account, purchase, sharing, and feedback features.

Capitalized terms not defined in this Privacy Policy have the meanings given to them in our Terms of Service.

Last updated: September 27, 2026

At a glance

• No accounts needed for the basics. We do not ask for your name or email to activate a Tag. We receive them only if you sign in, buy something, or choose to give them to us with feedback.
• We verify Tag scans. Each time a Tag link is opened, we record limited technical information such as the time, IP address and browser details to verify genuine products, detect copied or cloned Tags, prevent abuse, and show the appropriate experience.
• We use device information to make the Service work correctly and securely. When you activate, add a card, or add a phone, we use limited technical information about your device and browser. This helps us provide a compatible wallet experience, recognise linked devices, enforce device limits, and prevent misuse. We do not use this information for advertising or cross-site tracking.
• No selling, no ads, no trackers. We do not sell your personal information. We do not share it for advertising. We do not use third-party analytics or advertising tools.
• Payments are handled by Stripe. We never receive your full card number.
• You have rights. You can ask us for a copy of your information, to correct it, or to delete it, wherever you live (Section 9).

1. Who is responsible

For the Moment of Zen and 3MAGIC Service, 3LOGIC decides how and why your personal information is used, and is responsible for it (the "controller").

3LOGIC also provides technology that may be used for products offered by other companies. For some of those products, 3LOGIC processes personal information on behalf of the other company and under its instructions. In other circumstances, 3LOGIC may process limited information for its own purposes, such as operating and securing the platform, preventing fraud and abuse, complying with law, and protecting our rights and users. The privacy notice that applies to the relevant product will explain the applicable roles.

This Policy does not cover the services of Apple, Google, Stripe, or the retailer you bought your figurine from. They handle information under their own privacy policies.

2. What we collect, and when

2.1 When anyone taps a Tag

Each time a Tag's link is opened, we record the following, whether or not the person owns the figurine and whether or not the Tag is activated:

• the Tag's model and serial number, and its status;
• the date and time;
• the IP address;
• the browser's user-agent string (browser, operating system and version);
• if the browser already has our cookie, which of our device records it belongs to.

This happens as the page loads, before any activation or account step. It lets us check that the Tag is genuine, detect copied links and cloned Tags, prevent abuse, and show the right page. The first page opened by a Tag should provide a short notice and a link to this Privacy Policy.

2.2 When you activate a Tag

• Agreement record:
  • the versions of the Terms and this Policy you accepted, including their language;
  • your confirmation that you meet the Service's minimum age requirement;
  • the times you ticked each box and clicked to continue, as your device reported them;
  • the times our server received them;
  • the scan (Section 2.1) during which you agreed.
• Preferences that shape your cards:
  • your device's time zone, which sets when your "day" starts;
  • your browser's preferred languages and the language we pick from them;
  • the first day of the week for your region.
  We do not look up your location from your IP address.
• Device information (Section 2.3) and our device cookie (Section 7).

We create a user record and a device record, and link the Tag to them.

2.3 Device information and compatibility

When you activate a Tag, add a card or phone, or return to your cards from a linked device, we use limited technical information about your device and browser to help the Service work correctly and securely.

Why we use this information. Device information helps us:

• provide Passes and wallet features that are compatible with your device and software, as wallet technologies and operating systems change over time;
• recognise devices that are linked to your Tags, cards or account;
• apply device limits and help you add, replace or identify your phones;
• detect unusual activity, copied links, automated requests and other misuse; and
• diagnose compatibility problems and improve how the Service works across different devices.

What we receive. Depending on what your browser makes available, this may include:

• device type and model or model family;
• operating system and version;
• browser and version;
• screen dimensions and pixel ratio;
• language and time-zone information;
• touch and other basic device capabilities; and
• other technical signals that help us understand device compatibility or distinguish one device environment from another.

For example, device and operating-system information may help us determine which Apple Wallet or compatible digital wallet features your device supports so that we can provide an appropriate Pass experience.

Device recognition. We may combine a limited set of these technical characteristics into a one-way technical signature, sometimes called a device fingerprint. We use this as an additional signal to help distinguish devices and detect misuse. It is not our primary way of identifying you, and a matching signature is not treated as proof of your identity.

What we do not use this information for.

• We do not use it to track you across other websites or apps.
• We do not use it for advertising or advertising profiles.
• We do not combine it with information from data brokers.
• We do not use it to determine your precise location.
• We do not use these characteristics for biometric identification or recognition.

2.4 Wallet passes

What we create. For each Pass we issue, we keep:

• its serial number and authentication token;
• which Tag, user and theme it belongs to;
• the content we put on it;
• a copy of the Pass file.

What your wallet app sends us. When you add an updating Pass, your wallet app sends:

• a device library identifier and a push token, which we need to deliver updates;
• error reports about the Pass.

What we do not receive through the Pass update service. The wallet app does not provide your name, Apple ID, phone number, contacts or precise location as part of the Pass registration and update protocol.

When we stop. When you remove the Pass, or Apple tells us the push token is no longer valid, we delete that registration.

2.5 Adding or replacing a phone

If a phone that is not linked to an activated Tag scans it, we record a request to add that phone. The request includes the phone's device type, operating system, browser and IP address.

• The Tag's owner, or our support team, sees these details in order to approve or decline the request.
• If the request is approved, we collect device information from the new phone (Section 2.3).

2.6 Sharing, claiming and My cards

If you share. We record the share link, the card, and whether and when it was claimed. The recipient receives the card's content. We do not show them your name or contact details.

If you add a card someone shared with you. We create a user record and device record for you, with:

• the device information in Section 2.3;
• your time zone and languages;
• your agreement to the Terms and this Policy.

My cards and collections. We record which cards belong to you, the collections you create, and your downloads.

2.7 Accounts (Sign in with Apple or Google)

If you sign in, we receive and store:

• from Google: your Google account identifier, your name, your email address, and whether Google has verified it;
• from Apple: your Apple identifier, your email address or an Apple "Hide My Email" relay address, and your name if you choose to share it.

We also keep:

• when you signed in;
• a record of your session;
• the versions of the Terms and this Policy you accepted when you created the account.

We never receive your Apple or Google password. If you use Apple's relay address, Apple forwards our emails to you. We have no access to your real address.

2.8 Purchases

Stripe processes payments and calculates tax. Stripe collects your payment details and billing address directly. We receive:

• a Stripe customer reference;
• what you bought, the price tier and plan;
• amounts, dates, trial and renewal status;
• records of payments, failed payments, refunds and disputes.

We never receive your full card number.

2.9 Feedback and support

What we receive. If you send feedback, we receive:

• your rating and message;
• any screenshots or documents you attach;
• your name and email, if you choose to give them;
• the card and Pass it concerns, your language, IP address and browser details.

Linking to records. Feedback sent from a card is linked to that card and to our records for it.

Emails. If you email us, we keep the email and our reply.

2.10 Benefits granted by our team

If our support team gives you a subscription or other benefit, for example to resolve a problem, we record the grant, who made it, and the Pass it is for. If you have not signed in yet, we may create a placeholder account for it. It becomes yours when you sign in.

2.11 Server logs

Our servers log requests, including IP address, time, the page requested, the result, and technical identifiers. We use these logs to keep the Service running and secure.

When we need to diagnose a specific problem, we may for a short time turn on detailed diagnostic logging. This records complete requests, including cookies and form contents.

2.12 What we do not collect

• precise location;
• your contacts or photos, other than files you choose to attach;
• biometric identifiers;
• health information.

We do not use your cards or activity to infer your mood, health, religious beliefs or other sensitive characteristics. If we ever want to, we will ask for your separate, explicit consent first.

3. How we use information

• To provide the Service:
  • activate Tags, and issue and update Passes;
  • choose each day's card for your time zone and language;
  • run My cards, sharing, downloads, and download and share credits;
  • provide accounts and subscriptions.
• To provide a compatible experience and recognise authorised devices: determine which Pass and wallet features are appropriate for your device and software, recognise devices linked to your Tags or cards, apply device limits and approvals, and determine owner pricing. If you think we got an owner-pricing decision wrong, contact us and a person will review it.
• To protect genuine products and the Service: detect cloned Tags, copied links, attempts to bypass device limits, automated or unusual activity, fraud and other misuse, and keep the Service secure.
• To keep records of your agreement to our Terms and this Policy, and to handle disputes.
• To process payments, keep financial records and meet tax obligations.
• To communicate with you:
  • notices on your Pass about the Service and new features;
  • emails about your account and purchases, such as receipts, trial and renewal reminders, and price-change notices;
  • replies to your feedback and support requests.
  We do not send marketing emails unless you agree to receive them.
• To understand and improve the Service, using our own operational records and aggregate counts, such as how many Tags are activated and how many Passes stay in wallets. We do not use device information or technical signatures from Section 2.3 to build behavioural profiles or track your activity across unrelated websites or apps, and we do not use third-party analytics services.
• To comply with the law and protect the rights, safety and property of our users, 3LOGIC and others.

4. Legal bases for users in the EEA and UK

If you are in the European Economic Area or the United Kingdom, applicable data protection law requires us to identify a legal basis for using your personal information. Depending on the purpose, we rely on the bases below.

We do not rely on legitimate interests to use device information or technical signatures for advertising, cross-site tracking, behavioural advertising profiles, or decisions that have legal or similarly significant effects on you.

5. Who we share information with

We do not sell your personal information. We do not "share" it for cross-context behavioural advertising. We do not disclose it to data brokers. We disclose it only to:

• Our service providers, who act on our instructions under contract:
  • Amazon Web Services, for hosting and content delivery in the United States;
  • GitHub, for deploying our software; it does not receive user data.
• Apple, to deliver Passes and updates through its push notification service, which receives the push token and not your identity, and when you use Sign in with Apple.
• Google, when you use Sign in with Google.
• Stripe, to process payments, calculate tax, send receipts and reminders, and prevent payment fraud. Stripe also uses some information as an independent controller under its own privacy policy, for example for fraud prevention and its Link service.
• The devices linked to your Tag. A Tag's linked devices can see its activation record, including the time, IP address and browser details used to activate it, and requests to add a phone.
• People you share cards with, who receive the card's content.
• Other brands on our platform, only for their own products and not for Moment of Zen.
• Authorities and others where required, to comply with law or valid legal process, or to protect the rights, safety or property of our users, 3LOGIC or others.
• A successor, if we are involved in a merger, acquisition or sale of assets. Your information would remain subject to this Policy, and we would tell you before it becomes subject to a different policy.

Where our web pages use fonts hosted on our own servers, loading those fonts does not send your IP address to an external font provider.

6. Who at 3LOGIC can see your information

A small number of 3LOGIC staff can see personal information in our systems, using an administration console.

• How they sign in: they sign in individually, and access is limited to what their role needs.
• What is recorded: administrative actions, such as grants and approvals, record who performed them.
• Why they look: to provide support, approve new phones, handle feedback, investigate misuse and run the Service.
• What stays hidden: secret values, such as authentication tokens, are hidden even from staff.

Where another company's products run on our platform, that company's authorised staff can see information about their own products only.

7. Cookies and similar technology

We use first-party cookies and similar technologies for functions such as recognising linked devices, keeping you signed in, operating My cards and sharing features, and securing the Service. We do not use advertising cookies, third-party analytics cookies, advertising pixels or cross-site tracking scripts. Where applicable law requires consent before we store or access information on your device, we obtain that consent unless an applicable exception applies. Our cookies are signed, so they cannot be altered, and are not readable by scripts on the page.

If you block or delete these cookies, the features that need them will not work on that browser (see Terms Section 6.1).

The pages of Stripe, Apple and Google that you visit to pay or sign in set their own cookies under their own policies.

Device information is read as described in Section 2.3. We honour Global Privacy Control signals where applicable. Because we do not sell or share personal information for cross-context behavioural advertising, such signals generally do not change how the Service works.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing and maintaining the Service, protecting the Service and genuine products, keeping appropriate records of agreements and transactions, responding to support requests, resolving disputes, and meeting legal, accounting, tax, and regulatory obligations.

How long we keep particular information depends on factors such as:

• the nature and sensitivity of the information;
• the purpose for which we collected or use it;
• whether your Tag, Pass, device, subscription, or account remains active;
• whether the information is needed for security, fraud prevention, troubleshooting, support, or dispute resolution;
• applicable legal, accounting, tax, contractual, or regulatory requirements; and
• whether the information can instead be deleted, de-identified, or aggregated.

In general:

• Service and device information is kept while it is reasonably needed to provide the relevant Tag, Pass, card, device, account, or subscription features, and for a reasonable period afterward where needed for security, support, fraud prevention, or recordkeeping.
• Security and technical records, such as scan records, server logs, and diagnostic information, are generally kept for shorter periods unless they are needed to investigate abuse, a security incident, or another specific problem.
• Agreement, purchase, payment, tax, and other business records may be kept for longer where needed to comply with law, maintain appropriate financial records, resolve disputes, or establish or defend legal claims.
• Support and feedback records are kept for as long as reasonably needed to respond to the issue, improve the Service, maintain an appropriate history of the interaction, or resolve related disputes.
• Wallet registrations and update credentials are kept while needed to provide Pass updates and are no longer used when the registration is no longer active or valid.
• Backups may retain information for a limited period after it has been removed from active systems until those backups are overwritten or retired in the ordinary course.

When personal information is no longer reasonably needed, we delete it, de-identify it, or otherwise stop using it in identifiable form, subject to any retention that is permitted or required by law. We may retain aggregated or de-identified information that no longer identifies you.

9. Your choices and rights

9.1 Choices you can make yourself

• Notifications and updates. Turn a Pass's notifications or automatic updates off in your wallet app, or remove the Pass. Removing a Pass stops updates but does not cancel a subscription.
• Subscriptions. Cancel any time from "Manage subscription".
• Cookies. Delete our cookies in your browser settings, with the effects described in Section 7.
• Feedback. Leave the name and email fields empty.

9.2 Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy, in a portable format where applicable;
• correct it;
• delete it;
• stop or limit certain uses, or object to uses based on our legitimate interests;
• withdraw a consent you gave.

Some laws give you further rights. We will honour them where they apply.

9.3 How to make a request

• Where to send it: email privacy@3logic.io.
• How we check it is you: because most of our records are not tied to a name, we may ask you to show that the information is yours. For example, open a link we send you on a device linked to your Tag, sign in to your account, or reply from your account email.
• Agents: an authorised agent may make a request for you, with proof of authority.
• How long we take: we generally respond within 30 days. Where applicable law provides a different response period or permits an extension, we may use that period and will tell you if additional time is required.
• No discrimination: we will not treat you differently for exercising your rights.

9.4 What deletion means here

We will delete or de-identify the personal information in our systems that is covered by your request, including, where applicable, your user, device and account records, the Passes and cards linked to them, your feedback, and our logs about you. Where applicable, we will instruct service providers that process personal information on our behalf to delete it. Third parties that act as independent controllers for some activities, such as certain payment, fraud-prevention, or legal-compliance activities, may retain information as permitted or required under their own legal obligations and privacy policies. If you signed in with Apple, we will revoke our access to your Apple sign-in where appropriate.

We keep only:

• the fact that your Tag was activated, and your agreement record;
• purchase and tax records;
• anything we must keep by law.

We keep these for the periods in Section 8. Passes already on your device stay there, because we cannot remove them, but they stop updating. Deleting your information does not cancel a subscription, so cancel it first.

9.5 If we refuse, and complaints

If we decline your request, we will explain why. You may appeal by replying to our decision, and we will answer within 45 days. You also have the right to complain to your data protection authority, for example in the EEA or UK, or your state attorney general.

10. Age requirements

Moment of Zen is intended for adults. You must be at least 18 years old to activate a Tag, add or claim a card, create an account, purchase a subscription, or use other personalised features of the Service.

We may ask you to confirm that you are 18 or older before allowing access to these features. We do not need your exact date of birth for this purpose.

If you tell us that you are under 18, we will not allow you to complete the activation, card-claim, account, or purchase process or create the associated persistent user and device profile.

We do not knowingly collect personal information through these features from children under 13. If we learn that we have collected personal information from a child under 13 in circumstances not permitted by law, we will take appropriate steps, which may include deleting the information.

If you believe that a child has provided personal information to us, please contact us using the information in Section 15.

11. Security

We use measures suited to the information we hold, including:

• encrypted connections;
• cryptographically signed Tag links and cookies;
• storing only one-way hashes of session and pairing secrets;
• restricted, individual staff access with records of administrative actions;
• separation of our servers' duties;
• keeping payment card details with Stripe.

No system is completely secure. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

12. Where your information is processed

We are based in the United States, and the Service is hosted in the United States. If you use the Service from another country, your information is collected by us directly and processed in the United States. The data protection laws of the United States may differ from those in your country. Where applicable law requires safeguards for international transfers, we and our service providers use recognised transfer mechanisms as appropriate, which may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Addendum, the EU–U.S. Data Privacy Framework, or other legally recognised mechanisms.

13. U.S. state privacy rights

Residents of certain U.S. states may have additional privacy rights under applicable law. Where those laws apply to 3LOGIC or to particular processing, we will honour those rights as required.

The types of personal information we collect and the circumstances in which we collect it are described in Section 2. Our purposes for using information are described in Section 3, the recipients of information in Section 5, our retention practices in Section 8, and the rights and request process we make available in Section 9.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We do not use device information or technical signatures to build advertising or behavioural profiles or to track you across unrelated websites or apps.

We do not intentionally collect information about your health, precise location, biometric identifiers or other sensitive characteristics, and we do not use your cards, collections or activity to infer your religious or philosophical beliefs or other sensitive characteristics.

14. Changes to this Policy

We will update this Policy when our practices change.

• Notice: if we make a material change, we will tell you at least 30 days before it takes effect, by email if you have an account, by a notice on your Pass, or in the Service.
• Consent: if a change needs your consent, we will ask for it.
• Records: we record which version you accepted. Earlier versions are available on request.

15. Contact

3LOGIC LLC · 23515 NE Novelty Hill Rd., Ste. B221-294, Redmond, WA 98053 · Privacy: privacy@3logic.io · Support: support@3logic.io

End of Privacy Policy.