Privacy Policy

What we collect

• Account data: email, username, display name.
• Authentication data: sign-in method, email or phone where provided, wallet/passkey status, and basic profile info from providers you choose.
• Gameplay data: leagues you join, lineups you set, messages you send in-league.
• Eligibility data: your age and location attestations, IP-derived country/region at the time of attestation, whether you passed, and any blocked reason.
• On-chain data: your Starknet wallet address, entry transfers, refund transfers, payout transfers, transaction hashes, and related contract or prize-pool activity. Public blockchain data is public by nature.
• Payments and support data: service fees, entry amounts, refund requests, manual admin notes, support messages, and operational records needed to reconcile funds.
• Usage data: pages visited, events (e.g. “joined league”), device and browser metadata.

How we use it

• To operate the service (create leagues, score lineups, display standings).
• To contact you about your account, your leagues, and product updates you opted in to.
• To verify age and location eligibility for USDC entry contests.
• To process entries, reconcile escrow, handle refund requests, and distribute prizes.
• To improve the product (analytics on aggregate usage patterns).
• To prevent fraud and abuse.

We do not sell your personal data. We do not share your email with third-party advertisers.

Third-party services

We use a small set of service providers to run the platform:

• Supabase: account storage, eligibility records, gameplay records, and authentication support.
• Privy: embedded wallets, passkeys, and wallet-signing infrastructure.
• Google: if you choose Google sign-in or where Google analytics tools are enabled.
• Starknet: public blockchain where contest escrow runs.
• Swapper.finance: fiat on-ramp services where available and chosen by you.
• Resend: transactional email.
• Google Analytics / Google Tag Manager: aggregate product analytics.
• PostHog: product analytics (events, funnels).
• API-Football: live sports data used for scoring.
• Railway: hosting.

Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember preferences (theme, onboarding progress), and measure product usage. You can clear them from your browser settings at any time; some features may stop working if you do.

Eligibility checks

For USDC entry contests, we ask you to confirm that you are old enough and located in a permitted jurisdiction. We compare that confirmation with IP-derived location signals, then store the result so we can enforce restrictions, answer refund/support questions, and show why an entry was allowed or blocked.

Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete your account and associated data by emailing us. On-chain transactions cannot be deleted because they are public and immutable by design.

Data retention

We keep account data for as long as your account is active. If you delete your account, we remove personal data within 30 days except where we are required to retain it for legal, tax, accounting, eligibility, refund, dispute, security, or anti-fraud reasons.

Children

Gaffer is not directed at children under 18. If you believe a child has created an account, contact us and we will remove it.

Changes

We may update this policy. Material changes will be communicated by email and surfaced in-app before they take effect.

Contact

Privacy questions: legal@playgaffer.xyz.