Privacy Policy

Introduction

This privacy policy explains how we collect, use, retain, and protect your personal information when you use our casino app (the "Service"). We are committed to protecting your privacy and ensuring transparency about how we handle your data.

1. Data We Collect

1.1 Account Information

• Display name (required to use the service)
• Avatar (optional — you may choose a pre-made avatar or upload a photo)
• Country/region (inferred from IP or billing address; used for geolocation controls and tax compliance)
• Date of birth (required for age verification; 21+ enforced in-app, 18+ store-rated)
• Email address (for account recovery and notifications)

1.2 Social & Gameplay Data

• Friends list (players you have connected with in-app)
• Presence status (whether you are currently online and your current activity)
• Wallet ledger (coin balances, transaction history, purchases, bonus credits, play duration)
• Game history (results of individual spins, hands, and draws)
• Club/team membership (if applicable)

1.3 Purchase & Billing Data

• Purchase history (items purchased, dates, amounts, payment method type — but NOT card details, which are handled by the app store)
• Session history (login times, play duration, refund/chargeback events)

1.4 Device & Technical Data

• Device type, OS version (to troubleshoot crashes and optimize performance)
• App version (for support and debugging)
• IP address (for geolocation checks; WA/AK and permanently excluded regions are blocked at the API)
• Crash logs (anonymized, to improve stability)
• Analytics events (game played, features used, session length — aggregated, not linked to your identity)

1.5 What We Do NOT Collect

• Card numbers or payment information (handled by Apple and Google, not by us)
• Location data beyond country/region inference
• Browsing history outside the app
• Biometric data

2. How We Use Your Data

2.1 Core Service Delivery

• Account identity and authentication
• Rendering your profile, friends list, and social features
• Processing coin purchases and managing your wallet
• Determining game outcomes and maintaining the ledger
• Enforcing age and geographic restrictions
• Providing customer support

2.2 Safety & Compliance

• Detecting fraud, refund abuse, and modified clients
• Complying with gambling regulations (WA, regional blocklists)
• Enforcing responsible-play tooling (session timer, daily spending cap, self-exclusion)
• Auditing outcomes for disputes
• Preventing money laundering

2.3 Service Improvement

• Aggregated analytics to understand feature usage and player retention
• Crash logs to identify and fix bugs
• A/B testing new features (with your explicit consent for changes to odds or RTP)

2.4 What We Do NOT Do

• We do NOT sell personal data to third parties
• We do NOT use your profile or friend graph for targeted advertising
• We do NOT share your real name with other players (only your chosen display name)
• We do NOT use your purchase history for gambling-escalation marketing ("chase your losses")

3. Legal Basis for Processing

US Players (and other permitted regions)

Your data is processed under these legal bases:

• Contract performance: to deliver the game and manage your account
• Legitimate interest: to improve the service, detect fraud, and ensure security
• Legal obligation: to comply with gambling regulations and financial reporting

Soft-Launch Markets (future)

For players in Canada, Australia, New Zealand, and the Philippines: Additional consents and notices will be provided per local privacy law (PIPEDA, Privacy Act, etc.) at the time those markets open.

4. Data Retention

Data Category	Retention Period	Reason
Account profile (name, avatar, country)	Until account deletion	Core service delivery
Wallet & transaction ledger	7 years	Regulatory & fraud audit trail
Game history (individual spins)	1 year	Dispute resolution; older records archived
Friend graph & presence	Until account deletion	Social features
Crash logs & technical data	90 days	Debugging & support
Analytics (aggregated)	2 years	Service improvement

Deleted accounts: After deletion, your display name, profile, and avatar are removed. Your wallet ledger is retained anonymized (linked to a deletion timestamp, not your identity) to preserve the integrity of the game economy and audit trail.

5. Third Parties & Data Sharing

Service Providers (Processors)

• Apple & Google (payment processing, app store listing, age verification)
• Amazon Web Services (cloud infrastructure; data held in us-east-1)
• Analytics provider (aggregate, anonymized event data only)
• Crash reporting (anonymized stack traces to track stability)

We do NOT share your personal data with these providers beyond what is necessary for them to deliver their service. Each processor is bound by a data processing agreement.

Legal Requirements

We may disclose your data if required by law, court order, or valid government request (e.g., a warrant for a refund-abuse investigation).

No Sale

We do NOT sell your personal data.

6. Your Data Rights

Right to Access

You can request a copy of your personal data, including:

• Your profile information
• Your complete wallet ledger and transaction history
• Your friend graph
• Your game history

How to request: Email support@casino-app.tobewobe.com with "Data Access Request" in the subject line. We will respond within 30 days with a downloadable file.

Right to Deletion

You can request deletion of your account and associated personal data.

How to request: Visit the data deletion form in the app (Settings → Privacy → Delete My Account) or use the web-based form.

What happens: Your display name, profile, avatar, friends list, and presence are deleted immediately. Your wallet ledger is retained anonymized (no personal identifiers) for 7 years per regulatory requirements.

Right to Correction

You can update your display name, avatar, and country/region at any time via your profile settings.

Right to Withdraw Consent

If you have opted into optional analytics or push notifications, you can disable them in Settings → Privacy at any time.

Right to Portability

You can request a copy of your personal data in a portable format (JSON or CSV). Email support@casino-app.tobewobe.com with "Data Portability Request" in the subject line.

7. Security

We implement industry-standard measures to protect your data:

• Encrypted transmission (TLS 1.2+)
• Encrypted storage for sensitive fields (passwords, billing address)
• Access controls and least-privilege principle
• Regular security audits and penetration testing
• Incident response plan (see §9)

No system is 100% secure. If you suspect a breach, contact us immediately.

8. Children & COPPA Compliance

The app is 21+ in-app, 18+ store-rated. We do not knowingly collect data from anyone under 13. If you are under 13 and have created an account, please contact us immediately and we will delete your account within 24 hours, even without parental consent.

COPPA (US Children's Online Privacy Protection Act): If we have actual knowledge that we have collected data from a child under 13, we will delete it on request, and may disable all related accounts.

9. Data Breach Notification

If we discover a breach affecting your personal data, we will:

1. Notify you within 72 hours by email and in-app alert
2. Describe what data was affected
3. Explain what we are doing to mitigate harm
4. Provide resources (credit monitoring, etc.) if applicable

For residents of specific states (CA, VA, CO, etc.), we will also notify the state attorney general if legally required.

10. International Data Transfers

If you are outside the United States, your data will be transferred to and stored in the United States (us-east-1 AWS region). By using the Service, you consent to this transfer. For soft-launch markets (Canada, Australia, NZ, Philippines), additional consent and legal mechanisms will be in place before those regions open.

11. User-Generated Content

Any profile information you make visible to other players (display name, avatar, status line) may be viewed by other players in the game. Be mindful of what you share. We reserve the right to moderate or remove content that violates our code of conduct.

12. Changes to This Policy

We may update this policy at any time. If we make material changes, we will notify you in the app or by email. Your continued use of the Service constitutes acceptance of the updated policy.

13. Contact Us

Mailing Address:
[Company Legal Address]

Response Timeline:
We aim to respond to all requests within 30 days. For complex requests, we may seek a brief extension.