Privacy Policy

Personal Information

We collect information you provide directly:

• Email Address: Used for account creation and authentication
• Phone Number: Optional, used for OTP verification
• Username: Public identifier for your profile
• Profile Data: Avatar, bio, and display preferences
• Contact Information: Collected only when you contact support

Automatically Collected Data

• Device Information: Device type, OS version, unique device ID
• IP Address & Location: General location based on IP (not precise GPS)
• Usage Data: Quiz results, coins earned, tasks completed, features used
• Timestamps: When you access features and complete activities
• App Analytics: App crashes, performance metrics, feature usage

Google Sign-In

When you sign in with Google:

• We receive your email address and basic profile information
• Google's privacy policy applies: policies.google.com/privacy
• You can revoke our access anytime through your Google account settings
• We don't store your Google password

Firebase Authentication

PlayWin uses Firebase Authentication for secure account management:

• Firebase handles all authentication requests securely
• Passwords are encrypted and never stored in plain text
• Firebase Privacy: firebase.google.com/support/privacy

Phone OTP Authentication

Optional two-factor authentication via SMS:

• One-Time Password sent to your phone for verification
• OTP is valid for 5 minutes only
• We don't store OTP codes after verification
• Phone number is encrypted in our database

Guest Login

You can play as a guest without authentication:

• No personal information is required
• A temporary account is created locally on your device
• Guest progress is not synced across devices
• Guest accounts may be subject to restrictions

Google Firestore

PlayWin uses Google Cloud Firestore for primary data storage:

• Stores user profiles, game progress, and coins balance
• Data is encrypted at rest and in transit
• Automatic daily backups
• Data centers located in multiple regions for redundancy

Firebase Realtime Database

Used for real-time data synchronization:

• Leaderboard data and live updates
• Chat and messaging features
• Real-time notifications
• ACID compliance for data integrity

Data Encryption

Your data is protected through multiple layers:

• In Transit: TLS 1.2+ encryption for all network requests
• At Rest: AES-256 encryption for stored data
• Sensitive Data: Additional encryption for passwords and payment info
• Access Control: Role-based access to databases

Google Analytics

We use Google Analytics to understand how you use PlayWin:

• Tracks page views, clicks, and user flows
• Helps us improve the app experience
• Data is anonymized and aggregated
• You can opt-out: https://tools.google.com/dlpage/gaoptout

Google AdMob

In-app advertisements are served through Google AdMob:

• Displays personalized ads based on your interests
• Google collects advertising-related data
• You can manage ad preferences in your Google account
• See Google's privacy policy for AdMob

Firebase Crash Reporting

We monitor app crashes and errors:

• Automatically collects crash logs and stack traces
• Helps us identify and fix bugs
• Data is anonymized and never includes personal information
• You can disable this in app settings

How We Use Cookies

• Authentication: Session tokens for login
• Preferences: Saving your language and theme choices
• Analytics: Understanding user behavior and improving experience
• Security: Preventing fraud and protecting accounts

Managing Cookies

You can control cookies through your browser settings:

• Most browsers allow you to refuse cookies or alert you when cookies are being sent
• Note: Disabling cookies may affect app functionality
• You can delete cookies anytime from browser settings

Required Permissions

• Internet: Required for all online features
• Camera: For profile photo upload
• Storage: For storing game data locally
• Location: For location-based features (optional)

Optional Permissions

• Contacts: Only with your explicit consent for referral sharing
• Microphone: For future voice features (if enabled)
• Calendar: For event reminders (if you subscribe)

Data Protection

• Industry-standard security protocols and encryption
• Regular security audits and penetration testing
• Compliance with OWASP security guidelines
• Two-factor authentication support
• Automatic session timeout for security

Secure Transmission

• All data transmitted over HTTPS/TLS connections
• Certificate pinning to prevent man-in-the-middle attacks
• Regular security headers implementation
• Protection against common web vulnerabilities

Account Security

• Strong password requirements
• Account recovery options
• Suspicious activity alerts
• Device management for logged-in sessions

Third-Party Providers

• Google: Authentication, Analytics, AdMob, Cloud Storage
• Firebase: Backend services and real-time database
• Stripe/PayPal: Payment processing (if applicable)
• Twilio: SMS delivery for OTP

Age Requirements

PlayWin is not intended for children under 13 years old. If you are under 13, do not create an account.

For users 13-18:

• Parental consent may be required in some jurisdictions
• Limited data collection and processing
• Special protections for minors
• Parents can request data deletion for their children

Parental Controls

If you are a parent and believe your child has created an account:

• Contact us at support@playwin.app
• Provide proof of your relationship
• We will help delete the account and associated data

Retention Policy

• Active Accounts: Data kept as long as account is active
• Inactive Accounts: Account data retained for 12 months after last login
• After Deletion: Personal data deleted within 30 days, some data retained for legal/compliance reasons
• Analytics Data: Anonymized data retained for performance analysis
• Backup Data: Backups deleted after 90 days

Legal Holds

We may retain data longer if required by law or if there is a legal hold on your account related to disputes, violations, or investigations.

How to Delete Your Account

For detailed instructions on deleting your account, visit our Delete Account page.

Alternatively, contact crsidhant01@gmail.com to request account deletion.

GDPR & Data Subject Rights

If you're in the EU, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Limit how your data is used
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Opt-out of data processing
• Right to Lodge a Complaint: With your local data protection authority

California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal data is collected
• Right to delete personal data
• Right to opt-out of data sales
• Right to non-discrimination for exercising rights

How to Exercise Your Rights

To exercise any of your privacy rights:

1. Email us at privacy@playwin.app with your request
2. Include your account email and specific request details
3. We will respond within 30 days
4. May request proof of identity for security

Privacy Inquiries

For questions about this Privacy Policy or your data:

• Email: privacy@playwin.app
• Support: support@playwin.app
• Response Time: 5-7 business days

Data Protection Officer

PlayWin has appointed a Data Protection Officer (DPO) for GDPR compliance:

• Contact DPO at dpo@playwin.app
• Handles all data protection and privacy matters
• Oversees compliance with data protection laws

Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• We will notify you of significant changes
• The "Last Updated" date at the top will change
• Your continued use of PlayWin means you accept the changes
• Major changes require your consent

Questions About Privacy?

We're here to help protect your data and respect your privacy.