Privacy Policy

NaagMoney ("the Game") is operated by NaagMoney ("we", "us", the "controller"). This policy explains what data the Game collects, why, and the choices you have. It applies to the web version and the mobile app.

You can reach us at any time for privacy questions or data requests at support@naagmoney.com — this address also serves as our privacy contact for GDPR, CCPA, and UK GDPR requests. See Section 11 (EU Representative) for the EU contact where required.

Account data. When you create an account we store your chosen Challenger Handle, a permanent Ledger Tag, and — if you register with email — your email address, a hashed password (we never store or see your plain password), and an optional 6-digit security PIN used only for password recovery. You may optionally add a country, profile picture, and public social handles (Instagram, YouTube, Twitch).

Guest players. If you play as a guest, a randomly generated player identifier is created for you. No email or password is required.

Gameplay data. Match results (score, kills, duration, chips carried and banked), your in-game wallet balances (chips, tickets, season pass state), leaderboard placements, clan memberships, cosmetic inventory, and referral activity. This data is what makes the global championship, leaderboards, and economy work — it is tied to your player identity and is visible to other players in the form of ranks, scores, and public profiles.

Community content. If you join a clan, the messages you send in clan chat are stored so members can read them and so we can moderate abuse. If you submit a gameplay Clip, we store its title, description and link (or the auto-generated match card) together with your player identity and its moderation status — clips are reviewed by our moderation team before they appear publicly. Clips and clan messages are removed when you delete them or your account.

Technical data. Your IP address is used at signup to auto-detect your country/region (via a country-lookup service) and to route your connection to the nearest game server region. We also keep minimal connection logs for integrity and abuse prevention.

On-device settings. Preferences you choose in Settings (music, sound, vibration, orientation, performance mode) are stored locally on your device via browser local storage. They are not uploaded to our servers.

Chips and tickets are virtual in-game items. They have no real-world monetary value and cannot be exchanged for cash. Chip wallets are subject to the published season reset (January 1 each year), which is part of the championship design and disclosed in-game.

Rewarded ads. The Game may offer optional rewarded video ads. On the mobile app these are served through Google AdMob, which receives device information (such as advertising identifiers: GAID on Android and IDFA on iOS subject to App Tracking Transparency consent) to serve, measure, and attribute ads. Ad delivery is governed by Google's own privacy policy. Watching rewarded ads is always optional.

In-app purchases. Time Passes are processed securely by the Google Play Billing system on Android and Apple App Store (StoreKit) on iOS. We receive only the cryptographic purchase receipt/token needed to authenticate and credit your account (order ID, product ID, and purchase status). We never see, process, or store your credit card or banking information.

We use the data described above to:

• Operate the Game: matches, matchmaking, economy, extraction, and season progression;
• Rank players on leaderboards and run the global championship;
• Keep the economy fair: anti-cheat, anti-abuse, and integrity investigations;
• Provide support when you contact us, including issue reports you email us;
• Process purchases and ad rewards you explicitly choose to trigger.

We do not sell your personal data, and we do not use it for third-party advertising profiles beyond the ad SDK described in Section 4.

For users in the European Economic Area, the United Kingdom, and Switzerland (the "EEA"), we process personal data only where we have a lawful basis under Article 6 of the UK GDPR / EU GDPR. The table below maps each processing purpose to its legal basis.

• Account creation (email, password, name, country, security PIN)Contractual necessity — Art. 6(1)(b)Required to enter into and perform the player agreement with you.
• Gameplay state, scores, chips, inventory, season progressionContractual necessity — Art. 6(1)(b)Required to deliver the matches and economy you signed up for.
• Matchmaking and global leaderboardsLegitimate interest — Art. 6(1)(f)Our interest in running a fair global championship. Balancing test: the ranking/matchmaking uses only gameplay data needed for fair play; the impact on your privacy is limited because no sensitive personal data is processed for this purpose, and you can object (see Section 10).
• Analytics and crash reportingConsent — Art. 6(1)(a)Opt-in via the platform consent flow; you can withdraw consent any time in Settings without losing access to the Game.
• Advertising (AdMob / AdSense — rewarded ads)Consent — Art. 6(1)(a)Consent is collected via Google's User Messaging Platform (UMP) on native and Funding Choices on web, plus Apple App Tracking Transparency (ATT) on iOS. You can withdraw consent in your device privacy settings.
• Anti-cheat and content moderationLegitimate interest — Art. 6(1)(f)Our interest in protecting competitive integrity and the community from abuse. Balancing test: we process only gameplay signals, chat content, and minimal network identifiers (IP), and only authorized staff access it.
• Marketing emails (if you opt in)Consent — Art. 6(1)(a)Only sent where you explicitly opt in; you can unsubscribe at any time via the link in every email or by contacting us.
• Legal, tax, and accounting record-keepingLegal obligation — Art. 6(1)(c)Where we are required to retain records (e.g. payment/tax records) under applicable law.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you have the right to object (see Section 10).

We only share data with: (a) infrastructure and service providers that host the Game servers and databases; (b) Google (AdMob for optional ads, Google Play for purchases); (c) the country-lookup service used once at signup for region detection; and (d) authorities where required by law. Service providers are bound to process data only on our instructions.

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as defined by California law (CCPA), except in the limited sense that ad SDKs listed in Section 4 may use device identifiers to serve ads based on your consent given through the UMP / ATT flow.

Where your data is stored. The primary Game database and the game servers run in [Primary hosting region — to be confirmed at deploy] (the "Primary Region"). The operator will confirm the exact region (and any backup regions) in this policy before launch. Account, gameplay, and chat data are stored in the Primary Region; crash reports and analytics may be processed by sub-processors in their own regions as listed below.

Transfers outside the EEA / UK / Switzerland. Where personal data is transferred to a country outside the EEA / UK / Switzerland that has not been the subject of an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses (SCCs) (or the UK International Data Transfer Agreement / Addendum, as applicable) together with supplementary measures including encryption in transit (TLS 1.2+) and at rest. Where a transfer is to a country that has received an adequacy decision, no further safeguards are required.

Sub-processors. We use the following categories of sub-processors to operate the Game: (a) cloud infrastructure / hosting, (b) database, (c) advertising (Google AdMob on native, Google AdSense + Funding Choices on web), (d) analytics, and (e) crash reporting. A current list of named sub-processors (with their processing locations) is available on request from the privacy contact at the top of this policy. We require every sub-processor to be bound by a written agreement imposing obligations no less protective than those in this policy.

We keep your data only as long as we need it for the purpose for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The table below sets out our standard retention periods.

• Active account data (profile, wallet, inventory, gameplay state)Retained while the account is active + 30 days after a deletion requestThe 30-day window is the abuse-fight window; after it, the data is hard-deleted.
• Match history and leaderboard scores24 months rolling, then aggregated / anonymizedAggregated, non-identifying statistics may be kept longer for the championship history.
• Authentication tokens7 days without "Remember me"; 30 days with "Remember me"In-game session JWT lifetime: 1 hour; refreshed while you are actively playing.
• IP addresses (anti-abuse / connection integrity)90 days rollingUsed for region routing, rate limiting, and abuse investigations.
• Crash and analytics data90 daysAggregated insights may be kept longer; raw event records are deleted.
• Banned-account evidence (chat, gameplay, IP, device fingerprints)2 years from the banStatutory dispute-limitation period for enforcing the ban and contest claims.
• Payment records (Time Pass purchases, receipts)7 yearsTax and legal-records retention obligation; the records contain no card data.

You can delete your account yourself at any time: Profile → Delete Account. This erases your account, wallet, inventory, match records, clan messages, and clips (subject to the limited retention periods above, e.g. for fraud evidence or tax records). You can also email support@naagmoney.com with the subject "Data Request" for access, correction, export, or deletion of your data — we respond personally and within the statutory time limits (one month under GDPR, 45 days under CCPA).

If you are in the EEA, UK, or Switzerland, you have the following rights over your personal data. To exercise any of them, email the privacy contact at the top of this policy with the subject "Data Request" and we will verify your identity before responding.

• Right of access (Art. 15)Find out what data we hold about youYou can request a copy of your personal data and details of how it is processed.
• Right to rectification (Art. 16)Correct inaccurate or incomplete dataTell us what is wrong and what should be changed.
• Right to erasure (Art. 17 — "right to be forgotten")Ask us to delete your personal dataSubject to exemptions (e.g. legal retention, fraud evidence — see Section 9).
• Right to restriction of processing (Art. 18)Ask us to limit how we use your dataFor example, while a rectification request is being verified.
• Right to data portability (Art. 20)Receive your data in a structured, machine-readable formatApplies to data you provided and that we process by consent or contract (e.g. your account profile and gameplay history).
• Right to object (Art. 21)Object to processing based on legitimate interests or for direct marketingFor direct marketing, you can object any time; we will stop immediately.
• Rights regarding automated decision-making, including profiling (Art. 22)Not be subject to solely-automated decisions with legal/similar effectWe do not use solely-automated profiling for such decisions; matchmaking uses gameplay signals only.
• Right to withdraw consent (Art. 7(3))Withdraw consent for any consent-based processingWithdrawal does not affect lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority (Art. 77)Complain to your local data-protection authorityYou can do this without first contacting us, but we hope you will let us try to fix the issue first.

Your rights may be limited where an exemption applies — for example, where processing is necessary for compliance with a legal obligation (e.g. tax-record retention), for the establishment, exercise or defense of legal claims, or for reasons of public interest. Where an exemption applies, we will tell you and explain why.

NaagMoney is not established in the European Union. For EEA, UK, and Swiss data subjects, we will designate an EU Representative under Article 27 of the UK GDPR / EU GDPR before launching the Game in the EEA. You can contact the EU Representative for any matter arising from this policy or to exercise your rights.

EU Representative: [Name, postal address, email — to be appointed before EEA launch]

Until the EU Representative is appointed, please contact us directly at support@naagmoney.com.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the rights described in this section. Our privacy contact for California requests is support@naagmoney.com.

• Right to know what personal information we collect, use, share, or sell, and to whom (Cal. Civ. Code § 1798.130).
• Right to delete your personal information (§ 1798.105), subject to the exemptions in Section 9 (e.g. fraud evidence, tax records).
• Right to correct inaccurate personal information (§ 1798.106).
• Right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising (§ 1798.120, § 1798.140(ag)).
• Right to limit the use of sensitive personal information (§ 1798.121). The Game does not knowingly collect the categories of sensitive PI listed in the CCPA other than account-credential data needed to operate your account.
• Right to non-discrimination for exercising any of these rights (§ 1798.125).

Do Not Sell or Share My Personal Information. The Game does not sell your personal data and does not share it for cross-context behavioral advertising other than via the ad SDKs in Section 4 — which only receive device identifiers after you have given consent through the UMP / ATT flow. To opt out at any time, email us at support@naagmoney.com with the subject "Do Not Sell or Share", or submit a request through the in-app privacy form (Profile → Privacy Requests). We will honor opt-out signals under the Global Privacy Control (GPC) browser signal where applicable.

Shine the Light requests. California Civil Code § 1798.83 lets you ask us once per calendar year what personal information we have shared with third parties for their direct-marketing purposes during the preceding year. To make a "Shine the Light" request, email the privacy contact above with the subject "Shine the Light Request".

Authorized agents. You may submit a request through an authorized agent; we will require proof that the agent is authorized to act on your behalf and may verify your identity directly.

The web version of the Game and the marketing site use a small number of cookies and equivalent storage technologies. On native (iOS / Android) the equivalent SDK storage is used; on web, consent for advertising cookies is collected via Google's Funding Choices consent message, and on native via the User Messaging Platform (UMP) and Apple App Tracking Transparency (ATT). The categories are:

• Authentication cookies / tokensStrictly necessary (1st party)Session and CSRF cookies that keep you signed in and protect your account. Lifetime: the session lifetime in Section 9. Not optional — the Game cannot function without them.
• Preference cookies / local storageStrictly necessary (1st party, on-device)Music, sound, vibration, orientation, performance-mode settings stored on your device. Lifetime: until you clear them. Never uploaded to our servers.
• Advertising cookies / SDK storage (AdMob / AdSense)Marketing — consent required (3rd party)Set by Google ad SDKs only after you consent via UMP (native) or Funding Choices (web). Used to serve, measure, and attribute ads. Lifetime: up to 13 months, refreshed on activity. You can withdraw consent in your device settings.
• Analytics cookies (if enabled)Analytics — consent required (1st or 3rd party)Aggregate, pseudonymous traffic and crash analytics. Lifetime: up to 14 months. Disabled unless you opt in via the platform consent flow.
• Infrastructure / CDN cookiesStrictly necessary (1st party or trusted 3rd party)Used by our cloud infrastructure and CDN for load balancing and abuse prevention. Lifetime: typically 30 minutes to 24 hours. No personal data is stored in these cookies.

Most browsers let you refuse or delete cookies via the browser settings; the "Help" menu of your browser explains how. Restricting cookies may affect some features (for example, staying signed in across pages).

The Game is a general-audience product and is not directed to children under 13 (or under the higher age of digital consent in your EEA member state — 13 to 16 depending on the country). We do not knowingly collect personal information from children below that age.

Signup age gate. At registration, every new player is required to confirm that they are 13 years of age or older (or the minimum legal age of digital consent in their jurisdiction) and to accept these Terms and this Privacy Policy. The age confirmation is recorded with the account.

EEA member states with a higher digital-consent age. In EEA member states where the age of digital consent is set above 13 (for example 16), players below that age are required to obtain parental consent before creating an account. If you are a parent or guardian and believe your child has provided personal data without consent, contact us at support@naagmoney.com and we will delete the data promptly.

Accounts of under-age users. If we learn that an account has been created by a child under the applicable age (or without parental consent where required), we will delete the account and associated personal data on notice. We may also use age signals provided by the platform (e.g. Google Play "Age Range" or Apple Family Sharing signals) to enforce this rule.

For U.S. users, this section operates as our COPPA notice. We do not knowingly collect personal information from children under 13 within the meaning of COPPA; if you believe a child has provided personal data, contact us and we will delete it.

Passwords are stored as salted hashes, sessions use signed tokens, and all traffic between your device and our game servers travels over the network in encrypted form where the platform supports it. No system is perfectly secure, but we design the Game to collect the minimum data needed to run it, and we review access regularly.

If we change this policy, we will update the date above and, for material changes, announce it inside the Game. Continued play after a change means you accept the updated policy.

NaagMoney
Support & privacy: support@naagmoney.com

Placeholders in this policy that the operator must confirm before launch: the Primary hosting region (Section 8) and the EU Representative contact (Section 11).