Six data categories, retention windows, user rights
Six categories of data are collected on the single-wallet INR lobby: identity, wallet, KYC, gameplay, support, and consent. Each category has a defined retention window, a defined access path, and a defined deletion path on the closure screen.
What is collected, where it is stored, who sees it
The six categories at a glance
Identity: mobile number, OTP, four-digit PIN. Stored in the identity service; never shared with third parties.
Wallet: deposits, withdrawals, balance, ledger entries. Stored in the wallet service; encrypted at rest; accessed only by the user and the support team.
KYC: Aadhaar or PAN, bank statement or cancelled cheque, live selfie. Stored in the KYC service; encrypted at rest; deleted within 30 days of account closure.
Gameplay: bets, results, Daily Race rank, VIP tier progress. Stored in the gameplay service; aggregated for the Daily Race leaderboard; never shared with third parties.
Support: in-app chat transcripts, email correspondence. Stored in the support service; retained for 90 days; deletable on request.
Consent: cookie switches, marketing opt-in, analytics opt-in. Stored in the consent service; retained for 365 days; user-editable on the wallet screen.
How long each category persists
| Category | Retention (active account) | Retention (after closure) | Deletion path |
|---|---|---|---|
| Identity | Lifetime of account | 30 days | Account closure |
| Wallet | Lifetime of account | 7 years (regulatory) | Account closure; ledger retained per RBI norms |
| KYC | Lifetime of account | 30 days | Account closure |
| Gameplay | Lifetime of account | 1 year | Account closure |
| Support | 90 days | 90 days | User request via /contact/ |
| Consent | 365 days | 365 days | Wallet screen, user-editable |
Access, correction, deletion, portability
Access: the user can request a copy of all data held by the operator through the support channel. The data is delivered within 30 days as a JSON archive.
Correction: the user can correct identity, wallet, and KYC data on the wallet screen. Gameplay data is not editable; it is read-only audit data.
Deletion: the user can close the account through the /delete-account/ route. The closure runs on the server side; the wallet balance is settled before the closure completes.
Portability: the user can export wallet history and gameplay history as a CSV download from the wallet screen under Settings → Export.
Recipients, processors, transfer safeguards
The operator shares data with the following processors: the SMS gateway (sends OTP and transactional SMS), the email gateway (sends password reset and marketing email with consent), the payment gateway (processes UPI and bank transfer deposits and withdrawals), and the KYC vendor (validates Aadhaar or PAN and the bank statement). All processors are bound by data-processing agreements and operate inside India.
The operator does not share data with advertising networks. The operator does not embed any third-party tracker SDK in the lobby. The marketing pixel is opt-in on the wallet screen and is provided by a first-party server, not by Google or Facebook.
Encryption, access control, breach response
Data in transit is encrypted via TLS 1.3. Data at rest is encrypted via AES-256. Access to the KYC service requires multi-factor authentication. Access to the wallet service requires role-based authentication and is logged for audit. Breach response follows the CERT-In directive: report within 6 hours of detection, notify affected users within 72 hours.
No data collection from minors
The lobby refuses sign-up from minors
The lobby does not collect data from minors. The age-18 enforcement runs at sign-up: a user declaring age below 18 is refused before any data is captured. The lobby does not have a "minor mode" or a reduced-data mode; a minor simply cannot open an account.
If a parent suspects a minor has opened an account using a false age declaration, the parent can contact the support team through the /contact/ channel. The support team reviews the account, suspends it if the suspicion is confirmed, and deletes the data per the retention rules on this notice.
The operator does not knowingly collect data from minors. The operator does not target advertising at minors. The marketing pixel is opt-in for adults only.
How to exercise data rights
Three ways to exercise data rights
Access: send a request through the /contact/ channel with the subject "Data access request". The data is delivered within 30 days as a JSON archive.
Correction: open the wallet screen and edit the identity, wallet, or KYC fields directly. Gameplay data is not editable.
Deletion: open the /delete-account/ route and confirm. The closure runs on the server side; the wallet balance is settled before the closure completes.
How the privacy policy is updated
The update cadence
The privacy policy is reviewed at least once per quarter. Material changes (new data categories, retention changes, new third-party recipients) trigger an immediate review. The last-reviewed date at the bottom of every page records the most recent review.
Material changes are reflected on the privacy policy and in the change log below. Editorial corrections do not trigger a change-log entry.
The user can subscribe to privacy-policy updates through the wallet screen under Settings → Notifications → Privacy updates. The subscription sends an email when a material change is published.
Change log
2026-08-21: Added a section on age-18 enforcement and children.
Who reviews this notice
The privacy policy is reviewed by the editorial team, the operator's data-protection officer, and the operator's legal team. The three roles ensure the data categories, the retention windows, and the user rights are accurate, complete, and aligned with the law.
The last-reviewed date at the bottom of every page records the most recent review. The change log lists every material change.
What the privacy policy looks like under different jurisdictions
The privacy policy described on this notice is written for the Indian jurisdiction. The DPDP Act 2023 (Digital Personal Data Protection Act) governs the processing of digital personal data in India; the policy on this notice aligns with the DPDP Act's requirements for consent, retention, and user rights.
The GDPR framework grants additional rights (right to access, right to rectification, right to erasure, right to restrict processing, right to data portability) that are not all required under the DPDP Act. The lobby does not target users in the EU; the operator serves Indian users only. The privacy policy described on this notice is therefore the applicable one.
What the privacy policy covers in one paragraph
Six categories of data: identity, wallet, KYC, gameplay, support, consent. Each category has a defined retention window, a defined access path, and a defined deletion path. The lobby is encrypted at rest and in transit. The operator processes data only for the purposes stated on this notice. The user can request access, correction, deletion, or portability through the channels above.
Decision questions on this route
What data is collected on sign-up?
How long is KYC data retained after closure?
Can the user export the wallet history?
Who can see the KYC documents?
Does the operator share data with advertising networks?
How does the user delete the account?
Review the data the lobby holds
Six categories, six retention windows, six deletion paths. The closure screen runs the deletion on the server side.