PRIVACY POLICY

Last updated: December 31, 2025 · The absolute minimum we collect

What we collect

• Account basics: Email, username, password hash (for logins and lineup submissions)
• Eligibility proof: State of residence, DOB (18+ verification only — deleted after check)
• Gameplay data: Lineups submitted, Shard scores, Souls won (for leaderboards and prizes)
• Prize info: Name, address, PayPal/Venmo (for winners only — not stored long-term)
• Tech logs: IP address, device type (for fraud prevention and compliance — anonymized)

How we use it

• Run contests: Process lineups, score Shards, draw random Souls winners
• Verify eligibility: Ensure 18+ and legal state (no NY/FL/WA/ID/MT/NV)
• Award prizes: Send Souls redemptions via PayPal/Venmo (same-day during Scar-0)
• Prevent abuse: Detect bots, multi-accounts, fraud (your data stays secure)
• Improve the game: Aggregate anonymized stats (e.g., "average lineup size") — never personal

Who we share with (almost no one)

• No selling/renting: Your data never goes to advertisers or third parties for profit
• Legal only: If required by law (e.g., IRS 1099 for $600+ prizes) or court order
• Prize processors: PayPal/Venmo for redemptions (they have their own privacy policies)
• Fraud tools: Anonymized signals to services like Stripe for payment verification (if you buy packs)
• Audits: Aggregate data for sweepstakes compliance (no personal identifiers)

Security & storage

We use end-to-end encryption for all data at rest and in transit. Passwords are hashed with bcrypt. Access is role-based (you only see your own lineups). We monitor for breaches 24/7 and notify you immediately if affected.

Storage: Account basics forever (for your history). Eligibility proof deleted after verification. Prize info deleted after payout. Gameplay logs kept 1 year for disputes, then anonymized.

Your rights (full control)

• Access: Email ghost@ghostsweat.com for a full data export (free, within 30 days)
• Delete: Request deletion of everything except prize records (required by law)
• Opt-out: No marketing emails — only contest updates (unsubscribe anytime)
• California residents: CCPA rights — request, delete, or opt-out of "sale" (we don't sell)
• EU/UK: GDPR rights — access, rectify, erase, or object (we comply fully)

Cookies & tracking

Minimal cookies: Session ID for login, analytics (Google Analytics — anonymized, opt-out anytime). No third-party trackers. No behavioral ads. You can block cookies and still play.

Changes & contact

We'll post updates here and email you if major. Last updated: December 31, 2025.

Questions? ghost@ghostsweat.com