This Privacy Policy describes how Run It ("we," "us," or "our") collects, uses, discloses, and retains personal information when you use Run It Arcade (the "Service").

We are responsible for personal information under PIPEDA (Canada), and where applicable provincial privacy laws including Quebec Law 25, and U.S. state privacy laws.

By using the Service you consent to practices described here and in our Terms. If you do not consent, do not use the Service.

Account: email, username, display name, password hash (via our auth provider — we never store plaintext passwords), country of residence, optional profile fields, and age-related information for eligibility.

Gameplay and contests: scores, match results, contest entries, stakes selected, leaderboard data, anti-cheat signals, and device/session metadata needed to operate Contests.

Payments: transaction records, wallet balances, deposit and withdrawal history, Whop account identifiers, and payout verification data. Full payment card numbers are processed by Whop, not stored on our servers.

Device and usage: device type, OS, app version, IP address, coarse location derived from IP, crash logs, and analytics events.

Communications: support messages and marketing preferences.

Third-party sources: authentication, payment, and fraud-prevention vendors as described below.

We use personal information to: operate the Service; authenticate users; process payments and payouts; run Contests and tournaments; detect fraud and cheating; comply with law; communicate about your account; and improve the Service using aggregate or de-identified analytics.

Legal bases (EEA/UK where applicable): contract performance, legitimate interests (security, fraud prevention), consent where required, and legal obligation.

We do not sell personal information for monetary consideration.

We send promotional messages only with express consent, implied consent under CASL (e.g., recent transaction), or an applicable exemption.

Marketing emails include sender identification, contact information, and an unsubscribe mechanism. Unsubscribe requests are processed within 10 business days.

We share information with service providers under contractual safeguards, including: Supabase (hosting, database, authentication), Whop (payments and payouts), email delivery, crash reporting, and analytics.

We may disclose information to advisers, regulators, or law enforcement when required by law or to protect safety.

In a merger or acquisition, information may transfer subject to equivalent privacy obligations.

Information may be stored or processed in Canada, the United States, and other countries. We use contractual protections appropriate to PIPEDA and, where required, Standard Contractual Clauses for EEA/UK transfers.

We retain information while your account is active and as needed for legal, tax, dispute, and integrity purposes, then delete or anonymize it.

We use encryption in transit, access controls, and security reviews. No method is 100% secure.

We notify regulators and affected individuals of breaches posing significant harm as required by PIPEDA, Law 25, and applicable U.S. state law.

Canada (PIPEDA / provincial): access, correction, and withdrawal of consent subject to legal limits. Contact our Privacy Officer at [email protected].

Quebec (Law 25): portability, de-indexation rights where applicable, and notification of automated decisions with significant effects.

California (CCPA/CPRA): know, delete, correct, and opt out of sale/sharing (we do not sell for money). No discrimination for exercising rights.

Other U.S. states: access, delete, correct, and port where comprehensive privacy laws apply.

Marketing opt-out: unsubscribe link in emails or contact us.

The Service is not directed to anyone under 18. We do not knowingly collect information from minors. Contact us to request deletion if you believe we have collected a minor's data.

We may update this Policy by posting a revised version with a new "Last updated" date. Material changes receive notice where required by law.

California residents may submit CCPA/CPRA requests to [email protected]. We verify requests before responding.

Residents of Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws may exercise applicable rights by contacting us. Authorized agents may submit requests with proof of authorization.

We do not use sensitive personal information for purposes requiring opt-in consent under CPRA beyond what is necessary to provide the Service.

For questions about these documents, contact Run It at [email protected] or through Profile → Support in Run It Arcade.

Privacy requests: email [email protected] with the subject line "Privacy request" and your account email.