Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the Platform, you provide:

• Mobile phone number (used to create and sign in to your account via SMS verification)
• Username, display name, and profile preferences (such as avatar color)
• Responsible gaming settings (session limits, self-exclusion elections)
• Customer support communications

The current version of the Platform uses virtual currency only and does not collect your legal name, date of birth, email address and password, or state of residence. When optional real-money features and identity verification (KYC) launch in a future update, we will collect additional information as described in Section 10, and we will update this Privacy Policy before those features become available.

1.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Device identifiers (device ID, hardware model, operating system version)
• IP address and approximate geolocation
• App usage data (screens visited, features used, session duration)
• Match and gameplay data (moves made, match timing, game results, accuracy metrics)
• Push notification interaction data
• Network type and connection quality
• Anti-cheat telemetry: touch input patterns, move timing data, and in-game behavioral signals used exclusively to detect cheating and protect platform integrity
• Virtual currency transaction history (Coin and Diamond balances, competition entries, purchases)

1.3 Information from Third Parties

• Apple — in-app purchase transaction status for Merit Coin and Diamond purchases
• Apple APNs — push notification delivery status

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Platform Operations

• Creating and managing your account
• Processing virtual currency transactions (competition entries, Diamond purchases, Coin awards)
• Running matchmaking and managing game sessions
• Calculating and awarding skill ratings (ELO)
• Maintaining your virtual currency balance and transaction history

2.2 Age Requirement and Future Verification

The Platform is intended exclusively for users 18 years of age or older, as described in our Terms of Service. The current virtual-currency version of the Platform does not collect your date of birth.

When optional real-money features and identity verification (KYC) launch in a future update, we will collect your date of birth including year to:

• Verify you are 18 years of age or older
• Determine your eligibility for real-money competitions
• Enforce age-based access controls server-side

Any date of birth collected at that time will be stored securely and will not be shared with other users or used for marketing purposes.

2.3 Safety, Security, and Anti-Cheat

• Detecting and preventing cheating, multi-accounting, and platform abuse
• Analyzing gameplay patterns to identify anomalous performance inconsistent with a player's skill history
• Investigating disputed match results
• Enforcing our Terms of Service and Responsible Gaming Policy

2.4 Communications

• Sending transactional notifications (match results, virtual currency updates, KYC status when applicable)
• Sending re-engagement push notifications (with your permission, which you can revoke at any time in Settings)
• Responding to customer support requests

2.5 Platform Improvement

• Analyzing aggregate, de-identified usage data to improve features and user experience
• Monitoring platform performance and stability

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

3.1 Service Providers

We share information with carefully selected third-party vendors who process data on our behalf, subject to confidentiality agreements:

• Apple — in-app purchase processing for Merit Coin and Merit Diamond purchases
• Firebase — cloud infrastructure and encrypted data storage
• Apple APNs — push notification delivery

3.2 Legal Authorities

• Law enforcement — in response to a valid legal process (subpoena, court order) or when we believe disclosure is necessary to prevent fraud, protect safety, or enforce our rights
• Regulatory authorities — as required by applicable law

3.3 Business Transfers

If we are acquired, merge with another company, or sell substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or in-app notice before your information becomes subject to a materially different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

4. Virtual Currency and Apple In-App Purchases

Merit Coins and Merit Diamonds are virtual in-app currencies with no cash value. Your Merit Coin and Merit Diamond balances and competition history are maintained on our servers. Purchases of Merit Coins and Merit Diamonds are processed by Apple through the App Store's in-app purchase system.

We do not store your Apple ID credentials, payment card information, or any financial data related to your Apple account. All billing for in-app purchases is handled exclusively by Apple and is subject to Apple's privacy policy and terms. For questions about billing, receipts, or refunds for Coin or Diamond purchases, contact Apple Support directly.

We retain records of your virtual currency transaction history (purchases, entries, awards) as part of your account data for platform operation, dispute resolution, and customer support purposes.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, resolve disputes, enforce agreements, and comply with legal obligations. Specific retention periods include:

• Account and profile data: Duration of account plus 3 years after closure
• Virtual currency transaction history: Duration of account plus 3 years after closure
• Match history and gameplay logs: 12 months active, then archived in summary form
• Anti-cheat telemetry and behavioral data: 12 months
• Date of birth (collected only if you use identity-verified real-money features when they launch): Duration of account
• Customer support communications: 3 years

When your account is deleted, we will remove or anonymize your personal data within 30 days, subject to the retention periods above and any legal obligations requiring longer retention.

6. Data Security

We implement industry-standard technical and organizational measures to protect your information:

• All data in transit is encrypted using TLS 1.2 or higher
• Sensitive data at rest is encrypted using AES-256, managed by our cloud infrastructure provider (Firebase / Google Cloud)
• We do not store payment card data — all in-app purchases are processed by Apple
• Access to user data is restricted to authorized personnel on a need-to-know basis
• Regular security reviews are conducted

No method of electronic transmission or storage is 100% secure. While we take these protections seriously, we cannot guarantee absolute security. If a security incident affects your data, we will notify you as required by applicable law.

7. Your Rights and Choices

7.1 Account and Data Access

You may access, update, or correct your account information at any time through the app settings. You may also contact us at the address below to request:

• A copy of the personal data we hold about you
• Correction of inaccurate information
• Deletion of your account and associated personal data (subject to our legal retention obligations)

7.2 California Residents — CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete: You may request deletion of your personal information, subject to exceptions for legal compliance and fraud prevention
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Opt-Out of Sale: We do not sell personal information

To submit a CCPA request, contact us at support@joinmeritgaming.com with the subject line "CCPA Privacy Request." We will respond within 45 days.

7.3 Notification Preferences

You may manage push notification preferences in the app settings at any time. Transactional notifications related to your account security and match results cannot be fully disabled while your account is active, as these are necessary for platform operation.

7.4 Responsible Gaming Controls

You may set session limits or self-exclude from competitions at any time in Settings > Responsible Gaming. Self-exclusion requests are processed immediately and cannot be reversed during the elected exclusion period.

8. Children's Privacy

Merit Gaming is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, do not use this Platform.

If we learn that we have inadvertently collected personal information from a minor, we will promptly delete that information and close the associated account. If you believe a minor has created an account, please contact us immediately at the address below.

9. Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.

Apple's privacy practices governing in-app purchases and the App Store are described in Apple's Privacy Policy at apple.com/privacy.

10. Coming Soon — Advertising, Real-Money Features, and Additional Data Collection

10.1 Rewarded Advertising

Merit Gaming may introduce optional rewarded advertisements in a future update, allowing you to earn virtual Merit Coins by choosing to watch an advertisement. This feature is not active at launch and no advertising data is collected until it becomes available. When it does, ads would be delivered through Google AdMob, and Google AdMob may collect and process technical data — such as your device type and settings, a resettable advertising identifier, IP address, approximate location, and ad-interaction data — to deliver and measure advertisements, acting as an independent advertising partner under Google's own privacy policy (policies.google.com/privacy). We intend to serve non-personalized advertisements and will not use your data to track you across other companies' apps or websites. Watching advertisements would be entirely optional and would grant only virtual Merit Coins, which have no cash value. We will update this Privacy Policy and our App Store privacy disclosures before rewarded advertising becomes active.

10.2 Real-Money Skill-Based Competition

Merit Gaming plans to introduce optional real-money skill-based competition features in a future update. When those features launch, we will update this Privacy Policy before they become available. Additional data we expect to collect at that time will include:

• Government-issued photo identification for identity verification (KYC)
• Social Security Number (for IRS 1099-K tax reporting on net winnings of $600 or more per calendar year)
• Bank account details and payment card information for deposits and withdrawals (processed by our payment provider — we will not store raw financial data)
• Enhanced fraud detection signals

Participation in real-money features will be entirely optional. Users who do not wish to participate may continue using the Platform's virtual currency experience without providing any additional information.

You will receive at least 14 days' notice before any material changes to this Privacy Policy take effect.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will:

• Post the updated policy with a new Effective Date
• Send you an in-app notification or email at least 14 days before the changes take effect

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with updated terms, you must stop using the Platform and close your account before the new policy takes effect.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

We will respond to all legitimate requests within 30 days. For complex requests, we may require up to 45 days and will notify you of the extension.