PRIVACY POLICY

01 // Data Retention & Deletion

• › Match History & Logs: Real-time match data transmitted via Socket.io is kept for 30 days for fraud prevention, then purged.
• › Payment Events: Transaction receipts (via RevenueCat) are retained for 7 years to comply with financial and tax regulations.
• › Account Deletion: If you request account deletion via the app settings, deletion is scheduled in 7 days and can be undone during that grace period. After the grace period, personal data (Email, UserID, Roster) is permanently erased from production databases.

02 // Regional Rights (GDPR & CCPA)

We process data under the legal basis of Contractual Necessity (to run your game) and Legitimate Interest (security).

• › EEA/UK Users: You have the right to access, rectify, or erase your data (Right to be Forgotten). You may lodge a complaint with your local DPA.
• › California Users (CCPA/CPRA): We do not sell your personal information. You have the right to know what data is collected and to opt-out of sharing with third-party service providers.

03 // Security & International Transfers

• › Encryption: Data is encrypted in-transit (SSL/TLS) and at-rest (within Google Firebase's encrypted infrastructure).
• › Transfers: Data is stored on servers in the US/Europe (via Google and Railway). We use Standard Contractual Clauses (SCCs) to ensure safe international transfer.
• › Breach Notification: In the event of a data breach, we will notify affected users via email within 72 hours of discovery.

04 // Children's Privacy

Roster Drafts is not intended for children under 13. We do not knowingly collect data from children. If we discover such data, it will be deleted immediately.