Your data, your call.

1. Introduction

This Privacy Policy explains how Arena Rush ("we", "us", "our") collects, uses, shares, and protects your personal information when you use our mobile application, website, and services (collectively, the "Platform").

This Policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 of India.

2. Information we collect

2.1 Information you provide

• Account information: username, email address, password (hashed), phone number, date of birth;
• Game information: in-game name (IGN), unique player ID (UID) for Free Fire or BGMI;
• Payment information: UPI ID, bank account details (processed via Razorpay — we do not store card numbers);
• KYC information: for withdrawals above Rs 10,000, we may collect PAN card details as required by Indian financial regulations.

2.2 Information collected automatically

• Device information (model, OS version, unique device identifier);
• IP address, approximate geolocation (city/state level);
• App usage data (tournaments joined, screens visited, session duration);
• Crash logs and error reports.

3. How we use your information

• To provide, maintain, and improve the Platform;
• To process tournament entries, prize distributions, and withdrawals;
• To verify your identity and prevent fraud;
• To send transactional messages (match reminders, room codes, payout confirmations);
• To respond to your queries and provide customer support;
• To comply with legal obligations under Indian law.

4. How we share your information

We share your personal information only in these limited circumstances:

• Service providers: Razorpay (payments), Resend (email), Firebase (authentication and push notifications), all bound by data processing agreements;
• Legal requirements: when required by court order, government request, or applicable law;
• Business transfers: in the unlikely event of a merger, acquisition, or sale of assets;
• With your consent: for any other purpose disclosed at the time of collection.

We do not sell your personal information to third parties, advertisers, or data brokers.

5. Data retention

We retain your personal information for as long as your account is active or as needed to provide services. Financial transaction records are retained for a minimum of eight (8) years as required under the Income Tax Act, 1961. On account deletion, we anonymize or delete personal data within 90 days, subject to legal retention requirements.

6. Your rights

Under the DPDP Act, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your account and associated data (subject to legal retention);
• Withdraw consent for optional data processing;
• Nominate another person to exercise your rights in case of death or incapacity;
• Lodge a complaint with the Data Protection Board of India.

To exercise any of these rights, email arenarushesports@gmail.com with subject "PRIVACY — [rights request type]".

7. Security

We implement industry-standard security measures including HTTPS/TLS encryption in transit, bcrypt password hashing, JWT-based authentication with refresh token rotation, and role-based access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Breach notification. In the event of a personal data breach affecting your information, Arena Rush will notify you and the Data Protection Board of India within 72 hours of becoming aware of the breach, as required by the Digital Personal Data Protection Act, 2023. Notice will include the nature of the breach, the categories of data affected, likely consequences, and mitigation steps we have taken.

8. Children's privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete such information promptly.

9. Third-party services

Our Platform integrates with third-party services including Google Sign-In, Razorpay, and Firebase. Your use of these services is subject to their respective privacy policies. We are not responsible for their practices.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and in-app notification. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

11. Contact us

For any questions, concerns, or requests regarding this Privacy Policy, contact our Data Protection Officer at arenarushesports@gmail.com.