KAOS KLUB Privacy Policy

1. Who we are. KAOS KLUB is operated by [to be published], [to be published]. Privacy questions: privacy@kaosklub.app.
2. What we collect.
   • Account: email, password (stored only as a hash), date of birth, residential state, invite code, and the versions of the Terms and Rules you accepted.
   • Identity checks before a prize is paid: legal name, date of birth, residential address, taxpayer identification number (Form W-9), and a record that we checked the US sanctions list. Our identity provider, Didit, collects images of your ID document and a selfie, checks that the selfie is live and matches your ID photo, screens your name against sanctions and watch lists, and checks your IP address. See section 5a.
   • Play and wallet: every coin transaction, game round, seed and result, bonuses, mail-in requests and prize redemptions.
   • Payments: Stripe processes card payments. We receive a payment reference, amount and status; we never see or store your full card number.
   • Technical: IP address and the location region it indicates, device and browser details, timestamps, in-app events (for example sign-up, first win, session length), error reports and performance data, and session replays used to fix bugs, in which all text, inputs and images are hidden.
   • Messages you send us, and mail-in cards (we keep an image of the card and envelope).
   • Profile: your avatar (a preset or a photo you upload), who you follow, who follows you, who you block, your crew, and your duel and race records. We remove location and other hidden data from photos when you upload them, and we never use avatar photos for face recognition.
3. How we use it. To run your account and the games, check age and eligibility, prevent fraud and multiple accounts, pay prizes, meet tax and sanctions duties, offer responsible play tools, send birthday and Klub anniversary gifts (using your date of birth and sign-up date), improve the app, and contact you about your account. We do not sell your personal information.
4. What other players see. Your profile shows your username, avatar, tier, level, season rank, best multiplier, verified big wins, crew and earned badges (such as streak badges), to everyone, to followers only, or to no one, as you choose in Settings. If the Klub feed is on, other players see your username, tier badge and big wins in coins; if you turn it off, your wins can still appear but only as "A Klub member", with nothing that identifies you. In weekly leagues, your group sees your display name, tier badge and league points; you can turn leagues off in Me. For Draw Night we publish the entry list so anyone can check the draw, but each player is listed under a code that changes every week, so entries can't be linked to you or across weeks; only winners are named (or shown as "A Klub member" if their feed is off). If you buy Klub Coins while you're in a crew, your crewmates may get a gift from the house; it arrives within a day, without your name, and they see your name only if you choose to tell them. Your crewmates and players who follow you and whom you follow back can see when you're online and, as you play, your rounds as they land (the game, the multiplier and which coin, never any amounts, stakes, balances, purchases or redemptions). Both are on by default for those people; players who follow you without you following back see them only if you turn that on. You can turn either off in Settings ("Show me online", "Show my live play"); they're off if your profile is hidden, and live play is off if you've turned the Klub feed off. People you block never see either. Shared win cards show the same details. Never your real name, email, state, balances, purchases or redemptions.
5. Who we share it with. Service providers that run the app for us (hosting: Vercel; database: Neon; payments: Stripe; error monitoring: Sentry, in the US, with emails, IP addresses, cookies and identity fields removed before sending; identity verification: Didit), only for that purpose; tax authorities (for example Form 1099-MISC); and anyone the law requires, or where needed to protect players, prevent fraud or enforce our terms.

5a. Face data for identity checks. When you verify your identity to redeem a prize, Didit creates a face template from your selfie and your ID photo to confirm they are the same person. We ask for your consent in the app before the check starts, and you can decline (but we can't pay a prize without a verified identity). Face data is used only to verify your identity and prevent fraud, is never sold or used for marketing, and is shared only with Didit as our provider. It is deleted once the check is complete, and in any case no later than the time the law sets (in Illinois, within 3 years of your last interaction with us).

1. How long we keep it. Coin and prize records are permanent (our ledger cannot be deleted). Identity, sanctions and tax records are kept for the periods the law sets (sanctions-related records 10 years; tax records at least 3 to 4 years), and other records about 5 years after your account closes.
2. Your choices. You can see and update your details, turn off the feed, set limits or self-exclude, and ask us to close your account or delete data we are not required to keep. Email privacy@kaosklub.app. If the law where you live gives you further rights, we will honour them.
3. Children. KAOS KLUB is for adults only. We do not knowingly collect data from anyone under 18 and close any such account we find. If sign-up is refused because of age, we keep scrambled markers of the device and network for 24 hours to stop an immediate retry, and delete them within an hour after that; we keep only a record that a refusal happened.
4. Security. Passwords are hashed, server seeds are encrypted at rest, and access to identity data is limited to the people who need it. No system is perfectly secure; we will tell you of a breach as the law requires.
5. Changes. We will post changes here with a new version date and tell you in the app.