PRIVACY POLICY

Collected: email address, password credential (stored by our authentication provider, never in readable form), Google sign-in identifier where you use it, username, selected avatar, date of birth, and the country and region you give as your residence.

Why: to create and secure your account, to enforce the 18+ requirement, to show you to opponents, and to support eligibility checks.

Visible to other players: your username and avatar only. Your email address and date of birth are private and are never shown to other players.

Retention: for the life of the account, and afterwards only as required for legal, financial and fraud-prevention purposes.

Duel uses Didit to verify identity before a withdrawal is processed. Depending on the workflow enabled for your verification, Didit may process government-issued identification details, images of that identification, a facial or liveness capture compared against it, your date of birth, and sanctions or anti-money-laundering screening results.

What Duel itself stores is limited to:

• the provider name and the verification session reference
• the verification status and, where given, the reason for the decision
• your verified legal first and last name
• your verified date of birth and whether the age requirement was met
• the verified country and region
• the type of document used (for example, driving licence or passport)
• the number of attempts and the completion time

Duel does not store copies of your identification images, your selfie, or any biometric template. Those remain with the verification provider under its own retention practices.

Why: to confirm you are 18 or older, that the account and payout destination are yours, and to meet compliance obligations that apply to real-money play.

Collected: with your permission, your device's precise location (GPS), read once each time you open the app and used to decide whether paid competitions are available where you are; plus your IP address, the region derived from it, and indicators that the connection appears to be routed through a proxy or VPN. We store the resulting state decision, not a location history. You can turn location off in your device settings at any time; paid competitions are then unavailable.

Your IP address is stored as a salted hash, not in plain form. The audit record stores the resolved country and state only.

Who receives it: our hosting and edge network, and IP-lookup services used to derive country, region and proxy signals (currently ipwho.is, ipapi.com, ipapi.co and geojs.io). Those services receive the IP address only, with no account information.

Why: to determine whether real-money competitions are available where you are, to prevent fraud, and for security.

Collected: matches you create, join or are invited to, opponents, per-round seeds and scores, submitted run data, ready and start timestamps, round history, results, and integrity or anti-cheat event records.

Why: to run competitions, to resolve them and any dispute about them, to detect cheating, and to keep an accurate record of settlement.

Retention: competition and settlement records are retained as financial records; they are not deleted on request where we must keep them.

Collected: deposit and withdrawal amounts, fees, statuses, your balance and ledger entries, prize and settlement records, refunds and chargeback records, and the payment provider's transaction identifiers. For withdrawals we store the payout method you chose, the destination handle you provide, and the name on it.

Duel never receives or stores full card numbers, card security codes, or bank credentials. Card and wallet payment data is handled by our payment provider.

Who receives it: our payment provider for deposits, and the payout service you select for withdrawals. Retention: as required for financial recordkeeping.

Collected: request headers including browser and operating-system information, hashed IP address, session and security events, server logs, and error or crash reports generated when something fails.

Why: to operate the service, to debug failures, and to detect abuse.

Collected: support emails you send, player reports you submit, and the transactional messages we send you (account, security, deposit and withdrawal notifications). If you allow notifications, we store a push token for your device and send match and account alerts through Apple Push Notification service or Firebase Cloud Messaging. Transactional email is delivered by Resend, which receives your email address and the message content.

Duel currently shares information with:

• our cloud database, authentication and hosting platform, which stores account, gameplay and financial data
• our edge network provider, which handles requests and supplies coarse geo headers
• Didit, for identity, age and compliance verification
• Our payment processor, for deposit processing
• Resend, for transactional email
• Apple and Google, for app distribution, in-app purchases of Duel Coins and push notifications
• IP-geolocation services, which receive an IP address only
• the payout service you select for a withdrawal

Providers are given only what they need for their function and are not permitted to use it for their own unrelated purposes.

Duel does not sell your personal information, and does not share it for cross-context behavioural advertising. Duel does not run third-party advertising or advertising trackers on the platform.

Duel may disclose information where it reasonably believes it is required by law or valid legal process, to respond to a lawful request from a regulator or law enforcement, to establish or defend legal claims, to investigate fraud, payment disputes or competition integrity, or to protect the safety of users.

If Duel is involved in a merger, acquisition, financing or sale of assets, account information may be transferred as part of that transaction, subject to this policy or a successor policy with equivalent protections.

Information is kept for as long as your account exists and afterwards only where a legitimate purpose requires it: financial and settlement records, verification outcomes, self-exclusion records, fraud and integrity records, and anything a legal obligation requires us to retain. Everything else is deleted or de-identified once it is no longer needed.

Typical periods: financial, settlement and transaction records — at least seven years; identity verification outcomes — five years after account closure; self-exclusion records — at least five years after the exclusion ends; general account data — deleted or de-identified within 90 days after closure unless a dispute, investigation or legal obligation requires longer.

Access to data is restricted at the database level so that each account can normally reach only its own records; privileged operations run server-side. Withdrawal and verification data is limited to what compliance review needs. No system can be guaranteed secure, and you are responsible for keeping your credentials safe.

Duel is not intended for anyone under 18 and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to a minor we will restrict it and delete the associated information other than what we must keep. Contact support@getduel.app to report such an account.

Depending on where you live, you may have the right to request access to the personal information we hold about you, correction of inaccurate information, deletion, confirmation of whether we process your information, and to opt out of certain processing. You may also ask us not to retaliate for exercising these rights.

Submit a request from the Privacy Choices & Data Requests page or by emailing support@getduel.app. We will verify that the request comes from the account holder before acting on it. Some information cannot be deleted while a legal, financial or fraud-prevention obligation requires us to keep it, and we will tell you when that is the case.

Depending on where you live, you may have the right to know, access, correct, delete or receive a copy of your personal information, to opt out of sale or targeted advertising (Duel does neither), and to appeal a decision about your request. Duel will not discriminate against you for using these rights. We respond within 45 days, extendable once by 45 days where the law allows. An authorised agent may submit a request with your signed permission, and we may verify your identity first.

The version, effective date and last-updated date at the top of this page identify the current text. Material changes will be notified in the product, and acceptance will be requested where required.

Duel LLC, a Georgia limited liability company. Privacy questions and requests: support@getduel.app.