This Privacy Policy explains how PoolDefy (“we,” “us,” “the Platform”) collects, uses, shares, and protects personal information about users of the Platform at pooldefy.com and our related services (collectively, the “Services”). It applies to information we collect when you use the Services, whether or not you are logged in.
PoolDefy operates as a free-to-play promotional sweepstakes platform offering a Gold Coin (amusement) currency and a Promo Coin (sweepstakes) currency. The Promo Coin component triggers identity-verification and tax-reporting obligations on prize redemption. This Policy describes how we handle the data needed to operate that model, including identity documents, residential address, and payout-method information.
If you choose to sign in with Google, PoolDefy uses Google's OAuth 2.0 / OpenID Connect flow. The disclosure below is provided to comply with the Google API Services User Data Policy, including the Limited Use requirements.
Data we access. We request only the standard sign-in scopes:
openid — to receive a Google-issued ID token that proves you control the Google account.email — your primary Google email address and its verification status.profile — your name and profile picture (received but not stored — see below).We do not request, access, or use any other Google user data. We never request access to Gmail, Drive, Contacts, Calendar, photos, location, or any other Google service.
How we use the data. Solely to authenticate you to the PoolDefy platform — that is, to:
We do not use Google account data for advertising, profiling, training machine-learning models, or any purpose other than authentication.
What we store. From the data Google returns we persist only:
sub claim) so we can recognise you on return.We do not store the name or profile picture returned by the profile scope. We do not store Google access tokens or refresh tokens.
Sharing. Google account data is never sold, transferred, or shared with third parties. It is used only on PoolDefy's own backend for the authentication purpose described above. The data is processed on our infrastructure (currently Railway / Vercel — see Section 15 on international transfers).
Retention. Google account data we store is retained for the lifetime of your PoolDefy account. When you delete your PoolDefy account (Section 8), we delete the linked Google identifier and email along with the rest of your profile, subject to the regulatory retention windows described in that section.
Your control. You can disconnect Google sign-in from your PoolDefy account at any time by signing out and switching to password authentication, or by revoking PoolDefy's access from your Google Account at myaccount.google.com/permissions. Revoking access from Google does not delete your PoolDefy account; to delete the account itself, follow the instructions in Section 10.
Limited Use confirmation. PoolDefy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
| Purpose | Categories used |
|---|---|
| Operate the Services. Authenticate you, run contests, settle results, process Gold Coin package purchases, credit Promo Coin grants, render leaderboards. | Account information, activity data, purchase & redemption-related information. |
| Sweepstakes prize redemption. Verify your identity and eligibility, calculate the prize amount, prepare tax-reporting forms where applicable, and broadcast the redemption transfer. | Account information, eligibility & redemption verification information, redemption-related information. |
| Anti-fraud, anti-collusion, anti-money-laundering. Detect multi-accounting, pick collusion, sanctions matches, AMOE abuse, and suspicious purchase / redemption patterns. | IP, fingerprint, wallet addresses, activity data, eligibility verification information. |
| Ineligible-jurisdiction enforcement. Block contest entries and redemptions for residents of, or persons physically located in, ineligible jurisdictions. | IP and approximate location, residential address (during verification). |
| Customer support. Respond to questions, investigate disputes, void or adjust where appropriate. | Account information, communications, activity data. |
| Communications. Transactional notifications (purchase confirmed, redemption status, contest settled, position changes), security alerts, and (with your consent or where permitted) product news. | Email, account preferences. |
| Product analytics & reliability. Diagnose bugs, measure feature adoption, improve the Platform. | Aggregated activity data, device & technical data. |
| Legal compliance. Tax reporting where required, sanctions screening, sweepstakes compliance, responding to lawful requests from regulators or law enforcement. | Account information, eligibility verification information, activity data. |
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
We share personal information only as follows:
We do not sell or rent your personal information to advertisers or data brokers, and we do not share personal information for cross-context behavioural advertising.
Gold Coin package purchases funded with USDC, and Promo Coin redemption payouts, occur on public blockchains (currently Polygon for USDC). Information you transmit on chain — including the wallet addresses involved, transaction hashes, amounts, and timestamps — is permanently and publicly viewable and is not under our control. Any third party can correlate on-chain activity associated with your wallet, including activity outside the Platform.
Inside the Platform we keep your wallet activity tied to your account so we can credit purchases and process redemptions. We do not publish your account-to-wallet linkage outside the Platform except as described in Section 4.
We use cookies and similar storage technologies for the following purposes:
We do not currently use third-party advertising cookies. If we adopt them in future, we will update this Policy and provide a clear opt-in mechanism where required.
Because Promo Coin sweepstakes contests and redemptions are unavailable in certain jurisdictions (Section 4 of the Terms of Use), we determine an approximate location for every session using:
We do not collect precise GPS-level location. We may block access to the Promo Coin portion of the Services from sessions whose approximate location resolves to an ineligible jurisdiction; the Gold Coin portion may remain accessible at our discretion. Attempts to obscure your location through VPNs, proxies, or false residence statements are a Terms violation and may result in account suspension.
We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, hashed passwords, role-based access controls, audit logs, two-factor step-up for sensitive admin actions, and segregation patterns for treasury and redemption wallets. No system is perfectly secure; if you have reason to believe your account has been compromised, contact us immediately at support@pooldefy.com.
Subject to applicable law, you have the right to:
To exercise any of these rights, email support@pooldefy.com. We will respond within the time frame required by applicable law (typically 30–45 days).
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
To exercise these rights, email support@pooldefy.com. We may need to verify your identity before responding.
Residents of Colorado, Connecticut, Utah, Virginia, Texas, Oregon, New Hampshire, Delaware, and other U.S. states with comprehensive consumer-privacy statutes have rights similar to those described in Section 11, subject to each state's specific framework. Those rights generally include access, correction, deletion, portability, and the right to opt out of targeted advertising, sale, and certain types of profiling. To exercise these rights, email support@pooldefy.com; we will route your request to the appropriate workflow for your state.
If you are in the European Economic Area or the United Kingdom, the legal bases for our processing are described in Section 3, and the rights described in Section 10 apply to you in the form set out in the GDPR / UK GDPR. You have the right to lodge a complaint with your national supervisory authority. The data controller is the entity operating PoolDefy.
The Services are intended only for individuals aged 18 or older (or the age of majority in your jurisdiction of residence if higher), and only for individuals with the legal capacity to enter into contracts and to participate in promotional sweepstakes in their jurisdiction of residence. We do not knowingly collect personal information from any individual under 18. If you become aware that information has been provided to us by an individual under 18, contact support@pooldefy.com and we will remove it.
We operate globally and may transfer personal information to countries other than the one in which you reside. Where we transfer information out of the EEA or UK, we use appropriate safeguards (e.g. EU Standard Contractual Clauses) to provide a level of protection equivalent to your home jurisdiction.
The Platform may link to third-party websites and services (e.g. blockchain explorers, sports-integrity bodies, identity-verification vendor portals, social media). Their privacy practices are not covered by this Policy — review their policies before interacting.
We may update this Policy from time to time. Material changes will be communicated via email or in-Platform notice at least 14 days before they take effect. The effective date at the top of this Policy reflects the most recent revision.
Questions, requests to exercise your rights, or complaints? Email support@pooldefy.com.