Sidelines Privacy Policy

Version 2026.11.25

This policy explains what Sidelines collects, why, who it is shared with, how long it is kept and the choices you have. It is also our notice at collection under the California Consumer Privacy Act (CCPA/CPRA) and similar state privacy laws.

1. What we collect, and why

• Account: email, password (stored only as a one-way hash by our sign-in provider) and display name. Used to run your account.
• Identity verification (KYC): legal name, date of birth, mobile number, residential address and the last 4 digits of your SSN, plus a photo of a government ID and a selfie. Used to confirm you are a real, eligible, unique adult, prevent fraud, duplicate and underage accounts, and meet gaming, anti-money-laundering and sanctions laws. We do not run credit checks.
• Sanctions screening: your name and birth year are checked against the U.S. Treasury OFAC sanctions list when you verify and again whenever the list changes, as U.S. law requires before we pay prizes.
• Tax information: if your withdrawals in a year reach $600, your full SSN or ITIN and a W-9 certification, used only to file IRS Form 1099 and meet tax law.
• Biometric information: if you take a selfie, it is compared with your ID photo to confirm it is you. See the Biometric Notice.
• Location: your state each time eligibility is checked (state, time and accuracy). Precise coordinates stay on your device.
• Payments: deposit and withdrawal records and tokens issued by our processor. Full card and bank numbers never reach Sidelines.
• Activity: Playbooks, Pack purchases and pulls, buybacks, Rewards, balances, responsible-play settings and which terms you accepted.
• Shipping: name, address, email and phone when you ship a card.
• Device: app version and basic diagnostics. We do not use advertising identifiers or track you across other companies' apps or websites.

Sensitive personal information (SSN, government ID, biometric, precise location and account login) is used only for the purposes above, which state laws permit without a separate opt-in. We do not use it to infer characteristics about you.

2. Who we share it with

• Service providers under contract that may use it only to serve Sidelines: our database and hosting provider (Supabase, U.S. data centers), our identity verification partner (Persona) when enabled, our payment processor (Paysafe), shipping carriers (address only) and email delivery.
• Government agencies when the law requires, such as tax filings to the IRS and state, sanctions reports to OFAC, and responses to valid legal process.
• We do not sell your personal information and do not share it for cross-context behavioral advertising.

3. How we protect it

• Encrypted in transit (TLS) and at rest. SSN digits and tax IDs are additionally encrypted with a key held in a separate vault, and duplicate checks use a keyed hash, not the digits.
• ID photos and selfies go to a private store. You can upload but not read them back, and no one can browse it. Staff view photos only through 5-minute links.
• Only a small number of full administrators can open identity records. Every opening of an identity record, SSN, tax ID or ID photo is logged with the staff member and reason. Read-only staff never see identity details.
• The app hides identity screens from the app switcher and while your screen is recorded or shared, never saves ID photos to your photo library, re-encodes photos to remove location metadata, and keeps no identity details on your device after you submit.
• If a breach affects your personal information we will notify you and regulators as the law requires.

4. How long we keep it

• Selfies: deleted within 30 days after your verification is decided.
• Identity and transaction records: 5 years after your account closes (gaming, anti-money-laundering and tax rules), then deleted.
• Rejected verifications: 2 years, to prevent repeat fraud, then deleted.
• Accounts inactive for 5 years with no balance: identity details are deleted, and you would verify again to play with cash.
• Uploads you start but never submit: deleted within 2 days.

5. Your rights

Depending on your state (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) you can:

• Know and access what we hold: Account → Privacy & Data → Download My Data.
• Delete your account and data: Account → Privacy & Data → Delete Account. We keep only what the law requires, for the periods above.
• Correct inaccurate information: contact support. Identity details may need to be re-verified.
• Limit the use of sensitive information: we already use it only for the permitted purposes above.
• Opt out of sale, sharing or targeted advertising: we do none of these.
• Appeal a decision on your request by replying to our response, and complain to your state attorney general if you disagree.

We will not discriminate against you for using these rights. Send requests to contact@playsidelines.com; we confirm within 10 days and respond within 45 days. An authorized agent may act for you with your signed permission.

6. Children

Sidelines is for adults who meet their state's minimum age (18 or older). We do not knowingly collect information from anyone younger, and delete it if we learn we have.

7. Changes

We will tell you in the app before material changes take effect. Questions: contact@playsidelines.com.

Sidelines Biometric Notice

Version 2026.11.25

What we collect

When you verify your identity, you take a selfie (or a short selfie video) and a photo of your government ID. To confirm the person on the ID is you, the selfie is compared with the ID photo. This comparison can create a face geometry measurement, which some laws (including the Illinois Biometric Information Privacy Act, Texas and Washington law) treat as biometric information.

Why

Only to verify your identity, prevent fraud and duplicate or underage accounts, and meet gaming and anti-money-laundering rules. We never use it for marketing, advertising, profiling or any other purpose, and we never sell, lease, trade or profit from it.

Who handles it

Sidelines' verification team and, when enabled, our verification partner Persona, which processes it only on our instructions and under a contract that requires the same protections. It is shared with no one else except where the law requires.

How long we keep it

Selfies and any face measurements are deleted within 30 days after your verification is decided, and never kept longer than 3 years after your last interaction with Sidelines, whichever is sooner. Your ID photo is kept with your identity records for the retention period in the Privacy Policy.

How it's protected

Encrypted in transit and at rest in a private store with access limited to full administrators. Each view is logged.

Your consent

We ask for your written consent (the checkbox on the Photo ID & Selfie step) before collecting a selfie. You can decline: contact support to discuss other ways to verify, which may take longer. You can withdraw consent for future use at any time at contact@playsidelines.com.