Privacy Policy

Tsoro (“we”, “us”) operates a skill-based draughts platform with optional real-money contests. Controller identity, registered address, and DPO contact will be completed with counsel before public launch.

Account data (username, email, password hash), session cookies, IP address and approximate country (via MaxMind GeoLite/GeoIP for cash geo-fencing), gameplay and match telemetry, wallet ledger events, KYC status and admin review notes, and payment references processed by Stripe (we do not store full card numbers). Guest accounts use ephemeral demo emails and are limited to soft play.

To provide accounts and gameplay; authenticate sessions; enforce age, geo, and responsible-gaming rules; process deposits/withdrawals; settle skill contests; prevent fraud; meet legal and licensing obligations; and improve reliability. Legal bases (where GDPR/UK GDPR apply) may include contract, legitimate interests, legal obligation, and consent where required.

Account and ledger records are retained for the life of the account and as required for financial audit, dispute resolution, and AML/KYC obligations. Guest accounts may be purged on a shorter schedule. Backups follow host retention policies.

Depending on your region, you may have rights to access, rectify, erase, restrict, or port personal data, and to object to certain processing. Contact support to exercise rights. You may also lodge a complaint with a supervisory authority.

We use an httpOnly session cookie for authentication. The client may store non-secret profile hints (user id / username) in localStorage; bearer tokens for cash APIs are not persisted. Essential cookies are required for signed-in play.

Data may be processed in regions where our hosts and Stripe operate. Appropriate transfer safeguards will be documented with counsel for launch markets.

We may update this Policy; material changes will be posted with a new version date. Continued use after notice constitutes acceptance where permitted by law.