Privacy

BLOCKCHAIN DATA IS PUBLICWallet addresses and transactions written to a public blockchain cannot be made private or erased by BagsLeague. Use a wallet you are comfortable associating with your public manager and contest history.

1. Scope and controller

This Policy explains how Altiora LLP, trading as BagsLeague, handles personal data when you use bagsleague.fun and related application services. Altiora LLP is the controller of offchain personal data described here. Privacy requests can be initiated through @bagsleague.

2. Data you provide

We process your public wallet address, selected wallet provider, signed login challenge and verification result, manager name, team name, club code and colour, lineups, weights, captain choices, custom-league settings, entries, claims, referrals, consent records, responsible-play pauses, and support information you submit. We do not receive or store your private key or recovery phrase.

3. Data collected automatically

We process session identifiers, timestamps, transaction hashes, contract events, scores, ranks, prices and settlement evidence, and technical request information ordinarily supplied to hosting infrastructure, such as IP address, country or region signal, user agent, device/browser type, and security logs. The app uses a necessary HttpOnly session cookie after wallet sign-in and browser storage for interface preferences such as theme. The current product does not use third-party advertising cookies.

4. Why we use data

We use data to authenticate wallets, maintain profiles, operate and settle leagues, verify contract transactions, display public tables and history, process claims and refunds, enforce eligibility and fair-play rules, prevent fraud and abuse, secure and troubleshoot the Service, comply with legal obligations, and improve reliability and usability.

5. Legal grounds

Depending on your location, we rely on performance of our agreement with you, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where required. You may withdraw consent for optional processing, but this does not affect processing already lawfully completed or data required to provide or secure the Service.

6. Public information and blockchain permanence

Manager identity, wallet address, locked lineup, scores, ranks, results, and related contest activity may be visible to other users. Public-blockchain transactions are replicated by independent network participants outside our control. We cannot edit or delete blockchain records; where appropriate, we can correct or remove offchain profile presentation without altering the underlying chain.

7. Service providers and disclosures

We may share or transmit data to hosting and database providers, Solana Chain infrastructure and RPC services, wallets, oracle and market-data providers, security and professional advisers, and authorities where legally required. We do not sell personal data. Third parties process information under their own terms when you interact with their wallet, chain, explorer, or service.

8. International processing

The Service and its providers may process data in countries other than your own. Where required, we use or require appropriate transfer safeguards. Public blockchain data is globally accessible and cannot be confined to one country.

9. Retention

Wallet login challenges expire after five minutes. Wallet sessions are set to expire after 30 days unless revoked earlier. We retain profile, contest, settlement, consent, security, and transaction records for as long as needed to operate the Service, resolve claims, enforce rules, meet legal obligations, and maintain an auditable contest history. Public blockchain data follows the network's retention and cannot be deleted by us.

10. Security

We use wallet-signature verification, hashed session tokens, restricted cookies, transaction verification, and access controls intended to protect offchain data. No system is perfectly secure. Protect your device and wallet, verify every transaction, and report suspected compromise promptly. Never send a private key or recovery phrase.

11. Your choices and rights

Depending on applicable law, you may ask to access, correct, delete, restrict, or export offchain personal data, object to certain processing, withdraw consent, or complain to a supervisory authority. Some requests may be limited by blockchain permanence, fraud prevention, legal retention, or the rights of others. Disconnecting or logging out clears the current browser session but does not erase your profile, contest history, or onchain records.

12. Children

The Service is not directed to children. We do not knowingly allow anyone under 18 or below the applicable age of majority to enter. Contact us if you believe a child has provided personal information.

13. Changes and contact

We may update this Policy as the Service, providers, or law changes and will update the version date. Material changes will be presented through the Service where appropriate. Until a dedicated privacy mailbox is published, contact @bagsleague and do not include a seed phrase, private key, or other wallet secret.