Privacy Policy

Rivaly (“Rivaly”, “we”, “us”) runs the Rivaly app and website at rivaly.fun. We decide how and why your personal data is used, which makes us responsible for it. This policy works alongside our Terms of Use. Contact us any time at support@rivaly.fun.

When you create an account: your email address (or the identity your social login shares, such as your name and email from Google), and the username you choose.

Your profile: anything you add — display name, photo, banner, bio, colours and links to your social accounts.

Your wallet and activity: your Solana wallet address, deposits, withdrawals, the rooms you create and join, your stakes, sides, results, payouts and host earnings, and the people you follow.

What you post: chat messages, Arena posts and replies, reactions, photos and GIFs, and any reports you make.

Usage data: which pages and features are used, the type of device and browser, your country (worked out from your IP address, which we don’t keep with your activity), and how you first found Rivaly — for example a shared link or a campaign. It is linked to your account once you sign in.

When you contact us: what you send us and our replies.

We don’t collect your payment-card or bank details, and we don’t hold the keys to your wallet.

• To run Rivaly for you — your account, rooms, stakes, settlement, payouts, host earnings, chat and the Arena. (We need this to provide the service you signed up for.)
• To keep Rivaly fair and safe — preventing fraud, multiple accounts, match-fixing and abuse, enforcing our terms, and moderating content. (Our legitimate interest in a fair, safe service, and where needed, the law.)
• To improve Rivaly — understanding which features work, fixing problems and planning what to build. (Our legitimate interest; you can switch usage data off.)
• To talk to you — in-app notifications about your rooms and people you follow, and replies when you contact us.
• To meet legal obligations — keeping records and responding to lawful requests.

We don’t use your data for advertising, and we don’t make automated decisions about you that have legal or similarly significant effects. Rooms settle automatically from match data — that’s about the match, not about you.

Rivaly is social, so some things are visible to everyone, including people who aren’t signed in and search engines:

• your username, profile, follower counts, record and the rooms you’ve created or joined in public rooms;
• which side you took and your stake in a public room, and what you say in its chat;
• your Arena posts, replies and reactions.

Private rooms are visible only to the people in them and are never shown to search engines. Host earnings are private unless you choose to show them.

The blockchain is public and permanent. Deposits, stakes, payouts and withdrawals are transactions on the Solana network. Anyone can see the wallet addresses and amounts involved, and someone who knows your wallet address could connect it to your activity. Nobody — including us — can change or delete a blockchain transaction.

We never sell your personal data. We share it only with:

• Service providers who run Rivaly for us, under contracts that let them use it only to provide their service: Supabase (database, sign-in and storage), Vercel (hosting), Dynamic (sign-in and wallets), Helius (access to the Solana network), Cloudinary (photos), Klipy (GIF search, which receives a coded ID, not your name) and Render (scheduled jobs).
• Sign-in providers you choose, such as Google, under their own privacy policies.
• Authorities, when the law requires it, or to protect people from fraud or harm.
• A buyer or successor, if Rivaly is reorganised, merged or sold — they would remain bound by this policy.

Our sports-data providers send us match data; they don’t receive anything about you.

Rivaly sees how fans call matches: which way the crowd leans, how money moves before kickoff, and how often the crowd is right. Through Rivaly Data, we sell or license aggregated, anonymised statistics like these to partners such as media companies, clubs, leagues and researchers.

• Every figure is a total or an average across many people, calculated inside our database.
• No figure describes fewer than 5 different people — smaller groups are left out entirely.
• No dataset contains names, usernames, email addresses, wallet addresses or anything anyone has written.
• Partners must agree not to try to identify anyone from the data.

This data can’t reasonably identify you, so it isn’t personal data — but we want you to know it exists.

We use a small number of cookies and browser storage items, and no advertising or third-party tracking cookies:

• Essential — keeping you signed in, and the sign-in and wallet provider’s own session. Rivaly can’t work without these.
• Preferences — light or dark mode, and things you’ve already seen, such as the first-time guide.
• Our own analytics — a random browser ID, a visit ID that resets after 30 minutes idle, and a cookie recording how you first arrived (kept for 180 days) so we know which channels bring people to Rivaly.

Analytics switch off automatically if your browser sends Do Not Track or Global Privacy Control, and you can turn them off any time in Settings on your profile (“Share anonymous usage data”).

We keep your account data for as long as your account is open. When you close it, we delete or anonymise your personal data within a reasonable time, except what we must keep — for example records of financial transactions, or information needed to prevent fraud or deal with a dispute — which we keep only as long as that need lasts.

Things that have become part of other people’s rooms (such as your stake in a settled pool) are kept without your name where we can. Blockchain transactions can’t be deleted by anyone.

You can change your profile at any time and switch off usage data in Settings. You can also ask us to:

• give you a copy of the personal data we hold about you, in a portable format;
• correct anything that’s wrong;
• delete your data and close your account;
• stop or limit a particular use of your data, or object to it.

Email support@rivaly.fun from the address on your account. We’ll reply within 30 days, and may need to confirm it’s you first. Depending on where you live, you can also complain to your local data-protection authority — though we’d like the chance to put it right first.

Data is encrypted in transit, access to our database is restricted by row-level security so people can only read what they’re allowed to, and access to admin tools is limited, logged and audited. Your wallet’s keys are managed by our wallet provider and never held by Rivaly. No system is perfectly secure; if a breach affects you, we’ll tell you and the relevant authorities as the law requires.

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses for those transfers.

Rivaly is only for people aged 18 and over. We don’t knowingly collect data from anyone younger; if we learn we have, we close the account and delete it. If you think a child is using Rivaly, tell us at support@rivaly.fun.

When this policy changes, we’ll update the date at the top, and tell you in the app before material changes take effect.

8 October 2026: first published.

Email support@rivaly.fun with any question or request about your data.