Playbox
Жүктеу

Playbox Privacy Policy

Effective Date: April 19, 2026 Last Updated: October 7, 2026

This Privacy Policy ("Policy") explains how Playbox Sport Inc. ("Playbox," "we," "our," "us"), a Delaware C Corporation, collects, uses, stores, and shares your personal data when you access or use the Playbox platform, including our website (https://play-box.xyz), mobile applications (App Store, Google Play), and the Telegram-based WebApp (@playbot_playbot, collectively, the "Platform").

This Policy forms part of the Playbox User Agreement. By using the Platform, you consent to the practices described herein.

1. Legal Framework

Playbox complies with applicable data protection laws, including:

Where local law provides stronger protections, those protections apply.

2. Categories of Data Collected

2.1 Account Data

Name, email address, phone number, profile photo, date of birth, and city of residence. Collected when you register or update your profile.

2.2 Event and Activity Data

Event participation history, team memberships, match results, player ratings, statistics, and attendance records. Collected automatically as you use the Platform.

2.3 Payment Data

Transaction records, withdrawal history, and wallet balances. Full payment card and bank account details are processed and stored exclusively by our third-party payment partners (Stripe, Wise). Playbox does not store this information.

2.4 Location Data

City-level location (provided during registration or detected via IP address) and, where you grant permission, precise geolocation for finding nearby events. You may revoke location permissions at any time through your device settings.

2.5 Device and Technical Data

IP address, device type, operating system, browser type, app version, crash reports, and diagnostic logs. Collected automatically when you access the Platform.

2.6 Communications Data

Messages sent through in-app chat, notifications, and support requests.

2.7 Cookies and Analytics

Data collected through cookies, SDKs, and analytics tools including Google Analytics and Firebase. See Section 11 (Cookies) for details.

3. Purpose of Data Processing

We process personal data for the following purposes:

Purpose Legal Basis (GDPR)
Account creation and authentication Performance of contract
Event organization, participation, and communication Performance of contract
Payment processing, withdrawals, and fee collection Performance of contract
Fraud prevention and AML/KYC compliance Legal obligation
Platform safety and security Legitimate interest
Service improvement and analytics Legitimate interest
Marketing communications Consent
Customer support and dispute resolution Performance of contract
Compliance with legal obligations Legal obligation

4. Email Communications

We send two categories of email:

Service Emails (no consent required)

These emails are necessary for the operation of your account and are sent under the "Performance of contract" or "Legitimate interest" legal bases:

You cannot opt out of service emails while your account is active, as they are essential to the Platform's operation.

Marketing Emails (consent required)

These emails are sent only with your explicit consent under GDPR Article 6(1)(a):

You may provide consent during registration or at any time through your account settings. You may withdraw consent at any time by:

Withdrawal of consent does not affect the lawfulness of processing performed before the withdrawal. We record the date and source of your consent for compliance purposes.

5. Data Shared with Event Organizers

When you join an event, the Organizer may see your name, profile photo, player rating, and team membership. Organizers must not use participant data for any purpose beyond event management. Playbox is not responsible for Organizer misuse of participant data.

6. Data Sharing with Third Parties

We do not sell your personal data. Data may be shared with:

All third-party processors are contractually obligated to protect your data and may only process it for the purposes we specify.

7. International Data Transfers

Your data may be transferred to and processed in the United States or other countries outside your place of residence. For EU/EEA users, transfers rely on Standard Contractual Clauses (SCCs) or other lawful safeguards under GDPR. By using the Platform, you acknowledge these transfers.

8. Data Retention

We retain personal data according to the following schedule:

Data Type Retention Period
Active account data While your account remains active
Event and match data 24 months after event completion
Chat messages 12 months
Payment and transaction records As required by law (typically 5–7 years)
Connected YouTube channel or Google Calendar and their access tokens Until you disconnect them or delete your account; tokens are erased immediately on disconnect
Data after account deletion Anonymized or deleted within 30 days, except where legal obligations require longer retention

9. Security Measures

We implement industry-standard safeguards including TLS/SSL encryption, role-based access control, firewalls, secure cloud infrastructure, and regular security assessments. However, no system is completely secure, and Playbox cannot guarantee absolute data security.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

10. User Rights

Depending on your jurisdiction, you have the right to:

For California Residents (CCPA/CPRA)

You have the additional right to:

To exercise any of these rights, contact us at [email protected]. We will respond within the statutory deadline applicable to your jurisdiction (30 days under CCPA, one month under GDPR).

11. Cookies

We use cookies and similar technologies to operate and improve the Platform.

Category Purpose Required
Strictly Necessary Authentication, security, core functionality Yes
Analytics Usage statistics, performance monitoring No
Functional User preferences, language settings No
Marketing Targeted advertising, campaign measurement No

You can manage cookie preferences through your browser settings or the cookie consent banner on the Platform. Refusing non-essential cookies will not block your access to the Platform.

12. Children's Privacy

The Platform is not directed at children under 13 in the United States or under 16 in the European Union, unless local law sets a lower digital consent age (not below 13). We do not knowingly collect data from minors. If we become aware that data has been collected from a child, we will delete it promptly. Parents or guardians may contact us to request removal of their child's data.

13. AML/KYC Compliance

To comply with financial regulations, Playbox may require users requesting withdrawals to submit identity verification documents (e.g., passport, government ID). Playbox may suspend accounts or deny withdrawals for users who fail to meet KYC requirements. Verification data is processed securely and retained only as long as required by law.

14. Amendments

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through notices on the Platform at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

15. Contact Information

Company Name: Playbox Sport Inc. Entity Type: Delaware C Corporation Business Address: 2261 Market Street, San Francisco, CA 94114, USA Phone: +1 510-722-0535 Email: [email protected]

For data protection inquiries, contact us at [email protected] with the subject line "Privacy Request."

16. YouTube API Services

Playbox uses YouTube API Services in three ways:

By using these features you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy (https://policies.google.com/privacy) explains how Google handles your data.

16.1 Connecting your own YouTube channel

Connecting a channel is optional and is meant for people who stream games they organize or referee. You start it yourself from Settings or from the stream settings of a game, sign in with Google, and choose which of your channels to connect. Playbox requests a single permission, "Manage your YouTube account" (scope youtube.force-ssl), because the YouTube Data API requires it to create and manage live broadcasts.

What we access. The ID, title, and avatar of the channel you connected, and, for broadcasts that Playbox created on that channel, their status, stream settings, duration, and video ID. We do not read your other videos, comments, subscriptions, playlists, or any data from other Google services.

How we use it. Only to provide the streaming feature you asked for:

We never change the privacy of videos on your channel after the game, never add them to Playbox playlists, and never delete recordings from your channel.

What we store. The channel ID, title, and avatar URL, the identifiers of broadcasts created through Playbox, and the OAuth access and refresh tokens. Tokens are encrypted at rest, are never shown in the Platform or to Playbox staff, and are used only by our servers to make the requests listed above.

Sharing. We do not sell data obtained through YouTube API Services, do not use it for advertising, and do not share it with third parties, except with Google itself when making API requests and where required by law. Other participants of a game see only the public broadcast link, as with any stream.

Disconnecting. You can disconnect each channel at any time in Settings → Connected Apps. Playbox erases that channel's tokens immediately; broadcasts already on your channel stay there. Google keeps one access grant per Google account for Playbox, so when you disconnect the last Google connection (your channels and Google Calendar), Playbox also revokes that grant with Google. You can also revoke access on the Google security settings page (https://security.google.com/settings/security/permissions).

16.2 Data from the Playbox channel and the embedded player

For the official Playbox channel, only the owner of that channel authorizes our access. The YouTube data we store about it is public information about videos on our own channel: video and playlist identifiers, titles, descriptions, and aggregate view statistics.

When you view embedded YouTube content, YouTube may collect data about that playback, including your IP address and device information, under its own policies.

Stored YouTube data is retained under Section 8 (Data Retention) and is deleted together with the related event data, or when you disconnect your channel.

17. Google Calendar

Connecting your Google Calendar is optional. You start it yourself in Settings → Connected Apps and sign in with Google. Playbox requests a single permission, "See, create, change, and delete events on Google calendars you own" (scope calendar.events.owned).

What we do with it. When you join or create a game on the Platform, we add it to your primary Google Calendar with the date, time, place, and a link to the game page. We update that event when the game is rescheduled or moved, and delete it when you leave the game, are removed from it, or the game is cancelled. We only create, change, and delete events that Playbox itself added.

What we do not do. We do not read, copy, or store your other calendar events, and we do not access other Google services.

What we store. OAuth access and refresh tokens, encrypted at rest and never shown in the Platform or to Playbox staff, and the list of games we added to your calendar, so we can update or remove them.

Sharing. We do not sell this data, do not use it for advertising, and do not share it with third parties, except with Google itself when making API requests and where required by law.

Disconnecting. You can disconnect at any time in Settings → Connected Apps. Playbox then removes the games it added and erases the tokens immediately; if no YouTube channel stays connected, Playbox also revokes its access with Google. You can also revoke access on the Google security settings page (https://security.google.com/settings/security/permissions).

18. Limited Use of Google user data

Playbox's use and transfer of information received from Google APIs, including YouTube API Services and the Google Calendar API, adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.