Privacy Policy

This policy covers the DAGGER service and this marketing site. We use our own self-hosted analytics with your permission. For visitors identified as being in the United States, Meta advertising measurement is enabled unless you opt out or your browser sends Global Privacy Control. Elsewhere, or if we cannot determine your country, Meta stays off until you allow it. Existing advertising rejections remain respected. In this policy, “we,” “us,” and “our” refer to the team behind DAGGER.

When you create an account, we collect:

• Account information from your chosen sign-in provider: email address, authentication method (email, Google, Apple, or X), display name, and avatar URL
• Legal acceptance records: your account identifier, the exact Terms and Privacy notice version presented, the time you accepted, and your adult-eligibility attestation. We do not collect a birth date or identity document for this attestation.
• Profile and usage data we store: your role, account access status, any promo code used at signup, your in-app preferences, and account timestamps (created and last login)
• Technical and interaction information from your browser or connection, as described below, and information you send when contacting us

We do not collect payment card details, and we do not buy personal data about you from third parties.

We use browser storage to keep you signed in and make the app work. Authentication credentials are used with Supabase and our service to verify access. Other functional storage includes:

• localStorage: your pinned games and your browser-notification preference
• sessionStorage: cached game data for fast loads, and a short-lived promo token that is cleared after it is redeemed or the tab is closed

These are functional, not advertising, mechanisms. You can clear them at any time through your browser.

We store your separate analytics and advertising choices, the time you made them, their expiry, and the consent-policy version for up to 180 days in a cookie shared between our marketing site and app. A separate cookie remembers when you dismiss the privacy notice; dismissing it does not grant consent. When advertising tracking is enabled under the regional choices described above, Meta Pixel may store browser and ad-click identifiers, including cookies named _fbp and _fbc.

When server-side advertising measurement is enabled, a first-party advertising reference links eligible activity between our marketing site and app. We retain attribution context for up to 30 days and signup references for up to seven days. A signup reference can carry permitted attribution through a sign-in redirect or email confirmation; it does not sign you in or replace your privacy choices. Browsers and devices may have separate storage, including Instagram's in-app browser.

We use our existing website delivery provider, Cloudflare, to determine your approximate country from your connection for these privacy controls. Our privacy code uses the country for the current visit and does not store the IP address or other diagnostics returned by that lookup. A failed lookup leaves advertising off until you allow it.

With your Analytics permission, we use our own self-hosted, first-party analytics to understand how the Service and this site are used — pages viewed, time on page, clicks, navigation paths, feature usage, and aggregate performance (such as Core Web Vitals). This runs on infrastructure we control, not a third-party analytics cloud.

Where enabled, this includes session replay: a reconstruction of on-page interactions (clicks, scrolling, and navigation) that helps us find and fix usability issues. For signed-in dashboard users, this activity is associated with your account (such as your user id, email, display name, and role). We mask form input values in session replay. Optional browser reliability traces also depend on your Analytics choice. Operational server logs used to run and secure DAGGER are separate from browser tracking.

When advertising tracking is enabled, Meta Pixel sends Meta information about page visits, signup and login-button interactions, completed registrations, navigation, sections viewed, and scrolling. Meta also receives technical information such as page URLs, browser identifiers, and your IP address. We use this to measure our Facebook and Instagram ads and support relevant advertising.

Where enabled, we also send page visits and completed registrations from our servers through Meta Conversions API. This includes event times, page addresses without query strings, browser and ad-click identifiers, IP address and browser information. For registered users, we may include a hashed email address and account identifier to help Meta match activity to advertising. Hashing transforms identifiers for matching; it does not make them anonymous. Our advertising event parameters exclude passwords, authentication tokens and form contents.

Disclosure to Meta for targeted advertising may qualify as sharing or sale under applicable state privacy laws. Your Advertising choice applies to both browser and server measurement. Meta may combine this information with information it holds under its own privacy policy.

We use the information above to:

• Operate, secure, and maintain the Service
• Manage account access and preferences
• Apply promotions you signed up with
• Improve reliability and performance
• Measure and improve advertising subject to the regional choices described in this policy
• Send necessary operational messages (a signup notification is emailed to the operator)
• Deliver service updates and marketing emails according to your email preferences; these preferences are separate from browser tracking choices

Authentication is handled by Supabase and your chosen sign-in provider; profile data is stored in our own database; diagnostic traces go to our observability collector. When advertising tracking is enabled, the advertising activity described above is shared with Meta, which processes it under its own privacy policy. Scores, odds, and related data are fetched inbound from third-party sources — no personal data about you is sent to those sources as part of those inbound data requests.

Hosting and delivery providers, including Cloudflare, process requests to serve and secure the website. We use email delivery providers for operational messages and Brevo for our weekly email workflow, including recipient details and delivery or unsubscribe information. Use the unsubscribe link in an email or your account's email preferences to stop marketing emails. Essential account messages are separate.

See Meta's privacy policy for information about how Meta uses this data.

We retain Terms acceptance records separately from your profile to document the agreement and handle legal obligations or disputes. Closing an account does not automatically remove that evidence. We keep it only for as long as needed for those purposes and applicable legal requirements. Contact us to request access or deletion; legal retention requirements may limit what we can remove.

We keep account data while your account is active. You can ask us to access, correct or delete your data by emailing [email protected]. You can also clear your local and session storage and turn off browser notifications yourself at any time.

Server advertising payloads awaiting delivery expire after 24 hours. We clear their contents when delivery succeeds, is cancelled, or is permanently rejected. Delivery identifiers and status records are scheduled for deletion after 30 days. Expired attribution and delivery records are removed through routine cleanup. We retain account opt-outs to honor your choice. Account, operational and analytics retention depends on providing the service, investigating issues and handling requests; backup copies may remain until their normal rotation.

Use Settings → Privacy → Cookie Preferences when signed in, Privacy choices on the sign-in page, or Privacy choices in the website footer, to accept, reject, or separately select Analytics and Advertising at any time. Analytics, including session replay, stays off until you allow it. Advertising is enabled by default for US visitors without an existing rejection or browser opt-out, and requires opt-in elsewhere or when the country is unknown. Use “Opt out of ads” in the notice, or uncheck Advertising and select “Save choices” in your preferences, to opt out of sharing for targeted advertising. Rejecting Advertising stops our Pixel events and removes its _fbp and _fbc cookies and our advertising reference from our domain. When server measurement is enabled, we also stop subsequent collection and cancel unsent events when the opt-out reaches our server. Requests already in transit may have been received. Global Privacy Control keeps Advertising off without changing your separate Analytics choice. Turning Analytics off stops new analytics requests, clears Rybbit's browser identity, and refreshes open pages that were recording to stop their recorders. This can clear unsaved form entries. Your choice does not prevent you from using DAGGER.

Browser choices are shared between our marketing site and app where browser storage permits. When an advertising context is linked to your signed-in account, we also record its opt-out for that account. Other linked browsers apply it when they next check with our server; an unrecognized browser cannot be linked to you before sign-in. Clearing storage can remove browser choices. We honor Global Privacy Control; the older Do Not Track signal does not change these settings.

These controls stop future tracking; they do not automatically erase information already received by us or Meta. Contact us at the address above for deletion requests, including data previously shared with Meta. We will handle requests and notify recipients as applicable. We ask again when a choice expires or when tracking purposes or recipients materially change.

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your information and opt out of targeted advertising or sale/sharing. Contact us to submit a request, use an authorized agent, or appeal a decision where an appeal right applies. We may verify identity or an agent's authority for requests involving account data. You do not need to create an account to use the browser advertising opt-out, and exercising your rights does not prevent you from using DAGGER.

DAGGER accounts and authenticated features are intended for people who are at least 18 years old and have reached the age of legal adulthood where they live. If you do not meet these requirements, do not create an account or submit personal information to us. Parent or guardian permission does not replace these requirements.

If you believe someone below the applicable account age has provided personal information to DAGGER, contact [email protected] so we can review the report and take appropriate action under applicable law.

We may update this policy. The “Last updated” date above reflects the current version, and we will note material changes. This update clarifies adult account eligibility and legal acceptance records. The policy also describes server-side advertising measurement, matching identifiers, retention and advertising choices across signup. Questions or requests can be sent to [email protected].