Privacy Policy

01 / Introduction and Scope

This Privacy Policy explains how Rush Live, Inc. ("Rush Live", "Rush", "we", "us") collects, uses, shares, and protects personal information when you use the Rush Live mobile application, the Rush Live companion software for your PC, our website, and the support channels connected to them (together, the "App"). In this Policy, "Companion", also written "companion", means the Rush Live companion software for your PC, which is called "Rush Tracker" in the App. It applies to everyone who creates an account or otherwise uses the App.

Rush Live is a real-money skill-contest platform for adults. That shapes this Policy: the law and our payment partners require us to know who you are, how old you are, and where you live before you can put money in, and to keep records of money in and money out for years afterwards. We collect what those obligations and the service itself need, and we say below exactly what that is. If you do not agree with this Policy, please do not use the App.

02 / Children's Privacy

Rush Live is strictly for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18: we ask your date of birth during sign-up, and identity verification confirms it against a government-issued ID before your first real-money entry. If we learn that we have collected information from a minor, we will delete it promptly and close the account. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect data from children under 13.

If you believe a person under 18 has provided us with personal information, please contact us immediately at rushliveteam@gmail.com.

03 / Information We Collect

Account data (information you provide)

• Account information (full legal name, email address, phone number, username)
• Date of birth (to confirm you are 18 or older)
• Profile information (avatar, bio)

Connected accounts and gameplay

• Linked gaming account identifiers you connect (for example a Twitch login used to pair the companion, or a Clash Royale player tag)
• Rush Live companion match telemetry — for partnered players who install the desktop companion, we receive signed in-game data (when a match starts and ends, results, kills, placement, rank, and similar per-game statistics) used to bind and settle your contests and to price self-stake targets
• Activity data (player-versus-player and self-stake entries, and the players you follow)

Identity verification (KYC)

• Before your first real-money entry — and again if required for fraud or legal reasons — our identity-verification provider (Stripe Identity) collects your full name, date of birth, address, a government-issued ID, and a selfie, and may create a facial-geometry template to confirm the ID and selfie match (see Biometric Consent & Retention)
• Tax information (e.g., taxpayer identification details) required for IRS reporting once you cross the reporting threshold

Wallet and payments (USD real-money lanes)

• Stripe processes all payment transactions; we never store full card numbers
• Segregated USD wallet activity (deposits, entry fees, winnings, refunds, withdrawals) and transaction history and amounts
• Payout-destination details you provide to Stripe Connect for USD withdrawals
• Membership purchases made through Apple: the plan, its status, and an Apple transaction identifier — Apple keeps your payment details, not us

Device, location and usage data (collected automatically)

• Device information (device type, operating system, app version, push-notification token if you allow notifications)
• Usage data (features used, screens viewed, time spent in the App, session data) — see Automatic Collection, Analytics and Cookies
• Log data including IP address and access times
• Your state of residence — from your verified identity document (or, where we allow it, as you told us) — used at each deposit and contest entry to enforce our state restrictions. The App does not ask your phone for its location (see Location & State Eligibility)
• Responsible-gaming settings and self-exclusion history

Support

• Messages you send us (email, in-app reports and feedback, dispute and review requests) and the records we keep of how we handled them

Sensitive information

Some of the above is treated as sensitive under state privacy laws: your government ID and selfie, any facial-geometry template derived from them, your taxpayer identification number, and your payment details. We collect these only because the law and our payment partners require them for a real-money contest platform. We use them only to verify your age and identity, confirm your state of residence is a permitted one, process payments, prevent fraud and money laundering, and meet tax and record-keeping obligations. We do not sell them, use them for advertising, or use them to infer anything about you beyond eligibility and fraud risk.

04 / Where This Information Comes From

• You — when you sign up, fill in your profile, deposit, enter a contest, buy a membership, or contact us
• Your device — device details, IP address and usage events, collected automatically by the App
• The Rush Live companion on your PC — signed match data from your own game client
• Game publishers' APIs — for Clash Royale only, match results fetched from Supercell using your linked player tag
• Stripe — verification results, payment status, refund status, and payout status
• Apple — the status of a membership subscription you bought through the App Store
• Fraud and sanctions screening providers — risk signals about an identity, address, or transaction

05 / Automatic Collection, Analytics and Cookies

The App records how it is used so we can see where players get stuck, fix crashes, and keep the money funnel honest. Here is exactly what runs:

• Product analytics (PostHog): events such as "opened the stake board", "deposited", "entered a contest", how long a session lasted and how often you return. These are keyed to your account identifier only. We do not send your name, email, phone number, date of birth, card details, or identity-verification state to analytics
• Crash and error reporting (Sentry): when the App fails we receive a technical report (the error, the screen, device and app version) so we can fix it
• Server logs: IP address, request times and the outcome of each request, kept for security, rate limiting and fraud detection

The App itself does not use advertising identifiers, third-party advertising trackers, or cross-app tracking, and we do not ask iOS for tracking permission. Our public website uses no advertising cookies; it may set the strictly necessary cookies its hosting provider needs to serve pages. We do not use analytics data to build advertising profiles or to make decisions about your eligibility.

06 / How We Use Your Information

Service provision

• Provide and improve the Rush Live service and run the real-money skill contests
• Bind and settle player-versus-player matches and self-stake entries from verified match data, and price self-stake targets from your own verified statistics
• Verify that you are 18 or older, confirm your identity before your first real-money entry, and confirm your real-money eligibility for each action
• Operate the segregated USD wallet and process deposits, entry fees, winnings, deposit refunds, and Stripe Connect withdrawals
• Activate and manage a membership you buy through Apple
• Send notifications about contest results, match outcomes, payouts, and players you follow

Geofencing and fraud prevention

• Confirm at the moment of each deposit and contest entry that your state of residence is a permitted state (the per-action state check)
• Detect and prevent fraud, collusion, multi-accounting, chargeback abuse, and cheating

Customer support

• Answer your questions, investigate disputed results, unauthorized transactions, and payment errors, and review enforcement decisions you ask us to reconsider

Analytics

• Understand how users interact with features
• Improve platform performance and user experience

Marketing

• Communicate with you about updates, new features, promotions, and contest results
• You may opt out of marketing communications at any time

Legal compliance

• Anti-money-laundering (AML) and sanctions/OFAC screening on the real-money lanes
• IRS 1099-MISC reporting for users with $2,000 or more in net winnings in a year
• Responding to lawful legal requests and enforcing our Terms
• Comply with other legal obligations

07 / How We Share Information

We do NOT sell your personal information

We share information only with:

• Stripe, Inc. — payment processing, deposit refunds, and USD payouts via Stripe Connect (Stripe is the transmitter-of-record for withdrawals), plus identity verification via Stripe Identity. Card and payout details are handled by Stripe and never stored on our servers
• Apple — membership subscriptions are bought and billed through the App Store; RevenueCat, our subscription-management provider, validates the purchase with Apple and tells our servers which plan is active
• KYC / AML and sanctions (OFAC) screening providers used to verify identity and meet anti-money-laundering obligations
• Service providers who help us operate the App: hosting and database (Supabase), product analytics (PostHog), crash reporting (Sentry), and push-notification delivery (Expo and Apple)
• The Rush Live companion (our gameplay-integrity software, built on the OverWolf platform) — it reads your own game client and sends us signed match data; OverWolf's own privacy policy governs what the platform itself collects
• Game publishers — for Clash Royale only, we send your linked player tag to Supercell's API to fetch match results; no other personal information is sent to a publisher
• Customer-support tooling — the email and ticketing services we use to read and answer your messages
• Other users — only your public profile: username, avatar, leaderboard rank, and the connected stats shown on your player profile. Your legal name, contact details, and money never appear to another user
• Law enforcement and regulators — when required by valid, lawful legal process, or where we believe disclosure is necessary to prevent fraud or harm
• Tax authorities — as required by IRS 1099-MISC reporting rules for users with $2,000 or more in net winnings in a year
• A successor — if Rush Live is involved in a merger, acquisition, or sale of assets, your information may transfer to the successor, who will be bound by this Policy until it tells you otherwise

08 / Biometric Consent & Retention

Biometric consent.

To verify your identity before your first real-money entry, our verification provider (Stripe Identity) will capture an image of your government ID and a photo/selfie of your face, and may create a facial-geometry template to confirm they match. By tapping "I Consent," you authorize Rush Live and its verification provider to collect, store, and use this biometric data solely to verify your identity and prevent fraud.

How we handle biometric data

• We collect it only AFTER you consent, BEFORE any biometric capture takes place
• We do NOT sell, lease, trade, or otherwise profit from biometric data
• It is used solely to verify your identity and prevent fraud
• It is retained only as long as needed for verification and legal compliance, and is permanently destroyed thereafter per our Biometric Retention Schedule

You may decline, but identity verification — and therefore real-money play, deposits, and withdrawals — cannot proceed without it.

09 / Identity Verification (Stripe Identity)

We use Stripe Identity for identity verification (KYC). Verification is required before your first real-money entry, and we may ask you to verify again when we need it to confirm eligibility, investigate suspected fraud, or meet a legal obligation. When you verify your identity:

• Stripe Identity collects your government ID, a selfie, and personal information, and may create a facial-geometry template to confirm they match (see Biometric Consent & Retention)
• This data is processed by Stripe under its privacy policy
• We receive your verification status (pass/fail), a verification ID, and the verified attributes we are required to keep (e.g., name, date of birth, address)
• We do NOT store copies of your ID or selfie photos

Data retention

• Verification records are retained at least 5 years for BSA/AML compliance
• Biometric templates are destroyed per our Biometric Retention Schedule (see Biometric Consent & Retention)

For more information, see Stripe's Privacy Policy at stripe.com/privacy.

10 / Location & State Eligibility

Rush Live offers real-money skill contests only in permitted U.S. states — 38 states today; the 12 restricted states are listed in the Terms of Service. Your eligibility is decided on our servers, at each deposit and contest entry, from your state of residence.

What we use today

• The state on the identity document you verified through Stripe Identity; until you have verified, the state you told us, where we allow that
• The IP address of your requests, which we log and use for rate limiting and fraud and abuse detection

What we do not do today

• The App does not ask your phone for its location, and does not collect GPS or other precise device location
• We do not currently send your IP address to a geolocation or VPN-detection service

What we may add

We reserve the right to use geolocation and IP-based location technology to confirm where you physically are before permitting a real-money action, and to detect VPNs and location spoofing. If we add this, the App will request the permission, this Policy will be updated to say exactly what is collected and for how long, and that location information will be used only for eligibility and fraud prevention and never sold.

11 / Contact & Friend Discovery

Rush Live offers an optional "Find friends from contacts" feature that shows you which of your phone contacts are already on Rush.

How it works

• When you choose to sync contacts, the App reads your device’s contact list on the device
• Names never leave your phone. Each phone number is turned into a hashed code (a salted SHA-256) on your phone, and only those codes are sent to us
• We compare the codes against the codes of numbers Rush users have added to their own accounts, and return only the matches
• A contact who is not on Rush leaves nothing behind: we do not store, log, or count their code
• Honest limits: a hashed code is not the number, but hashing is not encryption. Someone holding our salt could work backwards to a phone number, so we treat the codes as personal information and protect the lookup with strict server-side limits on how many codes one account can check

Your control

• Contact access is entirely optional — the App works without it
• You can revoke access at any time in your device settings
• If you add a phone number to your own account, we store it (for sign-in codes) and its hashed code (so friends who already have your number can find you)

12 / Your Choices

• Marketing email: opt out at any time by emailing rushliveteam@gmail.com. Service messages about your account, contests, money, and security continue while you have an account
• Push notifications: the App asks your permission; change it at any time in your device settings
• Text messages: we send SMS only to deliver a one-time sign-in code to a phone number you gave us. Sign in with email instead if you would rather receive no texts
• Contacts: grant or revoke the permission in your device settings; revoking it stops any further matching
• Blocking: you can block another player in the App; a blocked player cannot challenge you or see you in friend search
• Analytics: the events described above are part of running the service; if you do not want them recorded, delete your account
• Account deletion: available in the App settings. See Data Retention for what the law makes us keep

13 / Data Security

We protect your data with the following measures, each of which is part of how the App is built rather than a promise about the future:

• Encryption in transit: every connection between the App, the companion, and our servers uses TLS; data at rest is encrypted by our hosting provider
• Row-level security on the database tables that hold your personal data, so a signed-in user can read only their own rows
• Server-side authority for money: every deposit, entry fee, payout, refund, and withdrawal is executed by locked server-side procedures; the App itself can never move a balance
• Rate limiting on the public and money-lane API functions, stored in the database so it holds across every server
• Identity documents and selfies are captured and held by Stripe Identity; we receive the verification result and the verified attributes, not the images
• Secrets (API keys, signing keys) live in environment configuration, never in the App or the source code
• Security reviews are recorded and dated: a seventeen-category security audit in August 2026 and a red-team exercise in September 2026, with the fixes tracked in our engineering records

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we learn of a breach affecting your personal information we will notify you as the law requires.

14 / Data Retention

We retain your data for as long as your account is active. You can request deletion of your account and associated data at any time through the App settings. After account deletion, we may retain certain data where the law requires it or for legitimate business purposes (e.g., anti-money-laundering recordkeeping and fraud prevention).

Retention periods

• Account data: retained while account is active + 3 years after deletion
• Payment, wallet, and transaction records: at least 5 years, as required by the Bank Secrecy Act (BSA) and related AML rules
• Identity verification (KYC) and biometric records: retained only as long as needed for verification and BSA/AML compliance (at least 5 years), then destroyed per our Biometric Retention Schedule
• Usage and analytics data: 2 years, then aggregated/anonymized
• Responsible-gaming / self-exclusion records: permanent (player protection)
• State-eligibility checks: we keep the outcome of each check (the state we determined, its source, and when) with the transaction it gated, for the same period as the transaction record
• Gameplay-verification data (companion match reports and settlement evidence): retained with the contest it settled, for the same period as the transaction record, so a result can be re-examined if disputed
• Fraud and integrity records (investigations, flags, enforcement decisions and your review requests): retained at least 5 years after the matter closes, longer where an account was closed for fraud
• Tax records (taxpayer identification, 1099 filings, withholding): at least 7 years after the tax year they relate to

After the applicable retention period, data is securely deleted or irreversibly anonymized.

15 / Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data — subject to records we are legally required to keep, such as transaction, KYC, and AML records retained under a legal hold for the BSA 5-year period
• Opt out of marketing communications
• Export your data in a portable format

To exercise these rights, contact us at rushliveteam@gmail.com or use the settings in the App.

California residents (CCPA/CPRA)

• Right to know: request what personal information we collect and how it is used
• Right to delete your personal information (subject to legal exceptions)
• Right to opt out of the sale or sharing of personal information (we do not sell or share it for advertising)
• Right to limit the use of sensitive personal information (we already use it only for the purposes listed under Sensitive information)
• Right to non-discrimination for exercising your rights

Residents of other U.S. states with privacy laws

If you live in a state with a comprehensive consumer-privacy law (for example Virginia, Colorado, Connecticut, Utah, Texas, or Oregon), you have the rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of sales, targeted advertising, and profiling that produces legal or similarly significant effects. We do not sell your personal information, do not use it for targeted advertising, and do not make automated decisions with legal effects about you other than the eligibility and fraud checks described in this Policy — which you may ask us to review by a person. We do not use your sensitive information for any purpose beyond those listed under Information We Collect.

EU/EEA and UK residents (GDPR)

The App is offered only in the United States. If you are nevertheless in the EU, EEA, or UK, you have the rights of access, rectification, erasure, portability, restriction, and objection under the GDPR, and the right to complain to your supervisory authority.

How to make a request, and appeals

To exercise any of these rights, contact rushliveteam@gmail.com. We will respond within 30 days (45 days for CCPA requests). We may need to verify that a request comes from you before acting on it. If we deny a request, we will tell you why, and you may appeal by replying to our decision; we will answer the appeal in writing within 45 days and tell you how to contact your state attorney general if you disagree with the result.

16 / Third-Party Services

Our App integrates with third-party services including Stripe (payments and identity), Apple and RevenueCat (membership subscriptions), the OverWolf platform the companion runs on, and the game accounts you choose to link (for example Twitch or Supercell). Your use of these services is governed by their respective privacy policies. We are not responsible for their data practices. Links from the App or our website to other sites are provided for convenience, and this Policy does not cover those sites.

17 / International Users

Your data is stored and processed in the United States by us and by the providers named in this Policy. By using the App, you consent to this transfer.

18 / Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email before they take effect, and the "Last updated" date at the top will change. Where a change requires your consent — for example, a new use of biometric data — we will ask for it.

19 / Contact / Data Protection Officer