Privacy Policy

1. Who we are and what this covers

WagOne is a social football prediction platform at wagone.200boxes.com, currently operated by its founder as an individual. For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA"), we are the data controller for the personal data described here.

This Policy covers the WagOne web application and the services behind it. It does not cover any third-party website you reach by following a link from WagOne. Contact details are in section 11.

2. What we collect, and why

• Email address and password. Used to create your account, sign you in, confirm your address on registration and send a reset link if you request one. Email and password are the only sign-in method. Your password is stored only as a cryptographic hash and is never visible to us. Separately, for abuse control, we keep a record of how many sign-up attempts an address has made recently — in that record the address is stored only as a salted SHA-256 hash, never in readable form.
• Profile information you add. Your display name, your WagOne tag and a profile photo if you upload one. These are visible to other players wherever you appear — league rosters, squad member lists, Quick Game opponents and leaderboards.
• Gameplay activity. The games you create and join, your squad memberships and invitations, the predictions you submit, and your Sandbox Token balance and full transaction history. This is the product itself — without it there is no game to play.
• Network data for fraud and abuse prevention. When a Quick Game is accepted we record a salted hash of each player's IP address so we can detect one person secretly playing both sides. We store the hash, not the address, and it is used only for that check — never for tracking, profiling or advertising. Separately, our sign-up form runs a Cloudflare Turnstile challenge to block automated account creation; see section 5.
• Notification preferences. Which categories of in-app notification you have turned on or off.
• Server error reports. When something fails on our servers we record technical details of the failure — what broke, in which operation — so we can fix it. These reports can include the account identifier associated with the failed request. We no longer run any error-reporting tool in your browser.

We do not collect special-category data, we do not knowingly collect data from anyone under 18, and we do not use your data to make any decision about you by automated means that produces a legal or similarly significant effect.

3. Our lawful basis for using it

Under the NDPA we rely on the following bases:

• Performance of a contract — for everything needed to provide the Service to you: your account, your gameplay activity, your Token balance and the settlement of games.
• Legitimate interests — for keeping the Service secure, available and fair: abuse and bot prevention, self-play detection, rate limiting and diagnosing errors. We use hashed rather than readable identifiers for these wherever the check allows it.
• Consent — for anything optional that you actively choose, such as uploading a profile photo. You can withdraw consent at any time by removing the item or contacting us.
• Legal obligation — where we are required to retain or disclose information by law.

4. Cookies and browser storage

WagOne does not use advertising or analytics cookies, and there is nothing here to opt into. What we do use:

• Authentication cookies (strictly necessary). Set by our authentication provider to keep you signed in between pages and to refresh your session. Clearing them signs you out.
• Local storage (strictly necessary). We store your light or dark theme choice in your browser's local storage so the page renders correctly on your next visit. It stays on your device and is never sent to us.
• Turnstile (strictly necessary, sign-up page only). Cloudflare may set a token or cookie as part of the bot check described in section 5.

5. Who processes it on our behalf

We do not sell your personal data and we do not share it for anyone else's marketing. A small number of service providers process it strictly to run the Service, under contract and on our instructions:

• Supabase — our database, authentication and file storage. Holds essentially all of the data in section 2.
• Vercel — hosts and serves the application. As part of serving a request it processes connection data, including your IP address, in its server logs.
• Cloudflare — provides the Turnstile bot check on our sign-up form. The check runs in your browser and your IP address is sent to Cloudflare so it can verify the result. It tells us only whether a challenge passed.
• Resend — delivers our account emails (confirmation and password reset), and therefore processes your email address and the content of those messages.
• Sentry — receives the server-side error reports described in section 2. It is not loaded in your browser.
• football-data.org — supplies real fixtures and results. Data flows only inwards: nothing about you or your account is ever sent to them.

We may also disclose information where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim.

6. Where your data is processed

Our providers operate internationally, and our database and application are hosted in the European Union (Ireland). Your personal data is therefore transferred outside Nigeria.

We rely on providers that offer contractual data-protection terms consistent with the NDPA and, where applicable, the European General Data Protection Regulation, and we only transfer what is necessary to run the Service.

7. How long we keep it

Account data — your profile, preferences and gameplay history — is kept for as long as your account is open, and deleted or anonymised within a reasonable period after it is closed, except as set out below.

The Token transaction record is permanent and cannot be edited or deleted. That is deliberate: every player's balance is the running total of that record, so it is what makes balances verifiable and the game trustworthy. Corrections are made by adding an offsetting entry, never by altering or removing one. Closing your account does not remove its entries, though we will detach the identifying profile information associated with them. See section 8 for what this means for a deletion request.

Abuse-prevention records (hashed email addresses and hashed IP addresses) are kept only as long as needed for the check they support.

8. Your rights

Under the NDPA you have the right to:

• be informed about how your data is used — this Policy;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, subject to the limit described in section 7;
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where we relied on consent;
• lodge a complaint with the Nigeria Data Protection Commission.

You can change your display name, profile photo and notification preferences yourself at any time in Settings. For anything else — a copy of your data, a correction, a deletion request or account closure — email us at the address in section 11 and we will handle it directly. There is no automated self-service deletion tool yet. We may need to verify your identity before acting on a request, and we aim to respond within 30 days.

We would rather resolve a concern with you directly, so please contact us first — but you can complain to the Nigeria Data Protection Commission at any time regardless.

9. How we protect it

Access to your data is enforced at the database level: rules on every table restrict each account to the records it is entitled to see, rather than relying on the application alone to check. Passwords are only ever stored hashed. Email and IP addresses used for abuse checks are hashed with a secret value before storage. Privileged operations run through audited server-side functions rather than directly from your browser, and administrative actions are logged.

No service can promise perfect security. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

10. Children

WagOne is not intended for and must not be used by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes and contact

We may update this Policy as the Service develops or as the law requires. The date at the top of this page shows when it was last revised, and we will give reasonable notice through the Service of any material change.

For any question about this Policy, or to exercise any of the rights in section 8, email bzzroptions@gmail.com.