Privacy Policy

Last updated: August 2026

1. About This Policy

This Privacy Policy explains how EXM Games ("EXM", "we", "us") collects, uses, stores, and shares information when you use PesaTu ("the Game") and the EXM website. It also describes your choices regarding your information.

2. Information We Collect

When you create an account and use the Game, we may collect the following categories of information:

Account Information

• Username or display name.
• Email address used for account registration and communication.
• Phone number, where provided, for account verification or recovery.
• Country or region, based on information you provide or derived from your connection, for compliance and service availability.
• Authentication credentials processed through Supabase Auth.

Transaction and Payment Information

• Records of token purchases, including amount, timestamp, and payment provider reference.
• Records of token redemptions, including amount, timestamp, and processing status.
• Token balance history and in-game transaction logs.
• EXM does not store full payment card numbers, CVV codes, or bank account details. Payment transactions are processed by third-party payment providers who collect and process payment information independently.

Gameplay Information

• Match history, including entry costs, outcomes, and opponents.
• In-game actions, decisions, and performance data.
• Room creation and participation records.
• Token balance changes resulting from gameplay.

Device and Technical Information

• Device type, operating system, and version.
• App version and build identifier.
• IP address and connection logs.
• Crash reports, error logs, and performance diagnostics.

Notification Data

If the Game uses Firebase Cloud Messaging (FCM) or a similar service for push notifications, a device token or equivalent identifier may be collected and stored to deliver notifications. You can disable notifications through your device settings at any time. Notification tokens do not identify you personally outside the context of delivering Game notifications.

3. How We Use Information

We use the information we collect for the following purposes:

• Account operation: creating, maintaining, and securing your account.
• Authentication: verifying your identity when you sign in.
• Gameplay: processing match entries, determining outcomes, crediting rewards, and maintaining game state.
• Transaction processing: recording purchases, maintaining token balances, and processing redemption requests.
• Fraud prevention: detecting and preventing cheating, payment fraud, collusion, account abuse, and other violations of our Terms.
• Customer support: responding to inquiries, investigating reported issues, and resolving disputes.
• Security: monitoring for unauthorised access, attacks, and system abuse.
• System monitoring and improvement: analysing performance, diagnosing errors, and improving the Game's stability and features.
• Legal compliance: meeting obligations under applicable law, responding to lawful requests from authorities, and enforcing our Terms.
• Communication: sending service-related announcements, security alerts, and account notices. We do not send marketing emails.

4. Payment Providers

Token purchases and redemptions are processed by third-party payment providers integrated into the Game. These providers collect and process payment information according to their own privacy policies and terms. EXM receives transaction confirmation, amount, and a payment reference — not your full payment instrument details.

We encourage you to review the privacy policies of the payment providers available in the Game. Payment providers operate independently, and EXM is not responsible for their data handling practices.

5. Data Sharing

We do not sell personal information. We share information only in the following circumstances:

• Service providers: with Supabase (database, authentication, and storage infrastructure) for operating the Game's backend.
• Payment providers: to facilitate token purchase and redemption transactions.
• Legal obligations: with law enforcement, regulators, or other government bodies when required by applicable law, court order, or legal process.
• Safety and enforcement: when necessary to investigate, prevent, or take action regarding suspected fraud, illegal activity, violations of our Terms, or threats to the safety of users or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, where user information may be among the transferred assets.

6. Data Retention

We retain information for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Specifically:

• Account information: retained while your account is active. Upon account closure, personal account data is deleted or anonymised within a reasonable period, except as required for legal, fraud prevention, or security purposes.
• Transaction records: retained for the period required by applicable financial, tax, and anti-money laundering regulations, which may extend beyond account closure.
• Gameplay records: retained for fraud detection, dispute resolution, and service improvement. May be retained after account closure in aggregated or anonymised form.
• Technical logs and diagnostics: retained for a limited period for security monitoring and performance analysis.

7. Security

We implement reasonable technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls, and infrastructure security provided by our service providers. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the security of your account credentials. Do not share your password with others. Notify us immediately if you suspect unauthorised access to your account.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information.
• Restrict or object to certain processing activities.
• Request a copy of your information in a portable format.
• Close your account.

To exercise these rights, contact us through the official EXM Games website. We may need to verify your identity before processing your request. Certain information may be retained where required by law or for legitimate business purposes as described in this Policy.

9. Third-Party Services

The Game relies on the following categories of third-party services:

• Supabase: provides database hosting, user authentication, and file storage infrastructure. Supabase processes data in accordance with its own privacy and security practices.
• Cloudflare R2: provides file storage for game client downloads. Download requests transmit your IP address and device information to Cloudflare's edge network.
• Payment providers: process token purchases and redemptions.
• Notification services: if enabled, deliver push notifications to your device.

The Game or website may contain links to external sites. We are not responsible for the privacy practices of those sites.

10. Cookies and Tracking

Our website may use essential, session-only cookies required for security and basic functionality. We do not use tracking cookies, advertising cookies, analytics cookies, or similar technologies for profiling or marketing purposes. We do not integrate third-party analytics scripts or advertising pixels.

11. International Transfers

Your information may be transferred to and processed in countries other than your country of residence, where our service providers operate. We take steps to ensure that such transfers are subject to appropriate safeguards. By using the Game, you consent to the transfer of your information as described in this Policy.

12. Children's Privacy

The Game is not intended for individuals under the age of 18, or the legal age of majority in their jurisdiction. We do not knowingly collect information from minors. If we learn that we have collected information from a minor without appropriate consent, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated through the Game client or website where reasonably possible. Continued use of the Game after changes take effect constitutes acceptance of the updated Policy.

14. Contact

For privacy-related inquiries, data access requests, or to report a concern, contact EXM Games through the official website.