Privacy Policy

1. Who we are

Real Victors (“Real Victors”, “we”, “us”, “our”) is a mobile application operated from Ottawa, Ontario, Canada. This Privacy Policy explains what information we collect when you use the Real Victors mobile app and the realvictors.com website (together, the “Service”), how we use it, who we share it with, and the rights you have over it.

For privacy questions or requests, email hello@realvictors.com.

2. Information you give us

When you create an account or use the Service, we collect information you provide directly:

• Account basics: first name, last name, username, email address, password (stored hashed; we never see your plaintext password), and date of birth (collected during account setup and used to confirm you meet our 18+ age requirement). At sign-up you must also confirm via a checkbox that you are 18 or older.
• Profile details: profile photo, height, preferred basketball position, jersey number, bio, sport-specific skill ratings, social handles (Instagram, X, TikTok, YouTube, etc.) if you choose to add them.
• Activity content: games you create, join, RSVP to, or host; teams you create or belong to; ratings and reviews you give other players; photos you upload; messages you send through in-app chat.
• Payment details (when applicable): if you pay a fee for a paid game, your card details are entered directly into our payment processor, Stripe, and Real Victors does not see, store, or have access to your full card number, CVC, or expiry. We receive only Stripe's transaction metadata (last 4 digits, card brand, charge ID, amount, status) so we can show your purchase history and process refunds. If you host paid games, we collect additional information that Stripe requires to pay you out (legal name, address, date of birth, government-issued ID information, and bank account details). That information is provided directly to Stripe through their hosted onboarding flow; we hold only Stripe's confirmation that you are verified to receive payouts.
• Communications: emails or messages you send to hello@realvictors.com or through in-app support.
• Payment and payout information (paid games only): when you pay to join a paid pickup or exhibition, your card details are entered directly into a payment sheet operated by our payment processor (Stripe) and are never seen or stored by Real Victors. We receive a payment reference, the amount, the currency, and the success/failure status — enough to fulfil your RSVP and reconcile refunds. When you set up your account to receive host payouts, you complete a Stripe Connect Express onboarding flow where Stripe (not Real Victors) collects your legal name, date of birth, address, bank account details, and any government identification Stripe needs to verify you under Canadian financial regulations. Real Victors receives only a Stripe account identifier and the verification status. See Section 17 below for the full picture.

3. Information we collect automatically

• Location data: only when you grant the permission, and only used to surface nearby pickup games, suggest venues, and confirm attendance when you opt in. You can revoke location access at any time in your device settings.
• Device and technical data: device model, operating system version, app version, language, time zone, IP address, and crash diagnostics.
• Usage analytics: screens visited, features used, taps and navigation events. We use this to understand which parts of the app are working and to fix problems. We do not link analytics to advertising identifiers and we do not use the IDFA.
• Session activity recordings: a sampled portion of in-app navigation may be recorded by PostHog's mobile session replay so we can investigate UX issues, reproduce crash flows, and understand confusing screens. Recordings have safe-default masking: password fields and direct message message bodies are always masked at the SDK level, and any third-party native view that handles sensitive content (for example Stripe's payment sheet and the image picker) is automatically masked. Recordings expire on PostHog's retention schedule and are never used for advertising.
• Crash diagnostics and error reports: when the app crashes or hits an unhandled error, Sentry captures a stack trace, device model, operating system version, app version, and the last ~100 in-app breadcrumbs that preceded the error. Email addresses, user names, and similar identifiers are stripped from these reports before they leave your device.
• Image moderation scans: before any image you upload (profile photo, team logo, team photo, game cover) is stored on the Service, the image bytes are sent in-flight to Google Cloud Vision's SafeSearch service for a content-safety check. If the image is flagged as unsafe, the upload is rejected and the image is preserved in a private, admin-only review bucket to satisfy our content-moderation duties under the App Store guidelines and Canadian law. Safe images are not retained by the moderation provider.
• Push notification token: a device-level identifier that lets us send you reminders and alerts you have subscribed to. You can disable push notifications in your device settings.

4. Information from third parties

If you sign in with Apple or Google, we receive a verified email address and a stable user identifier from that provider. We do not receive your password from them, and we don't post anything on your behalf. The data those providers share with us is governed by their own policies.

When you transact through the Service, Stripe shares with us the metadata described in §2 above so we can show your transaction history, calculate host payouts, and process refunds.

5. How we use your information

• To run and improve the Service, including match-making, RSVPs, results, and reviews.
• To create and maintain your account, including authentication and age verification.
• To send transactional notifications you have opted into (game reminders, RSVPs, results, team invites, messages, payment receipts, payout notices).
• To process payments and payouts through Stripe, calculate and remit platform fees, issue refunds, and reconcile transactions.
• To compute and display your attendance history and aggregate stats you choose to share.
• To process payments for paid games and route host payouts. Real Victors uses Stripe Connect Express to collect player payments, hold them briefly on the platform balance during a 24-hour refund-protection window, and then transfer the host's share (entry fee less our platform commission) to the host's connected Stripe account. We use payment and payout metadata to issue refunds, generate earnings statements for hosts, and respond to disputes or chargebacks.
• To respond to your support requests and legal obligations (subpoenas, court orders, regulatory requests, tax-record retention).

We do not use your data to train third-party AI models, and we do not sell or rent your personal information.

6. Service providers we share data with

We share limited information with the providers who help us run the Service, under contracts that restrict how they can use it:

• Supabase for database, authentication, and file storage. Hosts your account, profile, games, messages, and uploads.
• Stripe, Inc. (and Stripe Payments Canada, Ltd.) for payment processing, host payouts, and Connect platform partnership. Stripe collects card details directly when you pay for a paid game (Real Victors never sees the full card number, CVV, or expiry). For users who set up host payouts, Stripe also collects the personal and financial information required for identity verification and money movement under Canadian financial regulations. Stripe is regulated as a money services business in Canada. Stripe's privacy notice: stripe.com/privacy.
• Expo for mobile build infrastructure and push notification delivery.
• PostHog for product analytics and sampled mobile session replay. Receives usage events, error reports, and short recordings of in-app navigation (with safe-default masking — see §3) so we can understand which features are used, which break, and where users get stuck. Personal identifiers in event properties are filtered before they leave the device. PostHog is contractually a data processor acting on our behalf.
• Sentry for crash reporting and error tracking. Receives stack traces, device metadata, OS version, and breadcrumbs when the app crashes or throws an unhandled error, so we can diagnose and fix it. Personal identifiers are scrubbed from reports before they leave the device.
• Google Cloud Vision (SafeSearch) for automated image moderation. Receives the bytes of any image you attempt to upload, in flight, to determine whether the image contains adult, violent, or otherwise unsafe content. Google does not retain or train on these requests under the standard Cloud Vision usage terms. We use this to meet our content-moderation obligations under the App Store guidelines and applicable law.
• Discord for internal admin notification of moderation events. When an image upload is flagged by Google Vision, a summary of the decision (user identifier, image upload type, flagged categories, and a 24-hour signed link to the rejected image) is posted to a private, admin-only Discord channel so that we can verify the decision and respond if a real-world safety issue is detected. Discord is used solely as a notification channel by our staff and receives no other user data.
• Apple and Google, only if you choose Sign in with Apple or Sign in with Google. Used solely to verify your identity at sign-in.

We may add or change providers as the Service evolves. Material changes will be reflected on this page.

7. Payments and Stripe

Real Victors uses Stripe Connect to process payments for paid games. When you pay a fee for a paid game, the funds are charged by Stripe, Real Victors retains a platform fee, and the remainder is paid out to the host through Stripe. Real Victors does not store your full card details at any point; the card information is entered into a Stripe-controlled form and tokenized before it reaches our servers.

If you choose to host paid games, you become a connected account on Stripe. Stripe will collect the identity and bank information they require to verify you and pay you out, including legal name, date of birth, address, and bank account details. That information is provided directly to Stripe. Real Victors stores only the Stripe-issued connected account ID and confirmation of your verification status.

For tax purposes, we and Stripe may be required to report your earnings to the Canada Revenue Agency or other tax authorities once thresholds are met. We will give you advance notice and the necessary documents before any reporting takes place.

8. Public vs. private information

By default, parts of your profile (name, username, photo, position, jersey number, public game activity, ratings) are visible to other Real Victors users. You can switch your profile to private in Settings → Privacy Settings, which hides your activity from non-friends. Your email address, phone number, password, payment details, and identity-verification information are never shown to other users.

9. How long we keep your data

We keep your information for as long as your account is active. When you delete your account, we remove your personal information within 30 days, except for:

• Records we're legally required to retain. Canadian tax law (CRA) requires us to keep transaction-level financial records for at least six years after the end of the tax year they relate to — so payment, refund, and host-payout records for paid games persist for up to seven years even after account deletion. These records are kept in pseudonymised form where possible (linked to internal IDs, not to identifying profile fields).
• Records Stripe retains under its own legal obligations as a money services business — Real Victors cannot delete information from Stripe's systems on your behalf, but you can submit a request directly to Stripe via Stripe Support.

Backups containing personal data are overwritten on a rolling basis and fully purged within a reasonable period.

10. Your rights

You have the right to access, correct, export, or delete the personal information we hold about you. The fastest way to exercise these rights:

• Access and correction: edit your profile directly inside the app from Settings → Edit Profile Info.
• Deletion: Settings → Delete Account, or email hello@realvictors.com. Note that records we are legally required to keep (notably payment transaction records, see §9) cannot be deleted on request.
• Export: email hello@realvictors.com with the subject “Data export request” and we will send you a copy of the personal data we hold about you within 30 days.
• Object or restrict: if you are in a region with additional rights (EU/UK/Canada/California), you can object to certain processing or ask us to restrict it. Email us with the subject “Privacy request” and we will respond within 30 days.

11. GDPR (Europe and UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract: to provide the Service you signed up for, including processing payments and payouts.
• Legitimate interest: to keep the Service running, prevent abuse, and improve features. We weigh these against your privacy rights.
• Consent: for location access, push notifications, and optional analytics. You can withdraw consent at any time.
• Legal obligation: when we are required to keep or disclose data by law, including tax and anti-money-laundering rules.

You have the right to lodge a complaint with your local data protection authority. Data we process is transferred to and stored in Canada and the United States, under standard contractual clauses where applicable.

12. CCPA / CPRA (California)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccuracies, and to opt out of the “sale” or “sharing” of personal information. Real Victors does not sell or share personal information for cross-context behavioral advertising. To exercise your California rights, email hello@realvictors.com.

13. Canadian residents

We comply with Canadian privacy law including the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (commonly known as Law 25), and the Canadian Anti-Spam Legislation (CASL). You may contact our Privacy Officer at hello@realvictors.com with any concerns. If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial commissioner (for Quebec, the Commission d'accès à l'information).

Under CASL, we send transactional and account-related emails (sign-up confirmations, password resets, payment receipts, game notifications) based on the express or implied consent created by your use of the Service. Any optional marketing emails will have a clear unsubscribe link and you can opt-out at any time without losing access to the Service.

14. Adults-only Service and age requirement

Real Victors is intended only for adults 18 years of age and older. The Service is not directed at, designed for, or marketed to minors. If you are under 18, please do not download, install, register for, or use the Real Victors mobile app or the realvictors.com website.

We enforce this requirement in two steps. First, at sign-up you must confirm via a checkbox that you are 18 or older. Second, during account setup we collect your date of birth and verify it against the 18+ threshold. If the date of birth you provide indicates you are under 18, the account is closed and the associated personal information is deleted. We do not knowingly maintain accounts for or collect personal information from anyone under 18. If you believe a person under 18 has created an account, contact us at hello@realvictors.com and we will act on it promptly.

Because the Service is not directed at minors, we do not currently provide parental-consent flows or child-specific protections beyond the absolute age gate. We may revisit this in the future, but for the avoidance of doubt: minors are not permitted users of Real Victors today.

15. Security

We use industry-standard safeguards including encrypted connections (HTTPS / TLS 1.2+), encryption at rest for sensitive data, hashed passwords, role-based access controls, and row-level security on user data. Card details are handled exclusively by Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS) at the highest level. No system is perfectly secure; if we ever discover a breach affecting you, we will notify you and the appropriate authorities as required by law.

16. Cookies and tracking

The Real Victors mobile app does not use web cookies. The realvictors.com website uses only essential cookies needed to make the site function (for example, to remember your session). We do not currently use advertising cookies or third-party tracking pixels on the marketing site.

17. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be communicated through an in-app notice or email at least 14 days before they take effect, where practical. The “Last updated” date at the top tells you when this version became effective.

17. Payments and host payouts (paid games)

Real Victors offers an optional paid-games feature. Hosts can charge an entry fee for pickup games or a per-team fee for exhibition matches. We act as the marketplace of record using Stripe Connect Express as our underlying payment and money-movement infrastructure. This section explains what information moves where, in plain language.

17a. What Real Victors receives vs. what Stripe handles

When you pay for a paid game, the card-entry sheet is rendered by Stripe's SDK and sends card details directly to Stripe. Real Victors never sees and never stores your full card number, CVV, or expiry. We do receive and store, on each successful payment:

• A Stripe payment identifier (used to look up the charge if there's a dispute or refund).
• The amount charged, the currency, and the breakdown between entry fee, our platform service fee, payment-processing fee, applicable taxes, and any host commission deducted at payout time.
• The game you paid for and which team (for exhibitions).
• The status of the payment (pending, succeeded, failed, refunded) and any error messages Stripe returned.

We do not store full bank account numbers, government-issued ID, or the contents of any KYC documents you submit to Stripe. Those live on Stripe's systems under Stripe's own privacy notice and security controls.

17b. What hosts share with Stripe to receive payouts

To accept paid games, hosts complete a Stripe Connect Express onboarding flow embedded in the Real Victors app. In that flow, Stripe (not Real Victors) collects:

• Your legal first and last name, date of birth, and home address.
• Your Canadian bank account details (transit, institution, account number) so Stripe can deposit payouts.
• A Social Insurance Number (SIN), and government-issued photo ID and a selfie if Stripe's automated checks ask for them. Stripe uses these to verify your identity under Canadian anti-money-laundering and tax-reporting rules.

We receive only the resulting Stripe Connect account identifier and the verification flags (e.g. “charges enabled”, “payouts enabled”). We do not see your SIN, your photo ID, your bank number, or the contents of your verification documents.

17c. How money moves

Real Victors uses a “held on platform” payment model. When you pay for a paid game, the full amount lands on the Real Victors platform balance first. We hold it for approximately 24 hours after the game starts to give us a clean window to process refunds for cancellations. After that hold, we transfer the host's share — the entry fee minus our platform commission — to the host's connected Stripe account. Stripe then runs its own settlement cycle (typically 2–7 business days for new accounts) before depositing the host's share to the host's bank account.

17d. Refunds, chargebacks, and disputes

When a paid game is cancelled — by the host, or by the platform — Real Victors issues automatic refunds back to the cards players paid with through Stripe. Refunds typically take 5–10 business days to appear on a card statement depending on the issuing bank. If you dispute a charge directly with your card issuer (a “chargeback”), Stripe notifies us and we may contact you and the host to gather evidence. Resolving chargebacks may involve sharing limited transaction history with Stripe and, if required, your card issuer or card network.

17e. Tax reporting

Hosts who earn income through Real Victors are responsible for reporting that income on their own Canadian tax returns. Where Canadian tax law requires us to issue an information return (for example, a T4A for sufficiently high host earnings), we will share the legal name, address, and earnings totals associated with that host's payout account with the Canada Revenue Agency. We will tell you in advance the year we begin issuing tax slips, and where to find your own.

17f. Promo codes and discounts

If you redeem a promo code at checkout, we record the code, the discount applied, and the resulting charge breakdown so we can reconcile promotions fairly. Promo redemption data is treated like the rest of your payment history for retention purposes (see Section 8).

17g. Your rights regarding payment data

You have the same access, correction, export, and deletion rights for payment data that you have for the rest of your account information (see Section 9), subject to the legal-retention obligations in Section 8. Records we are required to keep for CRA compliance, or that Stripe is required to keep as a money services business, cannot be deleted on request — but we will pseudonymise them where possible so they cannot be linked back to a deleted profile.

18. Contact

Privacy questions, data requests, or complaints: hello@realvictors.com.