Privacy Policy
1. Scope
This Policy applies to account sign-in and linking, profiles, community interactions, browsing preferences, account appeals and individually purchased in-depth match reports. When you are redirected to an authentication, SMS, email, payment or other third-party service, that provider processes information under its own privacy policy.
2. Information we process
- Account and sign-in information: We generate a unique user ID for each account and process the email address or Mainland China
+86mobile number. If you choose Google, WeChat, QQ or another third-party account to sign in or link, we receive the account identifier supplied by that platform and necessary authorised information such as your display name, avatar, email address and verification status. Google sign-in and registration are available only in supported regions outside Mainland China; all phone-number functions currently accept only+86numbers. - Authentication and verification information: Passwords are stored in a non-reversible form; we do not store plaintext passwords. During sign-in, password reset or an appeal, we process the verification code's purpose, validity period, attempt count and result. Before an appeal, control of the banned account must be confirmed through its verified email address. When you actively save a Passkey on a supported Apple device, we store only the WebAuthn credential identifier, public key, signature counter and necessary creation and usage status. We do not receive or store biometrics such as Face ID or Touch ID, nor do we hold the device's private key.
- Profile information: Your display name, bio and avatar, plus information needed to process uploads such as file type, dimensions and update time. New profile information is checked for safety first; changes that do not pass will not be made public.
- Preferences and browsing history: Saved matches, followed team or competition topics, news and matches viewed while signed in, reading progress and viewing times are used for cross-device synchronisation. Each account stores up to 500 saved matches, 100 followed news topics, and the 100 most recent news and match history entries. Activity while signed out is not added to account history.
- First-party usage analytics: We process a randomly generated visitor identifier, source, medium, campaign name, external referrer domain, landing path without query parameters, interface language and version, plus events for registration started, registration succeeded, verification failed, following, saving, posting, commenting, sharing and returning on days 1, 7 and 30 after registration. Signed-in events are linked through a salted pseudonymous index. User IDs, email addresses, phone numbers, passwords, verification codes, IP addresses and complete User-Agent values are not written to analytics events.
- Alerts and Web Push: To provide kick-off, goal, result and followed-team news alerts, we store alert preferences, inbox alerts and read status. We store the push endpoint and public encryption keys supplied by your browser only when you actively allow Web Push. This information is used to send alerts to that browser, and the subscription is revoked when you disable Push or delete your account.
- Community, moderation and appeal records: Your posts, comments, match-chat messages, images and likes, and their association with your account. To protect the community, we also retain necessary moderation decisions, violation and ban records, and the reasons, statements and outcomes of appeals you submit.
- Order and payment records: Purchased item, order number, amount, currency, payment method, provider, order status, timestamps and transaction identifier. Payment providers process sensitive details such as card numbers and security codes directly; we do not receive or store full card details.
- Paid-content access records: The purchased content and version, successful delivery and viewing times, access count, and network and browser security information needed to verify access and handle leak disputes. The report page displays the user ID, Singapore time and a tracking code as a visible watermark, and embeds a low-visibility forensic marker (Beta) containing only a pseudonymous tracking code. The watermark does not display an email address or phone number. A leak photo is decoded only in an authorized staff member's browser memory and is not automatically uploaded for decoding; the admin console queries viewing records using only the decoded tracking code. Recognition is supporting evidence for human review and never automatically bans an account.
- Session and security information: Cookies needed to maintain sign-in, plus signals such as IP, browser, network and region, used for sign-in verification, abuse prevention, registration-region assessment and troubleshooting. We do not use browser GPS to determine registration region, and we do not automatically link banned accounts solely because an IP, device, display name or contact detail in public content is the same.
3. Why we process this information
- Create accounts, verify email addresses or phone numbers, complete third-party sign-in and linking, save or remove Passkeys, and provide password reset and access recovery;
- Maintain sign-in status, manage profiles, and synchronise match favourites, followed news topics, reading progress and browsing history;
- Create your followed feed, send the match and team-news alerts you choose, and measure registration conversion, feature use and returns on days 1, 7 and 30 to improve the product;
- Publish and display community content; check for unlawful, fraudulent, harassing, sexual, violent, impersonating, promotional or other prohibited content; and apply restrictions, bans or appeal handling for repeated or serious violations;
- Create and verify orders, deliver purchased content after the payment provider confirms receipt, display anti-leak watermarks, and handle refunds, disputes and duplicate payments;
- Prevent automated registrations, credential stuffing, spam, SMS abuse and other security risks;
- Troubleshoot issues, respond to user requests and fulfil applicable legal obligations.
4. Cookies and sessions
We use necessary Cookies to support normal browsing, maintain sign-in, complete short-term verification and prevent automated abuse. Main-site sign-in lasts no more than 30 days and expires early after 7 consecutive days without authenticated activity. Passkey registration and sign-in challenges are short-lived, single-use random values bound to the current website address. Short-term verification information expires when the process finishes or its time limit is reached, and sessions may also be revoked immediately when you sign out or the account's security status changes. We protect these Cookies with appropriate security settings. Disabling necessary Cookies may prevent sign-in, appeals, community functions or some data pages from working correctly.
5. How service providers participate
To provide the functions above, the following service providers may process relevant information on our behalf, but only when you use the corresponding function:
- Cloudflare: Provides website hosting, security protection, databases, first-party usage analytics, task queues and Web Push task execution, and where necessary processes request IP addresses, browser information, pseudonymous usage events, account information, alert status, community content and uploaded avatars.
- Tencent Cloud: When the relevant functions are enabled, provide Mainland China human verification and SMS code services, potentially processing verification information, the request IP, destination phone number and SMS content.
- Brevo / Resend: Send sign-in or appeal codes, account-action notices and appeal outcomes, receiving the recipient email address and the content required for delivery.
- Twilio Verify: When phone verification is enabled, receive the destination phone number and verification request, and send and verify the SMS code.
- Google Identity Services: Authenticate you when you actively choose Google sign-in, and return a sign-in credential and authorised basic account information to us.
- Apple devices and password managers: When you actively create or use Passkey, the device system completes the local user confirmation and management of the private key; whether to save or synchronize to Apple's "password" and iCloud keychain depends on your device settings and the credentials manager selected by the system.
- Third-party account platforms: When you choose to sign in with or link WeChat, QQ, Apple, Facebook, X, Telegram or Alipay, the provider authenticates you and returns authorised basic profile information. We request only the permissions needed for sign-in or linking.
- Stripe: When an available method is selected, the provider processes card, Apple Pay, Alipay or WeChat Pay payments and returns the order status and required transaction identifiers to us. Availability is shown at checkout and determined by the provider's current response.
- PayPal: When PayPal is enabled and you actively choose it, process PayPal authorisation and payment, and return the order status and necessary transaction identifiers to us.
These providers may process data in different countries or regions under their own privacy policies. We do not sell your personal information or provide account data to third parties for advertising unrelated to operating and protecting towin.
6. Information that may be public
Your display name, avatar and bio, and posts, comments, match-chat messages and like status you actively submit may be publicly displayed in the community. Content that violates the Community Standards or fails a safety check may not be made public or may be removed. Email addresses, phone numbers, passwords and verification codes, third-party account identifiers, moderation and appeal records, session-security information, and order and transaction records are not displayed as public profile information. Do not include identity documents, medical records, home addresses, passwords, verification codes or other unnecessary sensitive information in public content or appeal statements.
7. Retention and security
While an account exists, we retain the information needed to provide account, community, alert and purchased-content access. Saved matches and followed news topics are retained until you remove them or delete the account. News and match browsing histories each retain the 100 most recent entries, which you can delete or clear. First-source and day 1, 7 and 30 return status are retained with the account to prevent duplicate measurement; first-party event details follow Cloudflare Analytics Engine service-retention rules. A Web Push subscription is retained until you disable Push on that device, the provider reports that it has expired, or the account is deleted. Moderation, appeal and security records are retained as needed to handle appeals, prevent abuse and comply with applicable law. Order and paid-content access records are retained as needed for delivery, financial reconciliation, refund disputes and applicable law. Short-lived verification codes and session information expire when no longer needed. Signing in again within three days after requesting account closure cancels the request. Otherwise the account enters an irreversible deletion process. Information eligible for deletion is then deleted or de-identified, except for the minimum records required by law, to handle disputes or prevent abuse.
Repeated or serious breaches of the Community Standards may result in feature restrictions or an account ban. Temporary bans do not expire automatically; users may submit a statement on the account appeal page. An approved appeal restores the account, while a confirmed violation may result in a permanent ban. We may retain the minimum moderation and security records needed to handle appeals and prevent evasion of enforcement.
We use reasonable measures such as access controls, encryption, security verification, rate limiting and anomaly detection to protect information. No internet service is completely secure; if you notice unusual account activity, sign out immediately and email support@towinsports.com.
8. Your choices, unlinking and data deletion
Where permitted by applicable law, you may request access to, correction, deletion or export of information associated with your account, withdraw consent where it can be withdrawn, or close your account. You can edit your avatar, display name and bio in your profile; unfavourite matches at the star; unfollow news topics under Manage Following; and delete individual news and match history entries or clear each history separately on the account history page. The ability to delete public content is determined by the functions currently provided on the website.
You can remove a saved Passkey under Settings — Account and Security after signing in. Removing our record does not delete a copy from your device's password manager; manage that copy in the relevant system settings. You can request deletion of your entire towin account on the same settings page. Submission signs you out immediately; signing in again within three days cancels deletion, but the account cannot be recovered after three days. To unlink one third-party account or delete a verified phone number, email the address below. If unlinking would leave no usable sign-in method, we first require you to add and verify another method. Revoking authorisation at the provider does not automatically delete your towin account.
If you cannot sign in or need to unlink identity information separately, email support@towinsports.com. To prevent impersonation, we may first verify control of the account. For account-sanction appeals, use the Account Appeal page.
9. Minors
Minors who cannot consent independently should use account and community functions only with a guardian's guidance and consent. If a guardian believes a minor submitted information without appropriate consent, email support@towinsports.com.
10. Policy updates
We may update this Policy when functions, service providers or legal requirements change. Material changes will be reasonably signposted on the website; the date at the top of the page is the current version's update date.
11. Contact us
For privacy questions, rights requests, payment or refund reviews, and account deletion requests, email support@towinsports.com.
This page explains our current handling of personal information and is not legal advice. It should be reviewed by an appropriately qualified professional before formal commercial operation or the provision of services in a particular jurisdiction.