Privacy Policy

1. Who is responsible

Ludo Cash Arena is operated by Eira Digital Co. Limited, the data controller for your personal data. We follow Uganda's Data Protection and Privacy Act, 2019 and its regulations. Registration and regulatory details are available on request from [email protected].

2. What we collect

• Account details - phone number, email, first and last name, username, your confirmation that you are 18 or older, gender, nationality, district or region, national ID number (NIN) where asked at sign-up, and your password (stored only as a one-way hash).
• Profile and social - display name, avatar or profile photo, level, badges, friends, blocks, groups and your settings.
• Gameplay - matches, dice rolls (with the fairness seeds), moves, timings, results, tournaments, token balances, rewards and missions.
• Chat and images - messages in matches, direct chats and groups, posts, and images you upload. Match chat in real-money games is kept, even if deleted, so we can review collusion and disputes.
• Money (when you use cash play) - deposits, withdrawals, gifts, stakes, prizes, fees, transaction references and the mobile-money numbers you save. We never collect or store your mobile-money PIN or full card numbers.
• Identity checks (KYC) - ID type, ID number, a photo of your ID and a selfie, only when needed for larger withdrawals or gifts (see AML and KYC).
• Responsible gaming - limits, reminders, time-outs and self-exclusions you set.
• Device and network - IP address, device and browser details, a device identifier, sign-in times and push subscription, used for security, fraud prevention and notifications.
• Support - reports, support chats and emails, and our replies.
• Nearby players location (optional) - see section 3.

We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we close the account and delete their data.

3. Nearby players and location

• Location is off by default. We only use it if you turn on nearby players and your device asks for your permission.
• Other players only see a distance band (for example "under 5 km"), never your exact position, address or coordinates.
• We store only the approximate location needed to work out those bands, and use it for nothing else (no ads, no tracking, no selling).
• You can turn it off and delete your saved location at any time in Settings; it is then removed from our systems.

4. Images

Images you upload (chat, groups, profile photo) are re-encoded and their hidden metadata, including any GPS location in the photo, is removed. Chat and group images are served from private, unguessable links to the people in that chat or group. Reported images are reviewed and may be removed. Uploads that are never attached to a message or post are deleted after 24 hours. ID and selfie images for KYC and payout proof images are never public; only authorised staff can open them and every view is logged.

5. Why we use it

• to provide the game: accounts, matchmaking (including the optional gender preference, which is never shown to other players), chat, groups, leaderboards and history;
• to keep games fair: detecting cheating, collusion, multi-accounting and automated play, and auditing disputed matches;
• to keep accounts and money secure and prevent fraud;
• to process deposits, withdrawals and gifts, and to check identity where the law or our AML policy requires;
• to apply the responsible gaming tools you choose;
• to send you service messages and, if you allow, notifications (see section 6);
• to answer your reports and support requests;
• to meet legal, regulatory, tax and anti-money-laundering obligations;
• to improve the Service using aggregated statistics.

We rely on your consent (for example location and marketing), on performing our agreement with you, on our legal obligations and on our legitimate interest in running a safe, fair game.

6. SMS, email and push messages

• Always sent: sign-in and verification codes, security alerts (such as a new-device sign-in) and essential account or payment messages.
• Your choice: SMS, email and push messages about deposits, withdrawals, gifts, wins, tournaments, support replies, rewards, play alerts and promotions. Each category has its own switch in Settings > Notifications. Marketing is off unless you turn it on, and you can turn it off again at any time.
• No messages about play or promotions are sent while you are on a time-out or self-excluded.

7. Who we share it with

• Messaging providers - your phone number and email, to deliver codes and notifications (eSMS Africa for SMS and email, and the push service of your browser or device).
• Payment providers - Pesapal, Flutterwave and Yo! Payments, card networks and the mobile-money networks (MTN, Airtel), only for deposits and withdrawals.
• Hosting and infrastructure providers that store and run the Service for us under confidentiality obligations.
• Regulators, law enforcement, the Financial Intelligence Authority or courts where the law requires it.
• Other players see your display name, username, avatar, level, badges, game results, your messages and posts, and (only if you turned it on) a distance band. People who already know your verified phone number or email can find your profile by it; your number and email are never shown.

We do not sell your personal data.

8. Where it is stored

Your data is stored on secured servers operated for us by hosting providers, and some providers (for example payment and messaging services) may process data outside Uganda. Where that happens we use contracts and safeguards that meet the Data Protection and Privacy Act. Details of the locations are available on request from [email protected].

9. How long we keep it

• Account and profile data: while your account is open, then deleted or anonymised within 90 days of closure, unless the law requires us to keep it.
• Gameplay, match chat and audit logs: up to 24 months, to resolve disputes and investigate cheating.
• Payment, KYC and anti-money-laundering records: as long as tax, financial and AML laws require (typically up to 10 years after the transaction).
• Security logs (IP and device): up to 12 months.
• Nearby players location: until you turn the feature off or delete it.
• Self-exclusion records: for the exclusion period and long enough afterwards to honour it.

10. How we protect it

Encrypted connections (HTTPS), secure session cookies, hashed passwords, encryption at rest for ID numbers and KYC data, strict staff permissions with two-factor sign-in, logging of every administrator action that touches personal data, and regular backups. We never log your login codes.

11. Your rights

Under Uganda's Data Protection and Privacy Act, 2019, you can:

• ask what personal data we hold about you and get a copy;
• ask us to correct inaccurate data;
• ask us to delete your data or stop processing it, where the law allows (we must keep payment and AML records for the legal period);
• object to processing based on our legitimate interests, including direct marketing;
• withdraw consent at any time (for example turn off location or marketing), without affecting earlier processing;
• complain to the Personal Data Protection Office (PDPO) at the National Information Technology Authority - Uganda (NITA-U).

To use these rights, email [email protected] or use Support (category "Account"). We may need to confirm your identity first and reply within 30 days.

12. Cookies

We use a few essential cookies to keep you signed in and protect against cross-site attacks, and local storage for settings. Only if you agree in the cookie banner, we also use Google Analytics (usage statistics) and Google AdSense (ads on free guide pages), which means Google receives technical data such as your IP address and device type. See our Cookie Notice.

13. Changes

We update the date at the top of this page when this policy changes and tell you in the app about important changes.

14. Contact

Privacy questions and data requests: [email protected]. Anything else: [email protected] or Support in the app. See also our Terms of Service.