Privacy Policy
Version 2026-11-06 · Last updated 6 November 2026
This policy is a working draft and is being reviewed by our lawyers. Items highlighted like this are still to be confirmed.
[Company legal name] ("Rake", "we") is the data controller for the personal data described here. We follow the Nigeria Data Protection Act 2023 (NDPA). You can reach our data protection contact at [privacy email].
What we collect
| Data | Why we use it | Legal basis |
|---|---|---|
| Username and password (stored only as a salted scrypt hash, never in plain text) | To create and secure your account | Contract |
| Your confirmation that you are 18 or older, and when you accepted these terms | To keep under-18s off Rake and record your agreement | Legal obligation, contract |
| Match records: moves, dice rolls, cards dealt, timings, results and the audit log | To run games fairly, settle results and resolve disputes | Contract, legitimate interests |
| Wallet records: deposits, entries, winnings, fees and withdrawals | To manage your balance and meet financial record-keeping duties | Contract, legal obligation |
| Bank details you give us for withdrawals | To pay you | Contract |
| Deposit limits and breaks you set, and when you changed them | To apply your choices and protect players | Legal obligation, legitimate interests |
| Technical data such as IP address and browser details | To keep Rake secure, prevent abuse and limit repeated sign-in attempts | Legitimate interests |
| Identity documents, if we need to verify you | To confirm age and identity and prevent fraud | Legal obligation |
We don't collect your email address or date of birth at sign-up. We don't sell your personal data or use it for advertising profiles.
Cookies and browser storage
We use one essential cookie to keep you signed in (it lasts 30 days and can't be read by scripts). We store only a scrambled copy of its value on our servers. Your browser also keeps small items in local storage so you can return to a match after refreshing, and to remember your light or dark theme. We don't use advertising or tracking cookies.
Who we share data with
We use these service providers to run Rake. They process data only on our instructions:
- Render (United States): hosts our game server and database.
- Vercel and Netlify: deliver the app and our website to your browser.
- Cloudflare (R2 storage): stores backup copies of our database.
- Payment providers and banks: to process deposits and withdrawals.
The football data provider we use for fixtures receives no personal data about you. We may also share data with regulators, law enforcement or courts where the law requires it, and with professional advisers under confidentiality.
Data stored outside Nigeria
Our servers and backups are located outside Nigeria, including in the United States. Where we transfer data abroad, we rely on the safeguards permitted by the NDPA, such as contractual protections with our providers. [Confirm transfer mechanism with counsel.]
How long we keep it
- Account details: while your account is open, then [period].
- Match, audit and wallet records: [period, e.g. as required for financial and gaming records], because they are needed to settle disputes and meet legal duties.
- Records of deposit limits and breaks: [period], so a break you chose can still be honoured.
- Backups are kept for up to about a week before being replaced.
How we protect it
Passwords and session tokens are stored only as one-way hashes. Connections use HTTPS. Game and wallet records are append-only and checked for tampering. Access to our systems is restricted to people who need it.
Your rights
Under the NDPA you can ask to:
- see a copy of the personal data we hold about you;
- correct data that is wrong;
- delete data we no longer need (some records must be kept by law, for example wallet and gaming records);
- restrict or object to how we use your data, or withdraw consent where we rely on it;
- receive your data in a portable format.
Email [privacy email] from the account concerned, and we'll respond within 30 days. If you're unhappy with our response, you can complain to the Nigeria Data Protection Commission (NDPC).
Children
Rake is only for people aged 18 and over. If we learn that someone under 18 has an account, we close it and delete their data except what we must keep by law.
Changes
If we change this policy in an important way, we'll tell you in the app before the change applies.