CashBrawl Privacy Notice
Draft of 13 October 2026, translated from the Italian draft for review. Not ready for publication until the controller, contacts, legal bases, retention periods and transfers have been approved.
1. Who processes the data and how to contact them
This notice covers the CashBrawl website, Telegram bot, organised matches and related support.
Data controller: legal identity, registered address and country to be confirmed before publication. Privacy contact: address and channel for exercising rights to be confirmed. The support contact in the previous Terms is cashbrawltg@gmail.com; using it as the privacy contact requires confirmation.
2. Account and sign-in data
For your account we use an internal identifier, CashBrawl name, language and information needed to manage sign-in, your profile, referrals and any account restrictions.
If you use the bot, Telegram provides your numeric identifier, public name and username where available. Telegram accounts continue to use the bot; the future Mini App is a Telegram entry point. The website will use email or Google: a Telegram account is not automatically linked to an account created on the website.
If you choose Google, we receive your Google account identifier and the profile data permitted for sign-in, including name and email. The Google identifier recognises the account; the name may be used as the sign-in name. Receiving an email address from Google does not automatically link another account with that address. The service does not request access to your mail, Drive files or calendar.
If you choose email, we process your address, the password supplied to the service, verification code and registration or recovery request information. The database stores the password as a hash and the verification code as a digest, rather than readable values. Operational emails verify your address, recover access or communicate receipts provided by the service.
3. Brawl Stars profile and images
To link a Brawl Stars profile we use the tag, in-game name and trophies returned by the Supercell API. To verify matches we consult the battle log, which may include information about other participants and players encountered. A tag already linked to another account cannot be linked to the new account.
You may supply a profile image so that the tag can be read automatically. Depending on the configured reader, the image may be sent to Google Cloud Vision or Claude, an Anthropic service. The extracted tag is then checked against the game profile and submitted for the player's confirmation. The active reader and its conditions of use must be confirmed for production before publication.
Images sent through Telegram may remain accessible through Telegram's file reference. Evidence uploaded to the website and support images may be stored in the service database. Avoid including third-party data or information unrelated to the requested check.
4. Matches, balances, deposits and withdrawals
We retain match entries and results, stakes, prizes, refunds, bonuses, wagering requirements, fees and account transactions. Referrals and the related share of fees are associated with the accounts involved.
For cryptocurrency deposits we process currency, network, deposit address, requested and received amounts, transaction identifier and request status. The linked checkout handles the payment request; CashBrawl records its link to the account.
For withdrawals we process the amount, fee, net payment, selected method, destination details and staff decisions. Required data depends on the method: crypto address and network, PayPal email, or account holder, IBAN and address for bank transfers when those methods are available.
A manual identity document check may be requested when needed for a withdrawal. No external KYC provider or document collection at registration is planned. Before publication, the submission channel, authorised viewers, storage location and retention period must be defined.
5. Reports and support
We process reports, reasons, submitted evidence, replies, staff notes and decisions needed to examine them. Data may also concern other match participants.
When support chat is active, website or bot messages and images are linked to the account and forwarded to the authorised staff Telegram group. The service retains the history needed for the conversation. Support availability, staffing and retention must be confirmed before publication.
6. Cookies, security and notifications
We use technical cookies for sessions, sign-in request checks, the trial before registration, reward selection and referral attribution. IP addresses, browser information and request counters may be processed to prevent abuse and protect the service. Public legal pages may also use anonymous request rate controls; they do not display account data or create a game session.
Push notifications require browser permission. We store the device subscription endpoint and keys needed to send notifications through the browser service, which may be provided by Google, Mozilla, Apple or Microsoft. The server message contains an event reference; the website retrieves the content through the player's authenticated access. You can revoke permission in the browser; the website also provides subscription management.
We keep local technical logs to diagnose faults and service actions. The Grafana Cloud integration in the code sends system and container metrics; any transfer of logs to external services and retention periods must be checked in the actual environment.
7. Why we use the data
Technical purposes are to create and protect accounts, verify game profiles, organise and verify matches, accurately record transactions, handle deposits and withdrawals, manage reports and support, and diagnose faults.
Legal bases to complete before publication: each purpose must be associated with its applicable basis, including any statutory obligations, legitimate interests and processing subject to consent. Accepting the Terms is not general consent to any use of data. This draft does not authorise advertising uses or additional purposes.
8. Who receives the data
Depending on the features used, recipients include Telegram for the bot, files and support; Supercell for profiles and results; Google for sign-in and, if selected, image reading; Anthropic if Claude is selected to read images; Mailgun for operational emails; the deposit checkout; browser push services; Grafana Cloud for metrics; infrastructure providers and authorised personnel.
The planned website email configuration is Mailgun EU, using mail.cashbrawl.app. The sending region alone does not establish that every processing operation or recipient is confined to the European Union.
Documents published on Telegraph are public texts. If you open a Telegraph link, you use that service and its conditions for processing browsing data also apply.
To complete: providers' contractual identities, roles, processing countries and safeguards for any international transfers. Data residency is not inferred merely from an API being present in the code.
9. Retention, copies and the testing environment
The web session in the code lasts seven days. In the reviewed version, the anonymous trial cookie lasts one day and the reward selection cookie one hour; the referral cookie lasts 30 days. These expiry periods do not erase account history.
Unused email requests are scheduled for removal 48 hours after creation; used ones 30 days after consumption. The verification code is valid for 24 hours. Expired sessions and sign-in states are removed by periodic cleanup; failures or cleanup backlogs may delay removal.
For Telegram onboarding stalled before consent, the code removes name and username after 45 days. Not all references and historical rows are deleted: this is not complete account anonymisation.
The bot also persists conversation state in files, which may include choices and references to submitted materials. Its retention periods remain to be confirmed.
Staging, used for testing before releases, may contain a copy of production data. Backup copies are also planned. These archives are additional processing locations, separate from the website and operational cleanup.
To complete before publication: retention periods or criteria for accounts, transactions, results, images, reports, support, identity documents, logs, staging copies and backups; authorised access and the procedure for removing copies.
10. Automated checks and disputes
The service uses automated checks to read tags, verify results, handle prizes and apply the penalty scale. Reports and disputes provided for by the service may require a staff decision. This draft does not describe automatic image reading as biometric verification.
To complete: classification of automated decisions under applicable law and ways to request review, explanation and human intervention when required. Staff availability is not presented as an undefined guarantee.
11. Rights and updates
Where applicable, data protection law provides rights of access, rectification, erasure, restriction, objection and portability subject to legal conditions; consent may be withdrawn for processing based on it. Obligations may prevent immediate deletion of part of the history.
Before publication, the contact for requests, competent complaints authority and response procedure will be specified. The draft reference for reviewing rights is the European Commission material.
The final version will state its effective date and how updates are communicated. This draft does not replace an approved privacy notice.