Skip to content
Offrivals

Privacy Policy

In force since Oct. 25, 2026

Who looks after your data

offrivals looks after your personal data.

Questions, requests and complaints go to [email protected].

What we keep, and what for

  • Your e-mail, to send you the sign-in code and your notices.
  • Your username, name, time zone and language, so the group knows who you are and each deadline falls on your day.
  • What you put in a challenge: the goal, the stake or the forfeit, your votes, your comments and the reasons of a dispute.
  • Your proofs: the screenshot or photo, the number you declare and what the automatic reading found.
  • Results and settlements: who made the goal, who owes whom, and whether it was paid. The money between participants never passes through us; we only record what each side marks.
  • Where you get paid, if you tell us: a Pix key or a Venmo, PayPal or Wise handle. Only whoever owes you sees it.
  • Notices on your phone, if you turn them on: the address your browser gives for push.
  • The version of the terms you accepted and when, and the link that brought you here, if it had a source tag.
  • Your IP address and browser, to keep the service running and to stop abuse.

The people in your challenges see your username, name, proofs, votes, comments and results.

Champion, the paid plan

With the paid plan, we also keep:

  • Your country, read from your connection, which sets the currency and the price. You can change it on the Champion page.
  • Each adhesion: the version of the terms, the price, the currency, the plan, the moment and your IP address, as proof of what you agreed to.
  • Each charge: the amount, the currency, the tax inside it, the country of the card, your last known IP address, when it was paid and any refund.
  • What brought you: the campaign tags (utm) and the landing page of the link and, if it was an affiliate's link, their code, to know which links bring people and to pay the affiliate's commission.
  • Passes: whose pass you used, who used yours and when, so whoever sent a pass gets their week.
  • Events of the plan, like opening the Champion page, starting a payment or cancelling, with your country and what brought you, to measure the plan. They stay with us, without your IP address or the country of your card.

Two signed cookies of ours help here: ofr_dev marks your device for up to 400 days, so a pass does not count on the device of whoever sent it; ofr_ref keeps an affiliate's code for up to 30 days after you open their link.

We never see or store your card number: you type it on Stripe's page.

On what legal basis

  • To run the service you signed up for (LGPD, art. 7, V): everything that makes the game and Champion work.
  • Legitimate interest (LGPD, art. 7, IX): security, preventing abuse, measuring the audience and measuring our ads.

Audience and ads measurement

We use Google Analytics to count visits and learn where people come from. Google receives your IP address, your browser, a _ga cookie, which screen you opened, the tags of the link that brought you (utm, src and the click id of an ad) and the steps you take: creating your account, a challenge, joining one, sending a proof and subscribing to Champion. If you are signed in, it also gets a code of your account, scrambled so it is not your number. It never gets invite codes, pass codes, sign-in codes, challenge identifiers or challenge names.

We use the Meta pixel and the Meta Conversions API to measure our ads on Facebook and Instagram and to show them to people like the ones who already play. Meta receives your IP address, your browser, the _fbp and _fbc cookies, the address and the title of each page you open, invite code and challenge name included, the buttons you tap and the fields of the forms you use, and the same steps. If you are signed in, it also gets your e-mail and a code of your account, both scrambled (hashed) before they leave.

The basis is legitimate interest. You can block both with your browser's tracking protection.

Who we share it with

Only with the companies that run the service for us, and only what each one needs:

  • Contabo: the server in the United States where the database, the files and the backups live.
  • Cloudflare: carries all traffic to the app, and the e-mails you send us.
  • Resend: sends our e-mails, with your address, the sign-in code and the text of each notice.
  • Anthropic: reads the screenshot of a proof to check the number, with the rule of the challenge.
  • Google: audience measurement, as above.
  • Meta: measurement of our ads, as above.
  • Stripe: processes Champion payments. It receives your e-mail, an internal number of your account and your language, and the card you type on its page. It also gets the code of your account that RevenueCat reads.
  • RevenueCat: measures the Champion subscription for us. It receives from Stripe the data of your Champion subscriptions and payments.
  • The push services of your browser (Google, Mozilla, Apple, Microsoft): deliver notices, which travel encrypted.

We do not sell your data. For advertising, only what goes to Meta, as above. When you open a payment link (Pix, Venmo, PayPal, Wise), the data goes from your phone to that app, without us.

Data outside Brazil

These companies keep data outside Brazil, mostly in the United States. The transfer is needed to run the service you asked for (LGPD, art. 33, IX). Google Analytics and Meta also process data in the United States, under the legitimate interest above.

For how long

  • The screenshot of a proof is deleted 60 days after the last cycle of the challenge. The number and the result stay.
  • The history of challenges and settlements stays while your account exists. After you delete it, it stays without your name, because it is also the record of the other players.
  • Payment handles, devices for notices and comments stay until you remove them or delete your account.
  • Records of Champion adhesions and charges stay after you delete your account, with no name attached, as proof of what was agreed and paid. Stripe keeps the payment records on its side.
  • Sessions expire after two weeks. Backups are kept for 14 days.

Your rights

You can ask to see your data, correct it, delete it or take a copy, to know who we share it with, and to object to a use of it.

Write to [email protected] from the e-mail of your account. We answer within 15 days.

Deleting your account takes away your e-mail, username, name, payment handles, devices for notices, screenshots and comments, ends Champion, and you can no longer sign in. Results, votes, numbers, settlements and Champion records stay, with no name attached. If a challenge of yours is still running or a settlement is open, we tell you before deleting.

You can also complain to the ANPD, the Brazilian data protection authority.

Security

There is no password to leak: you sign in with a code that lasts 10 minutes. Everything travels encrypted, screenshots live in a private store opened only by temporary links, and photo metadata, like location, is removed.

Age

You need to be 18 or older to play.

Changes

We let you know when this policy changes, and the date at the top changes with it.

The rules of the game are in the Terms.