Privacy Policy

Plain-language overview. Midgame uses account, device, activity, subscription, notification, and sports-preference information to operate and improve the Service. We do not exchange personal information for money or use it for cross-context behavioral advertising. Optional website analytics remain off until you choose to allow them. This overview is not a substitute for the complete policy below.

This Privacy Policy explains how Midgame, Inc. (“Midgame,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use the Midgame iOS app, midgame.bet, or a related service that links to this policy (collectively, the “Service”). It also describes privacy choices and rights that may be available to you.

This policy is a notice of our practices; it is not a contract requiring you to surrender a privacy right. The Terms of Service govern use of the Service. If a feature provides a more specific privacy notice when information is collected, that notice also applies.

#1. Scope and who is responsible

Midgame, Inc. is the business or controller responsible for personal information covered by this policy, except where another notice identifies a different responsible party.

This policy covers information handled by the Midgame app and website, including registered and guest accounts, support and contact communications, referrals, subscriptions, alerts, and website analytics. It does not govern an independent website, sportsbook, app store, authentication service, or other third party that processes information for its own purposes under its privacy notice.

The Service is operated from the United States. If you use it from another country, Section 12 explains international processing and transfer considerations.

#2. Information we collect

The information we collect depends on the features you use, the permissions you grant, your device, and whether you have an account or subscription. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a person or household, as defined by applicable law.

#Account and identity information

We may collect:

• name, display name, username, avatar, email address, phone number, and account identifiers;
• information supplied through Sign in with Apple, such as an Apple account subject identifier, relay or other email address, and name if Apple makes it available;
• phone number and verification status when phone authentication is used;
• guest-account and session identifiers; and
• authentication, recovery, session, and security records.

Midgame receives verification results from authentication providers. Do not send us a password or verification code except through the specific authentication interface that requests it.

#Age, state, and location information

We collect your date of birth and selected state or region to apply age requirements, configure the experience, support legal compliance, and help prevent misuse. Date of birth and location can be treated as sensitive personal information under some laws.

If you affirmatively tap “Use my location” and grant iOS permission, the app may request a one-time device location and translate it into a state or administrative region. Manual state selection is available. We do not use this permission as a promise that the Service determines whether any activity outside Midgame is lawful.

Like most internet services, our systems receive an IP address when a device connects. We may derive approximate country, region, city, and coordinates from that IP address for security, administration, service operation, and region-aware communications. IP-based location can be inaccurate and is separate from the optional iOS location permission.

#Preferences and feature configuration

We may collect sports and team selections, followed teams, player type, alert style, alert rules, tracked or muted games, notification choices, Live Activity choices, time zone, quiet hours, responsible-use settings, cooling-off state, alert caps, and self-exclusion settings. These choices can reveal interests and create inferences about how you prefer to use the Service.

#Activity and interaction information

Our first-party systems record how the Service is used. Depending on the feature, this may include:

• session identifiers, screen views, taps, feature interactions, funnels, and timestamps;
• game, trend, alert, or prediction identifiers viewed or acted on;
• tracked games, opened alerts, notification interactions, and the duration or sequence of an interaction;
• referral, invite, attribution, and conversion events;
• when you choose to open an independent third-party destination from Midgame; and
• app version, operating-system version, device model, locale, time zone, screen characteristics, referral parameters, and similar context.

This app activity may be associated with an account or guest identifier and is therefore not necessarily anonymous. We may create aggregate or deidentified statistics, but we treat information as personal unless it has been transformed so it cannot reasonably be linked back to a person.

#Device, diagnostics, and network information

We may collect device model, operating system and app version, language, time zone, network information, IP address, event times, crash reports, stack traces, app-hang information, performance traces, and technical view-hierarchy or similar diagnostic context. Diagnostic context is used to understand a malfunction and may incidentally reflect what the app displayed when the problem occurred.

Authentication tokens are stored in the iOS Keychain where the app supports it. The app may also cache account, game, alert, trend, rule, subscription, and preference data locally so features can load and function. Local data is subject to your device’s security and may persist until the app, cache, or device data is cleared.

#Notifications and Live Activities

If you enable notifications or Live Activities, we may collect Apple Push Notification service tokens, push-to-start and per-activity tokens, device and app version, notification permission status, Live Activity support status, and records of notification sending, delivery feedback where available, opening, actions, and related conversions. Tokens are technical identifiers used to route messages to a device; they are not the content of a text message or phone call.

#Subscription and transaction information

When you start, purchase, restore, or manage a paid feature through Apple, we may receive product and entitlement information, subscription tier, purchase and original-transaction identifiers, storefront or currency context, trial status, purchase and renewal dates, auto-renewal or cancellation state, billing-issue state, and related receipts or verification results from Apple and our subscription infrastructure provider.

Apple processes payment credentials and acts as merchant of record for App Store purchases. Midgame does not receive your complete payment-card number from Apple.

#Communications, support, reports, and feedback

We collect information you submit through contact, support, waitlist, reporting, feedback, and account-deletion flows. This may include your name, email, phone number, message category, message body, feedback, report details, deletion reason, and related records. Messages may contain information you choose to include. Please do not include payment-card details, passwords, verification codes, health information, or other unnecessary sensitive information.

#Referrals and fraud-prevention information

If you use a referral or invite feature, we may collect the referral code and relationship, platform, operating-system version, screen size, locale, time zone, user agent, IP address or a hashed form of it, device or token-derived fingerprints, invite status, join time, and reward qualification. An inviter may see limited status information about an invitee, such as a first name or username and whether the invite qualified, but not the invitee’s phone number or email through that feature.

#Website cookies and similar technologies

The website uses local storage and may use cookies or similar technologies to remember consent choices, maintain essential functions, protect forms, measure performance, and understand traffic. Optional analytics are disabled by default and enabled only after an affirmative choice through our consent interface, unless applicable law permits another basis and we update this notice.

When analytics is enabled, website events may include page URL and path, page title, referrer, campaign parameters, browser or device information, and interaction events. We configure advertising-storage signals as denied and do not use the Service to deliver third-party targeted ads. Section 9 explains browser controls and Global Privacy Control.

#3. Where information comes from

We obtain personal information:

• directly from you, including information entered during onboarding, support, referrals, settings, rules, and deletion flows;
• automatically from your device and use, including app activity, IP-derived location, diagnostics, permissions, tokens, cookies, and local-storage choices;
• from platform and service providers, such as Apple, authentication and verification providers, subscription infrastructure, analytics, diagnostics, and email providers;
• from another user, such as when someone sends an invite or identifies a referral relationship; and
• by generating inferences, such as sports preferences, likely region from IP, feature interests, and fraud or security signals.

Sports data providers supply game and market information displayed in the Service. We do not treat public game statistics as your personal information merely because you view them, although the record of what you viewed may be personal information.

#4. Why we use information

We use personal information to:

• create, authenticate, maintain, and secure registered and guest accounts;
• verify age information and configure region-relevant features;
• provide games, trends, alerts, rules, follows, notifications, Live Activities, referrals, and responsible-use controls;
• manage subscription access, verify entitlements, restore purchases, and address billing-support issues;
• personalize sports, team, alert, and notification experiences;
• send verification, security, service, support, policy, and other transactional communications;
• respond to inquiries, reports, deletion requests, rights requests, and feedback;
• monitor performance, debug crashes and app hangs, analyze feature use, and improve the Service;
• measure referral eligibility and prevent duplicate, automated, fraudulent, abusive, or unauthorized activity;
• enforce our Terms, protect users and systems, and investigate security incidents;
• comply with law, court orders, valid legal process, and recordkeeping obligations;
• establish, exercise, or defend legal claims; and
• create aggregate or deidentified insights that do not reasonably identify a person.

We do not use a date of birth, device location, authentication credential, or responsible-use setting to infer sensitive characteristics for advertising. We do not make eligibility decisions for independent wagering operators.

#5. Legal bases for processing

If European Economic Area, United Kingdom, or similar law requires a legal basis, our bases depend on the context:

• Contract: processing needed to provide the Service you request, authenticate an account, deliver selected features, or manage subscription access.
• Legitimate interests: operating and improving the Service, understanding use, maintaining security, preventing fraud, supporting users, and protecting legal rights, balanced against your interests and rights.
• Consent: optional device location, notifications where the operating system requests permission, optional website analytics, and other processing where we specifically ask for consent. You may withdraw consent prospectively.
• Legal obligation: processing needed to comply with law, valid process, tax, accounting, consumer-protection, or regulatory requirements.
• Vital interests or public task: only in the limited circumstances where the applicable law recognizes and requires that basis.

If we ask for information needed to perform a contract or comply with law and you do not provide it, the applicable feature may be unavailable.

#6. How we disclose information

We disclose personal information only as described below, as otherwise explained at collection, or with your direction.

#Vendors that process information for us

We use providers to perform defined functions. Depending on the Service configuration, these may include:

• Apple for Sign in with Apple, StoreKit and App Store purchases, APNs, Live Activities, and iOS platform services;
• Twilio for phone-number verification;
• RevenueCat for subscription offering, purchase, entitlement, restore, and subscription-lifecycle infrastructure;
• Sentry for production crash, app-hang, error, and performance diagnostics;
• Resend for transactional, verification, support, and website-form email delivery;
• Google Analytics and Segment for website analytics only after optional analytics consent, subject to the configuration described in this policy; and
• hosting, database, content-delivery, monitoring, security, customer-support, and infrastructure providers that help us operate the Service.

These providers receive information appropriate to their function and process it under their agreements with us. Some also process information for their own purposes as independent businesses, particularly Apple and services you choose to visit; their notices govern that independent processing. Vendor names and functions can change as the Service evolves, and we will update this policy when a change is material.

#At your direction or when you leave Midgame

When you choose to open an independent third-party service, the destination may receive ordinary connection and request information directly from your device, and any referral or destination parameters included in the link. Midgame may record that the action occurred. The third party’s terms and privacy policy apply after you leave Midgame.

#Legal, safety, and rights protection

We may disclose information if we reasonably believe disclosure is necessary to comply with a law, subpoena, court order, or other valid legal process; respond to a government request; enforce agreements; investigate fraud, security, or illegal activity; protect the rights, property, or safety of Midgame, users, or others; or establish, exercise, or defend legal claims. We assess requests and may object or narrow them where appropriate and lawful.

#Corporate transactions

Information may be disclosed in connection with due diligence, financing, reorganization, merger, acquisition, sale of assets, bankruptcy, or a similar transaction. A recipient may use it only as permitted by this policy unless it provides notice and any choice required by law.

#Professional advisers and business administration

We may disclose information to lawyers, auditors, insurers, accountants, banks, and professional advisers when reasonably necessary for their work and subject to appropriate duties of confidentiality.

#Aggregate and deidentified information

We may disclose statistics or information that has been aggregated or deidentified so it cannot reasonably be linked to you. We do not attempt to reidentify information that applicable law requires us to maintain as deidentified, and we require the same where legally required of recipients.

#7. Sale, sharing, advertising, and profiling

Midgame does not exchange personal information for money. As of this policy’s effective date, we do not display third-party advertising in the Service and do not use personal information for cross-context behavioral advertising or targeted advertising based on activity across unrelated businesses.

Some U.S. state laws define “sale” or “sharing” broadly enough that disclosures to an analytics provider may qualify even when no money changes hands. Optional website analytics remain off until you opt in, and you may reject or revoke them through Your Privacy Choices in the website footer. We also treat a recognized Global Privacy Control signal as an opt-out for that browser where required. We do not knowingly sell or share the personal information of anyone under 18.

We do not use automated processing to make decisions that produce legal or similarly significant effects about you. Product ranking, alert logic, fraud signals, and personalization can use automated rules, but they do not determine credit, employment, housing, insurance, education, health care, or legal eligibility for an independent wagering service.

#8. Retention and account deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security and integrity, resolving disputes, enforcing agreements, meeting accounting or legal requirements, and establishing or defending claims. Retention depends on the type of information, sensitivity, operational need, account status, legal requirements, and risk of harm from unauthorized use or disclosure.

In general:

• account and preference records are retained while an account is active and as reasonably necessary after deactivation;
• session, device, security, and fraud records are retained for security and integrity needs;
• subscription and transaction records may be retained for entitlement verification, accounting, disputes, fraud prevention, and legal compliance;
• analytics, diagnostics, alert, notification, and interaction records are retained for product, reliability, security, and recordkeeping needs;
• support, rights-request, report, and legal records are retained long enough to respond, document the response, prevent abuse, and meet legal obligations; and
• local app caches and browser storage remain on your device until the app, browser, or stored data is cleared, subject to operating-system behavior.

You can initiate account deletion in the app. When the current deletion flow begins, the account is deactivated, active sessions are revoked, and registered push devices are removed. A 30-day grace period may allow reactivation by signing in. After that grace period, reactivation may no longer be available. The 30-day period is not a representation that every record or backup is erased on day 30. We delete, deidentify, or restrict information according to the framework above and may retain information necessary for security, fraud prevention, legal compliance, transactions, disputes, and enforcement.

A deletion-request record may retain the reason, voluntary feedback, and a snapshot of contact information separately from the user account so we can document the request, improve the Service, prevent abuse, and meet legal obligations. You may omit optional deletion feedback. Information that cannot identify you or has been validly deidentified is not subject to the same deletion requirements.

Deleting a Midgame account does not cancel an Apple subscription. Cancel through Apple before the renewal time shown in your Apple subscription settings. See the Subscription Terms.

#9. Your controls and choices

Depending on your device and features, you can:

• update available profile, sports, team, alert, quiet-hour, and responsible-use settings in the app;
• grant or deny iOS location, notification, and Live Activity permissions through the app or iOS settings;
• turn categories of app notifications on or off where those controls are available;
• initiate account deletion in Midgame settings;
• reject optional website analytics in the consent banner or later through Your Privacy Choices in the footer; and
• clear website cookies or local storage through browser controls.

The website stores a consent record in browser local storage. If Global Privacy Control (GPC) is enabled, our website treats it as an opt-out of optional categories for that browser. A browser-level choice does not delete an app account or submit an access, correction, or deletion request. Email privacy@midgame.bet for those requests.

Browsers may send Do Not Track signals that do not have a uniform legal or technical standard. We do not respond to generic Do Not Track signals as a separate control, but we honor GPC where required and provide the choices described above.

Midgame’s mobile first-party product analytics do not currently have a user-facing analytics toggle. Device settings that limit advertising do not necessarily disable operational, security, entitlement, first-party analytics, or diagnostics data that are not advertising. You may exercise applicable legal rights as described in Section 10.

#10. Privacy rights and requests

Depending on where you live and subject to exceptions, you may have the right to:

• know whether we process personal information and access or receive a copy of it;
• know the categories, sources, purposes, and recipients of personal information;
• correct inaccurate personal information;
• delete personal information;
• receive certain information in a portable format;
• object to or restrict certain processing;
• withdraw consent without affecting prior lawful processing;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• appeal our decision on a request; and
• receive equal service and not be discriminated against for exercising a privacy right.

To submit a request, email privacy@midgame.bet with the subject “Privacy Request” or use an in-app method where available. Account deletion can also be initiated in app settings. Describe the right you want to exercise and the account information needed to locate your records, but do not send a password, verification code, government identification, or full payment-card number unless we specifically request an appropriate verification method.

We will verify requests to a degree appropriate to the sensitivity of the information and risk of harm. Verification may require confirming control of an account, email address, or phone number. If we cannot verify a request, we may deny it or limit the information provided. We may also deny or retain information where an exception applies and will explain the basis where required.

An authorized agent may submit a request where law permits. We may require proof of the agent’s authority and may ask you to verify your identity or confirm the request directly. We respond within the period required by applicable law and may take a permitted extension with notice. If we deny an appealable request, you may appeal by replying with the subject “Privacy Appeal.”

We do not charge for ordinary requests, but may charge or decline as permitted for requests that are manifestly unfounded, excessive, repetitive, fraudulent, or not legally required. We will not retaliate or unlawfully discriminate because you exercised a right.

#11. U.S. state privacy disclosures

This section supplements the rest of the policy for residents of states with comprehensive privacy laws, including California, where the law applies to Midgame and the person or information at issue.

In the preceding 12 months, we may have collected the following statutory categories described in Section 2:

• identifiers, such as name, username, account IDs, email, phone, IP address, device and push tokens, and referral identifiers;
• customer-record information, such as contact and account information;
• protected classification information, such as age or date of birth;
• commercial information, such as subscription product, transaction, entitlement, trial, renewal, and cancellation status;
• internet or electronic-network activity, such as screen views, taps, sessions, referral activity, destination opens, interactions, and website usage;
• geolocation information, including selected state, optional device location used for state selection, and location inferred from IP;
• audio, electronic, or similar information, limited to electronic messages, screenshots, attachments, or similar content you voluntarily send to support or reporting channels;
• inferences, such as sports, team, feature, alert, and product preferences; and
• sensitive personal information, which may include account authentication information, date of birth, and location data as defined by the applicable law.

We collect these categories from the sources in Section 3 for the purposes in Section 4. We may disclose them for business purposes to the recipient categories in Section 6, including platform, authentication, subscription, diagnostics, analytics, communications, hosting, security, infrastructure, professional-adviser, legal, and corporate-transaction recipients as appropriate. We do not collect every statutory category and do not knowingly collect characteristics such as race, religion, union membership, genetic data, or health diagnoses through the core Service.

We do not exchange personal information for money. Our position on analytics disclosures that a law may define as sale or sharing is described in Section 7, along with the opt-out method. We do not use or disclose sensitive personal information to infer characteristics or for purposes that require a separate right to limit under California law. If that changes, we will provide the required notice and control.

California residents may have rights to know, access, correct, delete, and receive information about categories, sources, purposes, and recipients; to opt out of sale or sharing; to limit certain sensitive-information uses; and to be free from unlawful discrimination. California residents may use an authorized agent as described above. California’s “Shine the Light” law may permit residents to request information about certain disclosures for another company’s direct marketing; we do not disclose personal information to third parties for their own direct marketing as contemplated by that law.

Other U.S. state residents may have similar rights, including opt-out and appeal rights. Submit requests through Section 10. We will apply the law associated with your verified residence and the Service as required.

#12. International users and transfers

Midgame is based in the United States, and we and our providers may process information in the United States and other countries where we or they operate. Those countries may have privacy laws different from those where you live.

Where required for a restricted transfer, we rely on an approved legal mechanism, such as an adequacy decision, standard contractual clauses, a provider’s valid certification framework, or another lawful safeguard. You may contact us for information about the mechanism applicable to your information, subject to confidentiality and legal limits.

Residents of the European Economic Area or United Kingdom may have the rights described in Section 10 and may lodge a complaint with the data-protection authority where they live, work, or believe a violation occurred. We encourage you to contact us first so we can try to address the concern. Nothing in this policy limits the right to contact an authority.

#13. Security

We use administrative, technical, and organizational measures designed to protect personal information, taking account of the nature of the information and reasonably foreseeable risks. Measures include access controls, authentication and session protections, transport security, protected storage for certain device credentials and push tokens, monitoring, and vendor controls where appropriate.

No method of transmission, storage, or processing is completely secure. We cannot guarantee that unauthorized parties will never defeat safeguards or that information will never be lost, altered, accessed, or disclosed. You are responsible for securing your device, account recovery channels, and verification codes and for promptly reporting suspected unauthorized access.

If a security incident affects personal information, we will investigate and provide notice to affected people or authorities where required by law.

#14. Children and younger users

The Service is not directed to children or anyone under 18, and we do not knowingly permit a person under 18 to create or use an account. If you are under 18, do not use the Service or send us personal information.

If we learn that we collected personal information from a person under 18 in violation of this policy, we will take appropriate steps to restrict the account and delete or otherwise handle the information as required by law. A parent or guardian who believes a minor provided information may contact privacy@midgame.bet.

Independent wagering services may impose a higher minimum age, commonly 21 in parts of the United States. Midgame eligibility does not establish eligibility to use those services.

#15. Third-party links and services

The Service may link to Apple, independent wagering operators, social platforms, help resources, or other services. Their privacy practices are outside Midgame’s control. Once you interact with an independent service, it may collect information directly from your device under its notice. Review that notice before providing information or completing a transaction.

Apple controls App Store payment, refund, subscription-management, and certain platform information. Midgame’s policy does not replace Apple’s privacy notice or the notice of another independent service.

#16. Changes to this policy

We may update this policy when the Service, law, vendors, or our practices change. We will post the updated version, revise the “Last revised” date, and provide additional notice when required. If a change materially affects processing based on consent, we will request new consent where law requires it.

Prior versions may be requested by contacting us. We encourage you to review this policy periodically, but posting alone will not substitute for a notice or choice that applicable law requires.

#17. Contact Midgame

Questions, complaints, privacy requests, or appeals may be sent to:

Midgame, Inc.
3857 Birch Street, #3396
Newport Beach, CA 92660
United States

• Privacy: privacy@midgame.bet
• Account deletion: delete@midgame.bet
• Support: support@midgame.bet

Please use “Privacy Request” or “Privacy Appeal” in the subject when applicable. Do not include passwords, verification codes, complete payment-card numbers, or unnecessary sensitive information.