SCOREBOX — PRIVACY POLICY v1.1.1

Effective Date: March 13, 2026 Last Updated: September 7, 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY. THIS PRIVACY POLICY DESCRIBES HOW SCOREBOX LLC COLLECTS, USES, DISCLOSES, AND PROTECTS YOUR PERSONAL INFORMATION WHEN YOU USE THE SCOREBOX MOBILE APPLICATION.

1. INTRODUCTION

This Privacy Policy ("Policy") is provided by Scorebox LLC, a Colorado limited liability company ("Scorebox," "Company," "we," "us," or "our"), and applies to Your use of the Scorebox mobile application together with the web pages we host at scoreboxapp.com, including all associated features, functionality, content, and services (collectively, the "Application" or "App"). Some parts of the Application, such as a Station's Chalkboard page, can be used without a Scorebox account; this Policy applies to that use as well.

By accessing or using the Application, You acknowledge that You have read, understood, and agree to the collection, use, and disclosure of Your information as described in this Policy. If You do not agree to this Policy, You must not access or use the Application.

This Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined herein shall have the meanings ascribed to them in the Terms of Service.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

(a) Account Information. When You create an account, we collect Your:

• First and last name
• Email address
• Gamertag (display name)
• Profile photograph (if provided)
• Authentication credentials (managed by our authentication provider)

(b) Profile Information. You may voluntarily provide additional information, including a profile avatar and gamertag, which is publicly visible to all authenticated Users.

(c) Event and Match Data. When You participate in Matches and Events, we collect:

• Match scores, results, and game-by-game records
• Team compositions and player lineups
• Dispute submissions (Red Flag) and resolution outcomes
• Event registration details and Squad roster information
• House rules text You write when creating or editing an Event

(d) Communications. When You use the Application's messaging features, we collect the content of Your direct messages, group messages, and event-related communications.

(e) Payment Information. When You make a payment through the Application (e.g., Event hosting fees, Event registration fees, Venue reservations), payment information is collected and processed directly by our third-party payment processor, Stripe, Inc. Scorebox does not collect, store, or have direct access to Your payment card numbers, bank account numbers, or other sensitive financial data.

(e)(i) Saved Payment Methods. If You choose to save a payment method for future purchases, that card is stored by Stripe, not by Scorebox. Saving is always Your choice — the payment sheet asks, and declining it has no effect on the purchase You are making. What Scorebox stores is an identifier issued by Stripe that links Your account to Your Stripe customer record; it contains no card number, expiry, or security code, and cannot be used to charge You outside the Application. You can remove a saved card at any time from the payment sheet, or by contacting us.

(e)(ii) Payout Information. If You receive payouts through the Application — as a Commissioner receiving Event registration fees for an Event You run, or as a Venue owner receiving Station reservation payments — we collect the Stripe Connect onboarding details You provide to enable those payouts (processed by Stripe). This applies whether or not You claim or manage a Venue. As with other payment information, these onboarding details are collected directly by Stripe; Scorebox does not collect, store, or have direct access to Your bank account numbers or other sensitive financial data supplied during onboarding.

(f) Referral Program and Account Credit Data. If You participate in the Commissioner Referral Program or hold Account Credit, we collect and store Your unique referral code, referral usage records (who referred whom), and Your Account Credit ledger: credit grants and their source (for example, a referral reward, a returned hosting fee, or a fill-guarantee credit), credit class and expiration dates, balances, spend records (which fees a credit was applied to and when), and expiry-warning delivery timestamps. This data is used to administer the program and Your Wallet, apply credit automatically at checkout, send expiry warnings, prevent abuse, and maintain accurate financial records.

(g) Venue Management Data. If You claim or manage a Venue, we collect information related to Your Venue, including Station configurations, reservable windows, and the Venue rules text You post for players.

(h) Content Reports. The Application lets You report another User, a message, an Event, a Squad, a Venue, or an AI-generated response that You believe is objectionable. When You submit a report, we collect and store: Your identity as the reporter, linked to Your account; what You are reporting; the reason category You select (for example, harassment, hate speech, threats, spam, inappropriate content, or impersonation); and any optional free-text note You add, up to 500 characters. Where the reported item is an AI-generated response — which is produced on request and not otherwise stored — the flagged text itself is saved with the report, up to 2,000 characters, so that it can be reviewed. We also record identifying details of the reported item at the time You report it, so reviewers can assess it without the content changing underneath them.

Reports are reviewed by Scorebox staff through an internal administrative console, and a copy of each report is emailed to our support inbox at support@scoreboxapp.com so that a person is alerted to it. That alert email identifies You as the reporter by name, gamertag, and email address, and includes the reason, Your note, and the reported content. We record the outcome of our review, including who resolved the report and what action was taken. Your identity as a reporter is not disclosed to the User or Venue You reported. Reports and their outcomes are retained as described in Section 5.

(i) Chalkboard Guest Entries. You can join the Line at a Station from that Station's page on our website without creating a Scorebox account and without signing in. When You join as a guest, the only information we collect is the display name You type, together with the Station and Venue You typed it at, the time You joined, and Your resulting position in the Line. We do not ask a guest for an email address, a phone number, a payment method, a date of birth, or any other detail, and we do not require You to create an account in order to get in Line.

We collect the display name for a single purpose: so that Venue staff and the other players waiting can see who is in the Line and call You when the Station is free. Because that is what the Line is for, the name You type is shown on that Station's page for as long as You are waiting, and that page can be viewed by anyone who opens it, including people who are not signed in. The name You type does not need to be Your legal name — use whatever You want to be called at the table.

A guest entry is not connected to any Scorebox account. We do not link it to a user record, and if You later create an account we have no means of associating that account with a guest entry You made beforehand. Retention of guest entries is described in Section 5.4a.

2.2 Information Collected Automatically

(a) Device Information. We automatically collect certain information about Your device, including device type, operating system version, and unique device identifiers, to ensure compatibility and improve the Application.

(b) Push Notification Tokens. When You grant notification permissions, we collect Your Apple Push Notification service (APNs) device token to deliver push notifications. This token is associated with Your user account and removed upon sign-out.

(c) Usage Data. We may collect information about how You interact with the Application, including features accessed, actions taken, and time spent within the Application.

(d) Crash and Diagnostic Data. When the Application encounters an error or crashes, we automatically collect a diagnostic report to identify and fix the fault. These reports are processed on our behalf by Sentry (see Section 4.3) and contain:

• The error message and the technical stack trace showing where in the code the fault occurred
• Device model, operating system version, and Application version
• The approximate time the fault occurred

Crash and diagnostic reports are not linked to Your identity and are not used for tracking, advertising, or profiling. Before any diagnostic report leaves Your device or our servers, we automatically remove authentication tokens, payment credentials, and email addresses. We use this data solely to diagnose and fix defects in the Application. Diagnostic reports are retained no longer than 90 days and are then deleted.

The same automatic error reporting applies to our server-side systems: when a server operation fails — for example, a payment or Event finalization — we record the technical error, subject to the same removal of authentication tokens, payment credentials, and email addresses described above.

2.3 Information Collected With Your Permission

(a) Location Data. The Application accesses Your device's location services only in the following limited circumstances:

• Venue Waitlist (Remote Join): When You join a Venue waitlist remotely through the Application, we verify that You are within 200 meters of the Venue. This is a one-time proximity check; continuous location tracking does not occur.
• Presence Confirmation: When confirming physical presence at a Venue via the Application (without QR scan), location is used for verification.
• Location data is never collected during casual play, when scanning a Station's QR code, or for any purpose unrelated to Venue proximity verification.

(b) Camera Access. The Application accesses Your device camera only for:

• Scanning Station QR codes to join a Station's line
• Scanning profile QR codes to navigate to another User's profile
• Capturing or updating Your profile photograph
• The camera is not accessed for any other purpose.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1 Core Application Functionality

• To create, maintain, and authenticate Your account
• To record and display Match scores, statistics, and results
• To calculate and update Elo ratings, rankings, and competitive statistics
• To facilitate Event management, registration, Squad rosters, and Match scheduling
• To operate the dispute resolution system (Red Flag process)
• To manage Station waitlists and reservations
• To deliver direct messages, group messages, and event communications

3.2 Payments and Financial Transactions

• To process Event hosting fees, Event registration fees, and Venue reservation payments through Stripe
• To validate and apply promotional codes and referral codes/credits to applicable fees
• To administer the Commissioner Referral Program, including tracking referral usage, awarding credits, and preventing abuse
• To manage escrow of registration fees pending Event verification
• To process refunds in accordance with our Terms of Service

3.3 Communications

• To deliver push notifications regarding Match disputes, roster decisions, Station session updates, Event updates, and other operational and user-configured alerts
• To send system-level communications regarding Your account, security, or changes to our Terms or this Policy

3.4 AI-Generated Content

• To generate match commentary using artificial intelligence services (Anthropic Claude)
• To generate text-to-speech audio for match commentary (OpenAI)
• Match data (scores, team names, sport type) may be transmitted to these providers to generate contextual commentary. No personally identifiable information beyond gamertags and team names is shared for this purpose.

3.5 Venue Discovery

• To provide Venue search and discovery features using Google Places API
• Venue search queries (text-based) are transmitted to Google to return relevant results. Your personal information is not included in these queries.

3.6 Safety and Integrity

• To receive, review, and act on content reports submitted by Users, including removing content, restricting features, and suspending or terminating accounts
• To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
• To enforce our Terms of Service, including the prohibition on stat manipulation and smurfing
• To maintain the integrity of the competitive ecosystem

3.7 Improvement and Development

• To analyze usage patterns and improve Application features, performance, and user experience
• To diagnose technical issues and maintain Application stability

4. HOW WE SHARE YOUR INFORMATION

4.1 Publicly Visible Information

By design, the following information is publicly visible to all authenticated Users of the Application:

• Your display name, gamertag, and profile photograph
• Your aggregated Match statistics, win/loss records, and Elo ratings
• Your follower and following counts
• Your Event participation (Squad membership, event rosters)

There is no private profile mode. By creating an account, You acknowledge and consent to the public visibility of the foregoing information.

4.2 Other Users

• Match Opponents: Your name, gamertag, statistics, and Match results are shared with opponents and other participants in Your Matches and Events.
• Commissioners: Event Commissioners can view roster information, Match results, and dispute details for Events they manage.
• Messaging: Message content is shared with the intended recipient(s) of each conversation.

4.2a Venue Owners

If You play at a claimed Venue (for example, by playing a Match there or joining a Station's Line), the Venue's owner can see aggregate activity metrics for their Venue — visit counts, busiest times, games played, and sport mix — which do not identify You. Venue owners who have additionally completed identity verification through our payment processor can also see named activity at their Venue: Your name, how often You have visited, and Your visit streaks there. This mirrors information that is already publicly visible on Venue leaderboards, extended with visit frequency.

We never share Your contact information with Venues. No email address, phone number, or device token is ever provided to a Venue owner. Venue announcements (Terms of Service §10.5) are composed by the Venue and delivered by Scorebox; You can opt out per Venue or entirely at any time. Chalkboard guests who are not signed in appear in the Venue activity metrics described above only as anonymous visit counts: a guest is never included in the named lists, and the display name a guest typed is used solely to tell one guest's visits apart from another's when counting, never shown to the Venue owner as part of these metrics. This is separate from the Line itself — while a guest is waiting, the name they typed is visible to Venue staff and to anyone viewing that Station's page, as described in Section 2.1(i).

4.3 Third-Party Service Providers

We share information with the following third-party service providers who assist us in operating the Application:

Each third-party provider processes data in accordance with its own privacy policy and terms of service. We require our service providers to use Your information only as necessary to provide services to us.

4.4 Legal Requirements

We may disclose Your information if required to do so by law or in response to valid legal process, including:

• Court orders, subpoenas, or government requests
• To protect the rights, property, or safety of Scorebox, our Users, or the public
• To enforce our Terms of Service
• To detect, prevent, or address fraud, security, or technical issues

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, Your information may be transferred as part of that transaction. We will notify You of any such transfer and any choices You may have regarding Your information.

4.6 No Sale of Personal Information

Scorebox does not sell, rent, or trade Your personal information to third parties for their marketing purposes.

5. DATA RETENTION

5.1 Active Accounts

We retain Your information for as long as Your account remains active or as needed to provide You with the Application's services.

5.2 Match and Statistical Data

Match history, scores, statistical records, and Elo ratings may be retained indefinitely to maintain the integrity and continuity of the competitive ecosystem, even after account termination.

5.3 Communications

Message content is retained for the duration of the conversation and is not automatically deleted. You cannot selectively delete individual messages.

5.4 Account Deletion

Upon account deletion:

• Your profile information (name, gamertag, avatar, email) will be removed
• Your push notification tokens will be removed
• Match history and statistical records may be retained in anonymized or aggregated form to preserve the integrity of historical results and other Users' records
• Payment records may be retained as required by applicable financial regulations

5.4a Chalkboard Guest Entries

We retain guest entries indefinitely. Once a guest entry is more than three hours old, a housekeeping routine marks it expired the next time that Station is opened in the Application, which takes the entry off the active Line; on Station screens in the mobile app a recently expired name remains briefly visible, struck through, so that a player who was skipped can see what happened. Expiry is a change of status only. The entry itself, including the display name You typed, is not deleted, and we do not delete guest entries on any schedule.

Because a guest entry is not attached to an account, it is not reached by the account deletion process described in Section 5.4. If You would like a guest entry removed, contact us at support@scoreboxapp.com with the Venue, the Station, and the name You used, and we will delete it.

5.5 Legal Obligations

We may retain certain information as required by law, regulation, or legal process, or to resolve disputes and enforce our agreements.

6. DATA SECURITY

6.1 Security Measures

We implement commercially reasonable technical and organizational measures to protect Your information, including:

• Encrypted data transmission (TLS/SSL) for all communications between the Application and our servers
• Row-Level Security (RLS) policies on all database tables, ensuring Users can only access data they are authorized to view
• Authentication via JSON Web Tokens (JWT) with secure session management
• Server-side price determination for financial transactions (client never transmits payment amounts)
• API key and secret management through secure environment configuration

6.2 No Absolute Security

Despite our efforts, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of Your information. You are responsible for maintaining the confidentiality of Your account credentials.

7. CHILDREN'S PRIVACY

7.1 Age Restrictions

The Application is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under thirteen (13) years of age. If we become aware that we have collected personal information from a child under thirteen (13), we will take steps to delete such information promptly.

7.2 Financial Features

Users must be at least eighteen (18) years of age to access financial features of the Application, including paid Event registration and Venue reservations.

7.3 Parental Notice

If You are a parent or guardian and believe that Your child under the age of thirteen (13) has provided personal information to us, please contact us at support@scoreboxapp.com so that we can take appropriate action.

8. YOUR RIGHTS AND CHOICES

8.1 Account Information

You may review and update Your account information at any time through the Application's settings, including Your name, gamertag, and profile photograph.

8.2 Push Notifications

You may manage Your notification preferences through the Application's notification settings. Certain operational notifications (dispute alerts, roster decisions, session updates) are always delivered regardless of Your preferences. You may disable all push notifications through Your device's system settings, but You accept responsibility for any consequences of missed time-sensitive alerts.

8.3 Location Services

You may enable or disable location services for the Application through Your device's system settings at any time. Disabling location services will prevent You from joining Venue waitlists remotely.

8.4 Camera Access

You may enable or disable camera access for the Application through Your device's system settings at any time. Disabling camera access will prevent You from scanning QR codes and updating Your profile photograph.

8.5 Account Deletion

You may delete Your account at any time from within the Application via Settings → Delete Account. You may alternatively request deletion by contacting us at support@scoreboxapp.com. Upon deletion, we will remove Your personal profile information (name, gamertag, avatar, email) and push notification tokens, subject to the retention provisions set forth in Section 5. Deletion cannot be completed while You have active paid Events as Commissioner or claimed Venues; You must resolve those commitments first.

8.6 Data Access and Portability

You may request a copy of the personal information we hold about You by contacting us at support@scoreboxapp.com. We will respond to verified requests within a reasonable timeframe and in accordance with applicable law.

9. STATE-SPECIFIC PRIVACY RIGHTS

9.1 California Residents (CCPA/CPRA)

If You are a California resident, You may have additional rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), including:

• Right to Know: The right to request disclosure of the categories and specific pieces of personal information we have collected about You.
• Right to Delete: The right to request deletion of Your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell Your personal information. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against You for exercising Your privacy rights.

To exercise these rights, contact us at support@scoreboxapp.com.

9.2 Colorado Residents (CPA)

If You are a Colorado resident, You may have additional rights under the Colorado Privacy Act ("CPA"), including the right to access, correct, delete, and obtain a portable copy of Your personal data, as well as the right to opt out of targeted advertising and profiling. Scorebox does not engage in targeted advertising or profiling based on personal data.

To exercise these rights, contact us at support@scoreboxapp.com.

9.3 Other State Privacy Laws

Residents of other states with applicable privacy legislation (including Virginia, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights. Please contact us at support@scoreboxapp.com to exercise any applicable rights.

10. INTERNATIONAL DATA TRANSFERS

The Application is operated from the United States. If You access the Application from outside the United States, please be aware that Your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in Your jurisdiction. By using the Application, You consent to such transfer, storage, and processing.

11. THIRD-PARTY LINKS AND SERVICES

The Application may contain links to third-party websites or services that are not operated by Scorebox. We are not responsible for the privacy practices of such third parties. We encourage You to review the privacy policies of any third-party services You access.

12. COOKIES AND TRACKING TECHNOLOGIES

The Scorebox mobile application does not use cookies. Web pages hosted at scoreboxapp.com use no third-party analytics or advertising trackers. One first-party cookie exists: when you follow a referral link, it remembers that referral code for up to 30 days so it can be applied if you create an account. It identifies no one, tracks no browsing, and is never shared.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will notify You through the Application or by other means prior to the effective date of the changes. Your continued use of the Application following the effective date of any modifications constitutes Your acceptance of the updated Policy. We encourage You to review this Policy periodically.

14. CONTACT US

If You have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Scorebox LLC Email: support@scoreboxapp.com

This Privacy Policy was last updated on September 2, 2026.