Privacy Policy

Last updated: September 5, 2026

House of Prize (“the Service”) is operated by Handaro AI (Korea) and provides browser-based board and card games with AI opponents at houseofprize.com. This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

1. Information We Collect

• Account identifiers— your email address, and, when you sign in with Google, your Google account’s basic profile (name, email, avatar URL). Collected via Supabase Auth when you create an account or sign in.
• Game activity — for each game you complete while signed in, we record the game, outcome, difficulty, duration, move sequence, engine version, and any resulting rating change. This record is tied to your account and used to display your history and to verify play integrity (server-side replay).
• Wallet ledger — if you obtain, spend, or receive in-service credits, we record the transactions in an append-only ledger tied to your account.
• Technical data — request-time information such as IP address, user agent, and timestamps, used to keep the Service secure, detect abuse, and support anti-fraud analysis. We do not persist your raw IP address in our application database; only your hosting/CDN providers retain IP per their own policies.
• Fraud-prevention identifiers (Prize Points events only) — when the Service credits your account with Prize Points following a verified game, we record with that accrual event: (i) an ISO country code derived from your request IP at that moment (raw IP is not persisted) and (ii) an anonymous device fingerprint (SHA-256 hash of your user agent, preferred language, and the first two octets of your IP address, truncated). These are used strictly to detect automation, multi-account abuse, and to allow us to segment eligibility for future point programs by region.
• Client-side preferences — game settings such as difficulty selection are stored in your browser (localStorage). This data never leaves your device.

We do not collect payment card information (we do not currently process direct payments), health data, precise geolocation, or contacts. We do not use tracking pixels for cross-site advertising.

2. How We Use Information

• Provide and operate the Service (authentication, game history, ratings).
• Verify play integrity by replaying recorded games against the same AI engine.
• Communicate with you (sign-in codes, transactional emails).
• Detect and prevent abuse (automation, multi-accounting).
• Improve the Service through aggregate, non-identifying usage metrics.

3. Third-Party Processors

We use the following processors, each bound by their own privacy terms:

• Supabase — authentication and database (US region).
• Vercel — application hosting and CDN.
• Resend — transactional email delivery for sign-in codes and account notifications.
• Google — optional sign-in provider (only if you choose Google sign-in).

We do not sell personal information, and we do not share personal information with advertisers.

4. Cookies and Local Storage

We use cookies strictly for authentication (session management) and localStorage for saving your per-game preferences. We do not use cookies for advertising or cross-site tracking.

5. Data Retention and Deletion

Account and game data are retained while your account is active. You may request deletion of your account and associated personal data at any time by contacting us; upon a deletion request, we remove identifying data within 30 days.

Because the wallet ledger is append-only for financial-audit reasons, we may retain non-identifying ledger rows (amount, reason, timestamp) after account deletion. Those rows carry only a pseudonymous user identifier and are not linked back to your email or profile after deletion. The fraud-prevention identifiers above (country code and device fingerprint) live in a separate table and are removed on deletion request.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account.
• Export your game history and account records.
• Withdraw consent for Google sign-in (by unlinking on the Google side).

To exercise any of these rights, email hansd410@gmail.com.

7. Children

The Service is not directed to children under the age of 13. If you believe a child has provided us with personal information, contact us and we will delete it.

8. International Transfers

We operate from Korea. Our processors (Supabase, Vercel, Resend, Google) may store or process data in the United States and other regions under their standard data-transfer safeguards.

9. Security

Passwords are hashed by Supabase Auth. Traffic to the Service is served over HTTPS. Database access is restricted via row-level security policies. No system is perfectly secure; we work to reduce risk continuously.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on the Service. Continued use after the effective date of an update constitutes acceptance of the updated policy.

11. Contact

Questions or requests regarding this policy: hansd410@gmail.com.

Operator: Handaro AI (Korea)