Privacy policy

Who runs this service

This policy covers Rivora Gaming at rivoragaming.com and the Rivora Gaming Android app, which opens the same website in your phone’s browser. Rivora Gaming is an independent Indian gaming community. Contact support@rivoragaming.com about privacy or your data.

Accounts and player profiles

We store your account name, email, verification status, sign-in provider and account identifiers. Password sign-in stores a password hash. Google sign-in can store your Google account name, email, image and authentication tokens. Sessions store a login token, expiry, IP address and browser information so we can keep you signed in and protect account access.

Your profile can contain your in-game names, UIDs, levels and tiers for each game you play (BGMI, Free Fire MAX, COD Mobile), a second BGMI account, city, district, state, mobile number, UPI ID or payout phone number, social links, profile photo and rank-proof image. We use these details to register players, check eligibility, recognise players in the room, contact them and arrange prizes. Fields not needed by a particular step can be left blank.

Registrations store the name used at the time, accepted rules, registration and check-in times, teams, invites and squad membership. Results store placement, kills, participation, disqualifications and prize amounts. Payment records store the amount, transfer reference and when the organizer marked it sent. Name-change history, fair-play actions, appeals handled by support and organizer checks help resolve mistakes and enforce match rules.

What other people can see

Public player profiles, published results and leaderboards show gaming identity and match statistics. A roster shows your name only when your roster-visibility setting permits it. Squad and tournament pages also show their participating squads and gaming names. A profile photo and social links you add can be public. Match participants can see team information needed to play. Public fair-play actions show gaming names and masked UIDs.

Your email, mobile number, UPI details and full UIDs are not fields in the public player profile response. Room details are restricted to eligible signed-in participants and the organizer. Notifications link to the match page and do not carry a room ID or password. Public announcements, comments and content you choose to share can be read by others.

Alerts, support and service measurements

If you enable browser or app alerts, we store the push subscription endpoint, encryption keys, browser information and delivery state. If you link Telegram, we store your chat ID, username and link time. Notification preferences, inbox messages, delivery attempts and errors are stored to deliver and troubleshoot alerts. You can disconnect Telegram or turn off push in Settings.

We record match views, registration actions, room views and invite actions. We also record interface errors, failed actions and abandoned steps with a temporary tab identifier, route, control label and error message. Referral links and campaign cookies identify which links brought visits and registrations. Local browser storage remembers choices such as install prompts and walkthroughs. The app shares the website’s browser storage.

Ask Rivora stores a masked question and answer, source pages, feedback and whether the answer came from search or a model. Email, phone and UPI patterns are masked before storage and model use. Avoid putting sensitive information in a question. Sponsor enquiries and career applications store the submitted contact details and message or experience; a career application also stores the uploaded resume. The organizer keeps a private list of businesses and people it talks to about sponsorship, with their contact details and notes of each conversation; a sponsor enquiry is added to it. Only the organizer can see it.

Who processes information

Cloudflare runs the website and API, D1 database, R2 file storage, Turnstile checks and Workers AI. It processes the information used by those features, including uploaded images and masked help questions used for model answers. Google processes Google sign-in when you choose it; Chrome provides the Android app’s website and browser services. Resend processes the destination email and message for verification and password-reset emails, and sends delivery and bounce reports back to us.

When linked, Telegram processes your chat identity and the alerts sent to it. The browser’s push service delivers encrypted Web Push messages. Discord receives only public match information for server posts, not player contact details or private room credentials. External community, social and video links open those providers’ services; playing an embedded YouTube video also involves YouTube. These providers have their own privacy policies.

The organizer can access private information needed to run matches, check results, arrange UPI prizes and answer support requests. Prize transfers are made outside this app. The service does not implement a player wallet, entry payment or in-app purchase.

Security

The live service uses HTTPS. Mobile numbers, payout phone numbers, UPI IDs and room passwords are encrypted at rest using AES-GCM. Mobile-number hashes support duplicate-account and ban checks. Passwords are hashed by the authentication service. Names, emails, gaming details, images, result records and OAuth tokens are not covered by that field-encryption claim. Private API access requires a session; organizer APIs also require the admin role and allowlist.

How long information is kept

Interface-friction records and stored Ask Rivora questions are swept after 30 days. Settled notification delivery rows are swept after 7 days. Expired Telegram connection codes are swept after expiry. Email verification and password-reset links expire after one hour. An expired link is not a promise that every related database row is erased at that instant.

The code does not set a general automatic expiry for accounts, profiles, match history, inbox messages, career applications, sponsor enquiries or the organizer’s sponsorship contact list. They remain until removed through a supported action, account deletion or organizer handling. We do not promise a fixed backup or external-provider retention period here.

Deleting your account and data

Open Settings → Delete my account on the website or in the Android app. Sign in with a verified email and confirm within 15 minutes of signing in. Read the confirmation, type DELETE and explicitly accept forfeiting unpaid prizes. Your account is scheduled for deletion after 30 days. All sessions end immediately, alerts are disconnected and you cannot sign in to that account again. Upcoming participation is removed or disqualified as appropriate for the match stage.

After the 30-day wait, the scheduled cleanup erases account credentials, contact and payout details, photos and rank-proof uploads, name history, linked alerts, comments, survey answers and associated activity and help records. Enquiries, sponsorship contact records and career applications matching the account email, including stored resumes, are removed too. A failed file deletion is queued for retry. Published scores and leaderboard statistics remain under Deleted player with a new anonymous profile address; the database keeps a minimal anonymous reference to preserve match records. Recorded payment amounts and dates remain without the player’s transfer reference. Shared squad names and other people’s content can remain.

Unpaid prizes are forfeited when you confirm deletion; they are not marked as paid. Active bans survive deletion. We retain the ban period, violation, a mobile-number hash where available and a keyed email hash to enforce the ban on another account. The retained email match is removed after the ban ends or is lifted. Anonymised match records and active-ban identifiers have different purposes and are not treated as the same data.

The public Account deletion page provides the same web route and support contact without requiring the app. If you cannot access your account, or want help with other data, email support@rivoragaming.com. Do not email your password, room password or signing keys. Copies already delivered to external services, other players or published media may require separate removal requests.