Privacy Policy

EngageLeague ("we", "us", "our") operates the EngageLeague platform at engageleague.com. We are the data controller for the personal information you provide when using our services. For privacy-related queries, contact us at privacy@engageleague.com.

Account data: When you register, we collect your email address, your X (Twitter) account details (username, display name, profile picture, follower count), and for Engagers, your cryptocurrency wallet address.

Engagement data: We collect records of engagement actions (likes, retweets, replies, quotes) on leaderboard posts as reported by the X API. This includes your X user ID and the timestamps of actions.

Payment data: For Hosts purchasing credits, we collect cryptocurrency transaction details including wallet addresses and transaction hashes. We do not collect or store credit card numbers.

Usage data: We automatically collect information about how you use the Platform including pages visited, features used, IP address, browser type, device type, and timestamps.

Cookie data: We use cookies and similar technologies as described in our Cookie Policy.

Communications: If you contact us, we retain the content of your communications.

We use your personal data to:

• Provide, operate, and improve the Platform
• Verify your identity and prevent fraud and bot activity
• Calculate and display leaderboard scores and rankings
• Process payments and credit purchases
• Send transactional emails (OTP codes, account notifications)
• Respond to your support requests
• Comply with legal obligations
• Analyse usage patterns to improve our service (where you have consented)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the services you have signed up for
• Legitimate interests: Fraud prevention, security, and improving our services
• Consent: Analytics cookies and marketing communications (you may withdraw consent at any time)
• Legal obligation: Where we are required to process data by law

We do not sell your personal data. We share data only with:

• Supabase: Our database and authentication provider (data stored in EU/US regions)
• X (Twitter) / API: We read public engagement data via the X API on your behalf
• Cloudflare: Bot protection and content delivery; processes IP addresses and browser fingerprints
• Vercel: Hosting provider; processes request data for serving the application
• Law enforcement: Where required by valid legal process

Public leaderboard data (your X username, display name, profile picture, and score) is visible to anyone with the leaderboard link, as that is the core function of the service.

We retain your account data for as long as your account is active plus 12 months after deletion, to comply with legal obligations and resolve disputes. Engagement event data is retained for the duration of the associated leaderboard plus 24 months. Payment records are retained for 7 years as required by financial regulations. You may request deletion of your data subject to these retention requirements.

If you are located in the EEA or UK, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention requirements
• Restriction: Request that we limit processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@engageleague.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Your data may be processed in countries outside the EEA, including the United States. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or we rely on adequacy decisions.

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed credentials, row-level security on our database, and limited access controls. However, no system is completely secure and we cannot guarantee absolute security of your data.

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent banner on the Platform. The "last updated" date at the top of this page reflects the most recent revision.

For any privacy-related questions or to exercise your rights, contact our privacy team at privacy@engageleague.com.