Privacy Policy

Who we are

Chow Social is operated by [legal entity name], [address], Indonesia. For any privacy question or request, contact [privacy@domain].

What we collect

• Identity & account: your Google name, email, and profile photo (via sign-in); a username you choose; an optional phone number and photo.
• Activity: bookings and holds, payment claims and the payment-proof image you upload, game sessions and hands, your point deltas and season standings, waitlist entries, reviews you write, and reports you submit or that name you.
• Check-in & device: when staff scan your rotating QR to seat you, we log the check-in, the scanning staff account, and a device identifier (a fraud-prevention audit log). Your QR is a short-lived signed token, not a permanent identifier.
• Technical: IP address, timestamps, and application logs needed to run and secure the service.

How we use it

To run the service (book, seat, score, leaderboards); to verify reviews and route reports; to prevent and investigate fraud and abuse; and to meet legal obligations. Our legal bases are your consent (recorded at sign-up) and performance of the service you request.

Public information

Your username and your ranked points and hands appear on public leaderboards, and your username, rating, and review text appear on a venue's public reviews. Your profile photo is public only if you choose to show it. Please note: floor staff can always see your profile photo during a check-in scan, for identity verification, even when you have hidden it from public view. We never publish your email, phone, per-hand results against named opponents, or financial data.

Payment proofs and images

Payment-proof images are stored privately and are readable only by you and the authorized staff of the venue you paid, through short-lived signed links. Uploaded images are re-encoded and stripped of embedded location/EXIF metadata.

Who we share with

We do not sell your personal data and we do not use it for third-party advertising.

• Venues you play at receive the booking, check-in, and score data for your play at that venue. A venue never sees a report filed against one of its own staff.
• Service providers who process data on our behalf under contract: Supabase (database and authentication) and Cloudflare (hosting and image storage).
• Authorities, where required by law.

Where your data is processed

Your data is processed and stored on our processors' infrastructure in Singapore (Supabase, Singapore region) and delivered through Cloudflare's global network. By using Chow Social you consent to this cross-border processing and storage outside Indonesia.

Retention, deletion, and anonymization

We keep your data while your account is active. Game events (hands, scores) are part of the community's competitive record and are conserved for integrity (points sum to zero across a season). When you ask us to delete your account, we anonymize you: we scrub your profile (name, email, phone, photo, username) so you are no longer identifiable, while the de-identified game events survive so the historical record stays consistent. This satisfies the PDP right to erasure through anonymization. Anonymization is permanent: an anonymized account cannot be restored, and to preserve the integrity of the community record, re-registering with the same identity may be restricted.

Your rights (UU PDP)

You may request access, correction, deletion/anonymization, and withdrawal of consent. To exercise any of these, email [privacy@domain]; we will respond within the period required by law.

Security

We use reasonable technical and organizational measures to protect your personal data, including access controls and encryption in transit.

Children

Chow Social is for adults (18+), consistent with venue policies.

Changes

We version this policy. If we make a material change, we will ask you to review and re-accept before you continue using the service.

Contact

[privacy@domain] · [legal entity name], [address], Indonesia.