Legal

Privacy Policy

Version 1.0 · Effective October 12, 2026 · Operator: Big Poppa's House

You acknowledge this version when you submit the membership application; it works alongside our Terms and Conditions.

1. Who we are and what this covers

1.1 Our identity. Big Poppa's House operates bigpoppashouse.com. "We," "us" and "our" refer only to Big Poppa's House. This policy covers information handled through our website, membership applications, the member dashboard, game-login requests, loads and redemptions, Poppa Coins and rewards, support chat and staff communications.

1.2 Separate choices. Acknowledging this policy does not authorize every optional use of information. Terms acceptance, service messages and optional promotional messages are separate. Membership does not authorize a public member spotlight.

1.3 Personal information. Personal information identifies you or can reasonably be connected to you. A member ID, transaction reference or hashed identifier may remain personal information if it can be linked to a person.

2. Adults-only membership

2.1 Age requirement. Members must be at least 21. The site is not directed to anyone under 21, and we do not knowingly collect personal information from them. Do not register for an underage person, use another person's identity, or submit inaccurate age information.

2.2 Underage information. If we learn that we have collected information from someone under 21, we will stop the application or restrict the account and take steps to delete or de-identify the information, except for limited records lawfully needed for security, a transaction or another legal obligation. Report a concern to support@bigpoppashouse.com without attaching an ID document to ordinary email.

3. Information we collect, step by step

3.1 Application. First and last name as printed on your government-issued ID, date of birth, mobile number, email address, a password, an optional Facebook name and an optional referral code. We record that you accepted the Terms. Passwords are stored only as salted one-way hashes, never in plain text.

3.2 Sign-in codes. Signing in sends a one-time code to your phone (through a verification service) or email. Codes are stored hashed, expire quickly, are single-use and are attempt-limited; sends are throttled per number.

3.3 Identity verification. To confirm you are 21 or older and that the account is yours, we ask for a photo of your government-issued ID and a selfie, or send you to a hosted verification provider. Section 5 explains how those images are handled. We store the outcome, the reason category and the name and date of birth read from the document for comparison with your application.

3.4 Application review. Staff review applications using the information relevant to eligibility, verification and account security, and record their decisions. Every sensitive staff action is written to an append-only audit log.

3.5 Game-platform logins. After approval you can request a login for a game platform, or tell us the login you already hold. Issued usernames and passwords are stored in encrypted form so that we can show them to you in your dashboard; staff access to them is recorded in the audit log.

3.6 Payments and loads. We record load requests, amounts, payment references and statuses. Card payments are taken on a payment processor's own hosted checkout; we never see or store full card numbers. We keep a ledger of amounts and references to reconcile requests, payments, fulfillment, reversals and disputes.

3.7 Redemptions. When you redeem winnings we record the request, the amount, the payment method you chose and, where a method requires it, destination details such as a payout handle or QR image, which are stored encrypted. Staff may attach a receipt image to the record.

3.8 Poppa Coins and promotions. We record coins earned and spent, XP and level, referral codes and outcomes, promo codes issued, pick'em entries and promotion claims, all derived from recorded transactions.

3.9 Support conversations. Messages and pictures you send through support chat, and texts you send to our number, are stored on your record and relayed to our staff as described in Section 9. A capped number of recent messages is kept per member.

3.10 Technical records. We keep a request log (time, IP address, method, path, status and duration) for security and troubleshooting, session records for sign-in, and the device information a browser normally sends. Logs are rotated and capped in size. If you enable push notifications, we store the push subscription your browser issues.

3.11 Cookies and preferences. We set a session cookie for member sign-in and a separate one for staff sign-in. We do not use advertising cookies, third-party analytics or tracking scripts. Your browser's local storage may hold interface preferences such as a dismissed install banner, favourite games or a pending referral code.

4. How we use it

4.1 Membership and account services. To administer membership, check age and eligibility, review identity outcomes, prevent fraud and duplicate accounts, issue and secure game logins, process loads and redemptions, and keep one account per person.

4.2 Programs and communications. To run Poppa Coins, referrals, rewards and promotions under their published rules; to send sign-in codes, account-ready notices, order and redemption updates and support replies; and to send optional broadcasts only to members who have not opted out.

4.3 Security and accountability. For security monitoring, staff accountability, audit, legal compliance and the investigation of complaints, errors and disputes. These purposes do not give permission for unrelated advertising, unrestricted staff access, or merging your records with another arcade brand.

5. Identity documents

5.1 On our server. When you upload an ID photo and selfie to us, an AI service reads the name and date of birth off the document and our server compares them with your application; a pass requires both to agree. The images are encrypted at rest, are never served as ordinary web files, can be opened only by senior staff through a logged endpoint, and are deleted automatically a short time after the check is complete. Ask support for the current retention period.

5.2 Hosted provider. Where we use a hosted verification provider instead, it captures the ID, selfie and any liveness check in its own flow under its own privacy notice. We store its session reference, the outcome and a reason category, and re-check the surname, date of birth and 21+ rule on our side.

5.3 Questions. Contact support about an incorrect outcome, an expired session or a privacy request involving verification. We never tell a member which field failed a comparison, because that would tell an impostor what to change.

6. Who receives information

6.1 Hosting. Our hosting provider stores the server and its backups. Authorized staff access information appropriate to their roles, enforced by the server for every action.

6.2 Verification, payments and game operators. The AI or hosted verification service receives the document images needed for its check. Payment processors receive what they need to take your payment and return a status and reference. A game-platform operator receives only what is needed to create and manage your login and load it: typically a username, and your member reference where its system asks for one.

6.3 Messaging providers. A texting provider and a code-verification provider process your number and the message content. An email provider processes your address and service-message content. Push notifications go through your browser vendor's push service.

6.4 Staff channels. Operational alerts and support-chat relays reach our staff through a private Telegram group. These relays can include your name, member ID and phone number, and the message you sent, so that staff can act. Members never join that group.

6.5 Advisers and authorities. Professional advisers may receive information relevant to financial, legal, privacy or dispute matters. Authorities receive information when law requires disclosure.

6.6 No sale or advertising sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we do not provide personal information to third parties or affiliates for their marketing. We do not sell, rent or share mobile numbers, SMS opt-in records or messaging consent with third parties or affiliates for marketing or promotional purposes.

7. Cookies, browser storage and privacy signals

7.1 Sign-in cookies. The session cookies support sign-in and authenticated access. Blocking them signs you out. They are not used to track activity across unrelated websites.

7.2 No advertising tracking. We do not use advertising cookies, third-party analytics, tracking pixels or social-media plugins. Pages load their typefaces from Google Fonts, which receives your IP address and browser details as part of that request under Google's privacy policy.

7.3 Browser signals. We do not conduct sale or advertising sharing regardless of whether your browser sends Global Privacy Control or a Do Not Track signal. Where applicable law gives a browser signal a specific legal effect, we honor that requirement.

8. Texts, email, push and your choices

8.1 Service messages. Sign-in codes, account-ready notices, order and redemption updates and support replies are sent by text, email or push as you have requested or enabled. A support inquiry or sign-in request is not permission for recurring marketing.

8.2 Broadcasts. We may send members promotional broadcasts about specials and events. Reply STOP to any text to opt out of all texts; reply START to opt back in. You can switch push notifications off in your browser at any time, and ask support to stop promotional email. Opting out never affects balances, rewards or membership, and we never resume texting a number that has opted out without its renewed permission.

8.3 Frequency and rates. Message frequency varies with your activity. Message and data rates may apply.

8.4 Protecting sensitive information. Never send passwords, sign-in codes or ID documents to staff by text, email or chat. Enter a sign-in code only on the sign-in screen.

9. Support chat and staff channels

9.1 What staff see. Support chat is private between you and our staff. Each conversation is relayed to a private staff Telegram group, where staff reply; their replies come back to your chat. Texts you send to our number are bridged the same way, pictures included.

9.2 Spotlights. We do not publicly use your name, image or story without separate permission. Submitting a support message does not authorize us to turn it into a testimonial.

10. Security safeguards

10.1 Protected records. Identity images, issued game credentials, payout destination details and every stored integration secret are encrypted at rest under a key that is kept separately from the data. Passwords and one-time codes are stored hashed. Sensitive files are never served as ordinary web files.

10.2 Staff controls. Every staff action is authorized on the server by role, and sensitive actions are written to an append-only audit log. Nobody can grant themselves a higher role. Append-only means history is kept by adding records rather than replacing earlier events; it does not mean records are retained forever or exempt from applicable privacy rights.

10.3 Backups. Encrypted backups are kept on the server, copied off-site and snapshotted by the hosting provider. Deletion from active records may not immediately erase a backup copy; restored backups must not be used to undo a deletion or an opt-out.

10.4 No absolute guarantee. No system is perfectly secure. We do not claim a security certification. Report suspected unauthorized access promptly, and use only the designated channels when submitting sensitive information.

11. Retention

11.1 Short-lived records. Used sign-in codes expire within minutes and are discarded. Identity images are deleted automatically once the check is complete (Section 5). Request logs rotate and are capped in size. Support chat keeps a capped number of recent messages per member.

11.2 Evidence records. Audit logs, the ledger of payments, loads and redemptions, promo codes, consent and opt-out evidence and staff decisions are retained for up to seven years to support financial records, legal obligations, dispute resolution and consent evidence. They are not ordinarily deleted merely on request.

11.3 Other records. For records without a fixed period above, retention is limited by the purpose: administering an active account, completing pending activity, providing support, maintaining a requested hold, resolving disputes and meeting legal obligations.

11.4 Legal holds. Relevant records under a legal hold are retained until the hold is lifted, including beyond routine periods where necessary.

12. Deletion

12.1 Requests. Ask for deletion through support chat or support@bigpoppashouse.com. We verify authority before acting but will not ask you to send passwords, codes or ID documents in ordinary email or text. Deletion of a member account is a deliberate staff action reviewed by the owner.

12.2 What is removed. On an approved request we remove your profile details, contact details, game logins held for you and support conversations, and revoke your sessions. Your member ID and the ledger entries, audit events and consent records linked to it remain for their retention periods in Section 11, because they are the arcade's record of money and decisions.

12.3 Blocked deletion. Deletion is paused, with an explanation, while a legal hold is active, a payment is open or disputed, or a load or redemption is pending. That does not create a blanket exemption from privacy law: we assess deletion of unaffected information and comply with any mandatory obligation.

12.4 Continuing rights. A deletion block does not cancel a text opt-out or prevent a correction request.

13. Access, correction and consent withdrawal

13.1 How to ask. Email support@bigpoppashouse.com or use support chat to request access, correction, deletion or withdrawal of consent. You can correct your own contact details in your dashboard; identity fields lock once your ID has been verified and are corrected through support.

13.2 Verification. We use reasonable, proportionate verification before disclosing private information or changing an account, and we protect other people's information and credentials when providing records.

13.3 Effects of withdrawal. Withdrawing optional messaging consent does not affect membership, balances or rewards. Withdrawing information necessary to complete a requested service may prevent that service from being completed, and we will explain the effect.

14. California and other US state privacy rights

14.1 Applicable protections. Residents of California and other US states with comprehensive privacy laws may have additional rights where those laws cover our processing. We honor applicable rights without requiring a resident's state to appear on a fixed list here.

14.2 Know, access and portability. Where applicable, you may ask whether we process your information, learn the categories and specific information held, the sources, purposes and recipients, and obtain a portable copy. Sections 3 through 6 describe our collection and disclosures.

14.3 Correction and deletion. You may request correction of inaccurate information and deletion subject to applicable exceptions, which we assess case by case rather than by blanket policy.

14.4 Opt-outs and sensitive information. We do not sell personal information or share it for cross-context behavioral advertising. You may contact support to exercise another applicable right or to request human review of an account or verification decision.

14.5 Fair treatment and appeals. We do not discriminate against you for exercising privacy rights. Send a state-privacy request or appeal to support@bigpoppashouse.com and identify your state of residence. You may complain to your state attorney general or other relevant regulator without waiting for our internal process.

15. Third-party services

15.1 Independent notices. Identity-verification services, game-platform operators, payment processors and messaging providers have their own privacy notices covering their services. Ask support for the identity of the provider involved in your account and where to find its notice; you do not need to provide ID documents or credentials to ask.

15.2 Locations. Providers may process information in the United States or elsewhere depending on their service arrangements. We do not promise that data never leaves the United States.

16. Changes to this policy

We identify the current version and effective date at the top of this policy. Material changes are notified by email or a prominent dashboard notice. Publishing a revision does not retroactively create consent or convert a service-message request into marketing permission.

17. Response times and complaints

We aim to acknowledge privacy requests and complaints within five business days of receipt and provide a substantive response or progress update within 15 business days. Opt-outs are handled promptly and within the applicable legal timeframe, not on this schedule. You may request escalation and may contact a regulator at any time.

18. Contact

Big Poppa's House · Website: bigpoppashouse.com · Support: support@bigpoppashouse.com or support chat from your dashboard. Contact support to request a mailing address for privacy correspondence; you may submit a request immediately by email or chat without waiting for one.

Related: Terms and Conditions · Play Responsibly