Draft for legal review. Text in [brackets] must be completed, and a lawyer should review these terms before LevelUp takes real payments.

Privacy Policy

Last updated: 2 October 2026

1. Who is responsible

[Company legal name], [registered address], is responsible for your personal data on LevelUp. Contact us through our Support page (choose "My account or privacy"). [If you have no office in the EU or UK: name your EU/UK representative here.]

2. What we collect

• Account: name, email, a securely hashed password, country, whether you play or coach, and when you accepted our terms.
• Discord (if you use it): your Discord ID, username and email, if Discord has verified it.
• Contact details you choose to add: WhatsApp number, Discord, Instagram, Facebook.
• Bookings and payments: sessions, prices, currencies, statuses and reviews.
• Chat messages between you and the other person on a booking.
• Support messages you send us: your name, email, the message, and our reply. Kept for up to a year after we close them, and deleted with your account.
• Coaches: skill check ranks and proof links, and the details Stripe needs for payouts.
• Bank details (coaches in countries Stripe cannot pay out to, such as Mongolia): the bank, account holder name and account number you give us so we can send your earnings by bank transfer, and a record of each transfer. They are stored encrypted, never shown on your profile, and only our payments team can open them, when sending a payout; each look is logged. They are erased when you delete your account, but the record of transfers stays, as tax and accounting laws require.
• Safety: reports you make or receive, and people you block.
• Account marketplace (where available): account listings, deals, and the login details a seller sends a buyer. Login details are stored encrypted, shown only to the buyer, and deleted when the deal ends.
• Email and phone verification (only if you use it): a phone number you add, whether your email and phone are verified, whether two-step login and email notifications are on, and short-lived one-time codes (kept only as an unreadable hash, and removed after use or within a day).
• ID check: whether you passed, when, and the reference of the check. Your document, photos and date of birth are taken and held by our identity partner, Stripe, under its own privacy policy, and we never receive or store them. If the check shows you are under 18, we keep only that your account was closed.
• Juniors (only if a parent or guardian adds one): a first name or nickname and a year of birth, and which sessions they were booked for.
• Passkeys (only if you add one): the public key and an identifier for each passkey, a name you choose, and when you added and last used it. The private key stays on your device and we can't see your fingerprint, face or screen lock.
• Notifications (only if you turn them on): a push address or token for each browser or phone, so we can send notifications to it.
• Your country, from your network: when you open LevelUp, the hosting network tells our server which country your connection comes from, and we use it only to pick the starting currency. We don't store it or look it up with anyone else. You can change the currency at any time.
• Technical: your login token and preferences (such as currency) stored in your browser, a short-lived cookie during Discord login, and server logs such as IP address and request times.

Your payment details stay private

• Card numbers, PayPal logins and bank details are entered only on our payment provider's secure pages. LevelUp never receives, sees or stores them.
• We keep only the provider's reference numbers we need to refund you or pay a coach. They are never shown to other users.
• Coaches' identity and bank checks are done by the payment provider. We only learn whether payouts are enabled.
• Other people on LevelUp never see how you paid.

Notifications

• Notifications are off until you turn them on, separately for each browser or phone, and you can turn them off at any time in your profile or your device settings.
• They only say what happened, such as "New message about your Valorant session". They never contain message text, names, amounts, contact details or payment details, because they can show on a locked screen.
• They are delivered by your device's push service: Apple for iPhones and Safari, Google for Android and Chrome, Mozilla for Firefox, Microsoft for Edge on Windows. Browser notifications are encrypted so only your browser can read them.
• We delete a device's push token when you turn notifications off, log out, or delete your account, or when the push service tells us the device is gone.

Email, text messages and codes

• We send a one-time code by email or text message when you verify your email or phone number, or log in with two-step login. A code works once and expires after 10 minutes.
• We email you about bookings, messages and payments only if you have verified your email and kept email notifications on. Every email has a link to stop them with one click, and you can change this in Settings. These emails say what happened, never message text, names or amounts.
• We use your phone number only to send verification and login codes, never for marketing, and we never share it with other users. Message and data rates may apply. Remove your number in Settings at any time, or delete your account and it is erased.
• Emails and text messages are delivered by our email and SMS providers Resend (email) and Twilio (text messages), which see your address or number and the message.

3. Why we use it

• To run your account and bookings, take payments and pay coaches (to perform our contract with you).
• To keep LevelUp safe: filtering chat, reviewing reports, preventing fraud and enforcing our terms (our legitimate interests).
• To keep records the law requires, such as tax and accounting records (legal obligation).
• To share your optional contact details with the other person on an accepted booking (your choice, which you can change at any time).

We don't sell your personal data, and we don't use it for advertising.

4. Who sees it

• The other person on a booking: your name, messages and reviews, and your contact details only after the coach accepts.
• Everyone: a coach's name, country, sessions, ratings and badges. Contact details are never public.
• Service providers that work for us: Stripe (payments), Discord (if you log in with it), push services that deliver notifications you turned on (Apple, Google, Mozilla, Microsoft), the providers that send our emails and text messages (Resend and Twilio), and our hosting provider (Render).
• Authorities, when the law requires it, such as tax reporting of coach earnings.

5. International transfers

LevelUp is used worldwide, so your data may be processed outside your country. Where the law requires it, we use safeguards such as the European Commission's standard contractual clauses. [Lawyer: confirm for each launch country.]

6. How long we keep it

• Your account data: until you delete your account.
• Booking and payment records: for as long as tax and accounting laws require, usually up to 7 years, with your name and contact details removed once your account is deleted.
• If we suspend or close an account for serious conduct, or because someone is under 18, we keep a one-way hash of its email address (it can't be turned back into the address) so the same person can't open a new account straight away. It is removed if the account is restored. [Lawyer: confirm the legal basis and retention period for each launch country.]
• Chat messages and reports: kept with the booking record so disputes and safety issues can be reviewed, for as long as that record is kept.
• Game account login details from the account marketplace: deleted as soon as the deal completes or is refunded.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, and object to or restrict how we use it. You can delete your account yourself from your profile in the app. For anything else, write to us through our Support page (choose "My account or privacy"). You can also complain to your local data protection authority.

Delete your account and data

You can delete your LevelUp account at any time, without contacting us:

1. Log in at LevelUp (website or app).
2. Open your profile (tap your name at the top) and go to Delete account.
3. Enter your password (or type DELETE if you signed up with Discord) and confirm.

• Erased straight away: your name, email, password, country, contact details (WhatsApp, Discord, Instagram, Facebook), linked Discord account, skill check submissions, notification devices and the people you blocked. Your sessions and listings are taken down and you are logged out everywhere.
• Kept, anonymised: records of past bookings and their chat, shown as "Deleted user", because tax, accounting and consumer laws require us to keep them. See "How long we keep it".
• Not possible yet: if you have active bookings or open account deals, finish or cancel them first, so nobody's money is left on hold.

If you can't log in, first try Forgot password on the login page. If that doesn't work, write to us through our Support page from the email address on your account, and we'll confirm it's you by replying to that address before we delete it.

8. Children

LevelUp is only for people aged 18 and over, and we check a government ID to confirm it. If we learn that an account belongs to someone under 18, we close it. The only exception is a young player aged 12 to 17 who is added and booked by their verified parent or legal guardian, who is present for every session. For these juniors we keep only a first name or nickname and a year of birth, which the guardian can remove at any time. We do not allow anyone under 12.

9. Cookies and similar storage

We only use storage that LevelUp needs to work: your login and preferences in your browser (including your chosen language and currency, and whether notifications are on), and a short-lived cookie that keeps a Discord login secure. We don't use advertising or tracking cookies. See Cookies and storage for the full list.

10. Security

Passwords are hashed, payments are handled by Stripe, and access to your data is limited to what is needed. No system is perfectly secure. If a breach puts you at risk, we'll tell you and the authorities as the law requires.

11. Changes

We'll update this policy when our practices change, and tell you about important changes before they take effect.