Privacy Policy

This Privacy Policy explains how Don't Press The Button (“Operator”, “we”) processes personal data when you use DON'T PRESS THE BUTTON (the “Service”). For users in India, this notice is intended to align with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable IT rules. For users elsewhere, we apply equivalent transparency principles; GDPR/other rights may apply depending on your location.

1. Data we collect

• Account data: email, username, password hash (Argon2id; we never store plaintext passwords), role, terms/age acceptance timestamps.
• Payment data: amount, currency, status, Dodo Payments checkout session/payment IDs, and limited metadata. Card credentials are processed by Dodo Payments — we do not store full card numbers or CVVs.
• Gameplay records: takeovers, ownership durations, promotional URL/pitch you choose to publish, referral codes and unique visitor counts.
• Technical data: IP address (often hashed for referrals), user-agent hashes, cookies for session/visitor uniqueness, presence heartbeats for live viewer counts, approximate region headers for geo-restriction.
• Support communications: emails you send us.

2. Purposes and legal bases

We process data to:

• Provide the Service and fulfil paid digital status transactions;
• Prevent fraud, abuse, multi-accounting, and payment disputes;
• Comply with law, tax, accounting, and payment-partner requirements;
• Operate live presence and activity feeds;
• Respond to support and grievance requests;
• Improve reliability and security (aggregated analytics where enabled).

Under the DPDP Act, we process personal data for the purposes above based on your consent (e.g., account creation, optional promo content) and/or for legitimate uses necessary to provide the Service you request and to meet legal obligations.

3. Sharing

We share data with:

• Dodo Payments — payment processing (see their privacy policy);
• Hosting, database, Redis, and email infrastructure providers under contract;
• Professional advisors and authorities when required by law;
• The public Service surfaces (username, ownership status, optional promo URL/pitch while you hold or as shown on public profiles you create).

We do not sell personal data.

4. Cookies and similar tech

We use first-party cookies/session identifiers for authentication, visitor uniqueness for referrals, and security. Disabling cookies may break login or referral attribution.

5. Retention

Account and gameplay data are kept while your account is active and for a reasonable period after deletion requests. Payment and accounting records are retained as required by Indian tax/accounting law and payment partner rules (often several years), even after account deletion of non-financial profile data.

6. Your rights

Subject to law, you may request access, correction, or erasure of personal data, withdraw consent where processing is consent-based, and raise a grievance. Contact pdarshan888@gmail.com. We will respond within timelines required by applicable law (DPDP grievance redressal practices apply for India).

You may also contact your local data protection authority where available. Erasure may be limited where we must keep records for fraud prevention, disputes, or legal compliance.

7. International transfers

Infrastructure or subprocessors may process data outside your country. We use contractual and organisational safeguards appropriate to the destination.

8. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children under that age.

9. Security

We use industry-standard measures (hashed passwords, HTTPS, signed webhooks, rate limits). No method of transmission is 100% secure.

10. Contact / Data Fiduciary

Related: Terms · Contact