01Purpose and scope
This Privacy Policy explains how Rewardspace handles information when you visit this website, register an account, sign in, and use its game challenge and wallet features. It covers account services and the development of real-money gaming challenges. USDC deposits on Solana can be enabled by the operator. Withdrawals and paid entry are not yet available.
Rewardspace is the project name used in this policy. Its legal entity, country of establishment, and privacy contact address have not yet been confirmed. Hosting, legal responsibilities, and contact details must be confirmed before paid services open.
02Key definitions
Personal information is information that identifies you or can be linked to you. Processing includes collecting, saving, using, sharing, or deleting that information. In this policy, “we” means Rewardspace and “you” means a visitor or registered user.
A session is a temporary authorization to access your account after signing in. Account data is stored in a database managed by Rewardspace. You can optionally connect a League of Legends account through Riot Sign On when the integration is enabled. Riot handles your game-account sign-in; Rewardspace does not receive your Riot password.
03Information we use
Registration collects your email address, password, and display name, along with confirmation that you are 18 or older and have read this policy. The server stores a normalized email address, a salted password hash, your display name, player tag, and account creation time. It does not store your original password.
Account records include wallet and challenge fields and request identifiers used to prevent duplicate operations. Older development records are retained separately from what is shown as available funds and live activity. Session records contain a hash of the session token and its expiration time. Authentication attempt counters use a hashed identifier to limit repeated attempts. Deposit records include your account ID, requested amount, receiving wallet, unique payment reference, transaction signature, verification results, and timestamps. Confirmed credits are stored in an immutable cash ledger. Connected game records include your publisher account identifier, display name, region, encrypted authorization and refresh tokens, ranked standings, recent match IDs, match statistics, results, and synchronization timestamps. No identity document, Riot password, wallet private key, or recovery phrase is requested.
04Your choices and control
You can edit your player tag in Player profile, review wallet information in Wallet, and inspect your latest challenges in Activity. Signing out revokes your current session. Clearing browser data removes the cookie but does not delete account records from the database.
Account deletion, email changes, data export for individual users, and email password recovery do not yet have self-service screens. The operator can manage the database and its backups. An operational privacy contact remains pending. Rights such as access, correction, deletion, and portability depend on applicable law; the responsible entity and jurisdiction still need to be confirmed.
05How information is used
Your email and password hash allow the server to verify sign-in details. Your session determines which account can read or modify a profile, balance, or challenge. Game and wallet records let the application keep account information consistent and avoid duplicate operations. Deposit information is used to match finalized blockchain transfers to accounts, prevent duplicate credits, and investigate transfers that need review. Connected game data is used to verify account ownership, show ranked and ARAM match history and live-game status, and check configured challenge objectives. Paid entry and financial settlement are not yet available.
Authentication attempt counters help limit repeated sign-in attempts. Information is not used for advertising or marketing. Before public operation or new processing such as payments or identity verification, Rewardspace must specify the relevant legal bases and any required choices or consent.
06Protecting your information
Passwords are hashed with scrypt and a random salt. Session cookies are HttpOnly and SameSite=Lax; their Secure flag is enabled when the server is accessed over HTTPS. The application checks the authenticated account and request origin before accepting changes. Game authorization tokens and provider secrets are encrypted at rest with a server-managed key. HTTP connections are not encrypted in transit.
Database files and administrative exports are held by the server operator. Password hashing does not encrypt the entire database. Anyone with sufficient access to the server computer or its backups could read account records. Protect that computer and its backups, and sign out on shared devices. No website or storage method can guarantee complete security.
07Storage and retention
Account, challenge, wallet, and duplicate-request records remain in the database until the operator removes them. There is no automatic deletion schedule for these records. Historical development balances and challenges are not presented as cash or verified match activity. Administrative backups and exports can contain account data and password hashes and must be managed separately.
Sessions expire after seven days and are revoked when you sign out. Expired session records are cleaned when new sessions are created. Authentication counters have a 15-minute window and expired counters are cleaned during subsequent authentication attempts. Ordinary server logs are separate from the database; a production logging and retention policy has not been established.
09Cookies and browser storage
The application sets the necessary rewardspace_session cookie after sign-in or registration. It contains a random session token, is not accessible to JavaScript, and is sent with requests to this server. The database stores a hash of the token. The app includes no analytics trackers or advertising cookies. A separate rewardspace-language preference cookie remembers your chosen language for up to one year.
Account information is stored on the server. Earlier versions may have left data in your browser; those entries are ignored by the current account system and can be cleared through browser settings. Blocking cookies prevents account sign-in; browsing the landing page does not require an account.
10Updates to this policy
This policy may change as Rewardspace develops. The date at the top identifies the latest revision. Changes to hosting, database providers, payment services, game integrations, or account information should be reflected here before those features are introduced.
11Contact
Rewardspace is the name of this project. The following details are still pending and will be added when confirmed.
- Name
- Rewardspace
- Legal entity and country
- To be confirmed
- Privacy contact email
- To be confirmed