PrizeRun Privacy Policy

1. Who we are

PrizeRun is operated by ALLYCHAT PTY LTD ACN 696 543 727, ABN 39 696 543 727. In this policy, PrizeRun, we, us and our refer to ALLYCHAT PTY LTD.

This policy explains how we collect, hold, use and disclose personal information through prizerun.vip, the PrizeRun game, player accounts, competitions, support and related services. We intend to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not a particular exemption would otherwise apply.

2. The short version

• We collect the information needed to run accounts, skill competitions, official runs, leaderboards, payments, verification, support and prize delivery.
• We collect detailed gameplay and technical records so official times can be verified and cheating or platform failures can be investigated.
• Paid Prize Competitions are limited to eligible people aged 18 years or older.
• We do not sell personal information.
• The live provisional leaderboard uses a chosen display name, not a legal name, and remains subject to verification.
• You can ask for access or correction and can make a privacy complaint.

3. Information we collect and hold

Account and profile information

This may include your chosen display name, legal name, email address, verified phone number, account identifiers, avatar, sign-in details, authentication and security events, account status and communication preferences.

Eligibility and prize information

For paid competitions and prize delivery, this may include your date of birth or confirmation that you are 18 or older, country, state or territory, residential address, location signals, identity and residency evidence, and delivery details. Paid Prize Competitions are available only to eligible people aged 18 years or older. We collect only the verification information reasonably needed for the relevant competition, legal requirement or prize.

Gameplay, competition and integrity information

This includes practice and official run records, inputs and gameplay events, start and finish times, recorded time, course and game-build identifiers, leaderboard position, run status, replay data, XP, run-credit history, device and browser information, network and latency data, IP address, approximate location, security signals, suspected tampering indicators and the outcome of any integrity review.

Payment and transaction information

This may include the Run Pack purchased, amount, date, currency, payment-provider reference, credits supplied or used, refund status and transaction history. Payment providers process card or wallet details. PrizeRun does not need to store a complete payment-card number or card security code.

Support and communications

We collect messages, attachments and records when you contact support, request a refund, report a security issue, make a complaint, enter a promotion, respond to a survey or communicate with us through email, the app or social media.

Website and app information

We may collect logs, pages or screens viewed, interactions, crash and diagnostic data, referral information, cookie or local-storage identifiers and information about the device, browser and operating system used. Necessary local storage may be used for sign-in, security, app state and preferences. Optional analytics or marketing technologies will be identified in a collection notice or consent choice before use.

We do not intentionally collect health information or other sensitive information unless it is reasonably necessary, lawful and collected with the required consent. If you request an accessibility adjustment, provide only the information needed to explain the adjustment.

4. How we collect information

We collect information directly from you when you create or update an account, play, buy a Run Pack, enter a competition, complete eligibility checks, claim a prize or contact us. We also collect information automatically from the device, browser, game client and PrizeRun servers when the Platform is used.

We may receive information from authentication, payment, identity or age-verification, fraud-prevention, hosting, delivery and support providers. We may also receive information from a parent or guardian, an authorised representative, a regulator or another person where authorised by law.

If you do not provide information required for an account, payment, eligibility check or prize delivery, we may be unable to provide that feature or accept an official competition entry. Free public practice may remain available where the game's classification permits.

5. Why we use personal information

We use personal information to:

• create, secure and administer accounts;
• provide practice and official runs and keep run-credit balances;
• calculate and display times, ranks, XP and results;
• test eligibility, age, residence and physical location where required;
• verify runs, detect cheating, investigate outages and protect competition integrity;
• process payments, refunds, receipts and transaction records;
• contact entrants and verify, announce and deliver prizes;
• answer questions, resolve complaints and provide accessibility support;
• prevent fraud, abuse, account compromise and security incidents;
• operate, debug and improve the Platform;
• comply with competition, consumer, privacy, tax, corporate, classification and other legal obligations; and
• send direct marketing where permitted and consented to, with an unsubscribe option.

We will not use personal information for a materially unrelated purpose unless you consent or the use is otherwise permitted or required by law.

6. Leaderboards, replays and winner publicity

During an Official Run Window, the live provisional leaderboard may show your chosen display name, avatar, recorded time, provisional rank, game or Course Build and a neutral verification status. Times and ranks may change when a new run is recorded or a result is held, corrected or removed through the review process. The leaderboard does not certify a final winner. Your legal name, date of birth, phone number, email and residential address are not intended for public leaderboard display.

Official-run replays and non-identifying run data may be published after the relevant run window closes to substantiate a result. General advertising using your legal name, image, voice, testimonial or prize-handover content requires separate consent. Refusing publicity consent does not affect prize eligibility.

7. Automated processing and human review

PrizeRun software calculates run times, checks game-build and input records, applies eligibility controls and flags unusual technical, location or integrity signals. These processes can affect whether a run is held for review, appears on a leaderboard or proceeds to winner verification.

PrizeRun will not finally disqualify an entrant or remove a prize entitlement solely because an automated signal was triggered. Material decisions receive human review, notice of the concern and a reasonable opportunity for the entrant to respond. We will update this policy before 10 December 2026 if additional automated-decision disclosures are required by amendments to Australian Privacy Principle 1.

8. Who we disclose information to

We may disclose information to service providers that help us operate PrizeRun, including:

• Supabase, for database, authentication, file storage and server functions;
• Netlify, for website and application hosting, delivery and security;
• payment and digital-wallet providers, including Stripe or Apple where used at checkout;
• identity, age, phone, residence, location, fraud and security-verification providers;
• email, communications, customer-support and analytics providers;
• prize suppliers, couriers and delivery partners;
• professional advisers, auditors, insurers and technical investigators; and
• courts, regulators, law-enforcement bodies and government agencies where required or authorised by law.

Providers may use personal information only for the services they provide to us or as otherwise disclosed under their own lawful role. We do not sell personal information or disclose it to data brokers.

9. Overseas storage and disclosure

Our primary application database, authentication and file storage are provided through Supabase, and our websites and applications are delivered through Netlify. These providers and their subprocessors may process information in Australia, the United States and other countries in which their infrastructure, security or support operations are located. Payment, identity, communications and delivery providers may also process information overseas.

Where Australian Privacy Principle 8 applies, we take reasonable steps to use providers with appropriate contractual, security and privacy protections. Overseas recipients may be subject to laws that differ from Australian law. Contact us if you want current information about the providers and countries relevant to your account or a particular competition.

10. Security and storage

We use access controls, row-level database protections, restricted administrative access, encryption in transit, logging, backups and security monitoring appropriate to the information and service. No online system is completely secure. You should protect your sign-in method and tell us promptly at security@prizerun.vip if you suspect unauthorised access.

We keep information only for as long as reasonably required for the purposes described above and applicable law. Account and gameplay records are kept while the account or competition is active. Competition, transaction, prize, dispute, security and audit records may be retained after closure where needed to establish results, meet tax or corporate recordkeeping duties, handle claims or demonstrate compliance. Information that is no longer required is deleted, de-identified or securely destroyed where lawful and practicable.

11. Access, correction and account closure

You can view and update some profile information in the app. You may ask for access to, or correction of, personal information we hold by emailing privacy@prizerun.vip. We may need to verify your identity before acting on a request.

We will respond within a reasonable period, usually within 30 days. If access or correction is refused, we will explain the reason and available complaint steps unless the law permits otherwise. You can also request account closure, subject to active competitions, prize claims, disputes and lawful retention requirements.

12. Privacy complaints

Send a privacy complaint to privacy@prizerun.vip with enough information for us to understand the issue. We will acknowledge a material complaint within 2 business days and aim to provide an outcome within 30 days. If more time is reasonably needed, we will tell you why and provide an update.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner. The OAIC may require you to complain to us first.

Lawful liability limits and the pre-action dispute process for contractual claims are set out in clauses 20 and 22 of the Terms. They do not prevent a privacy complaint to the OAIC, urgent relief or the exercise of a right that cannot lawfully be limited.

13. Direct marketing

Where permitted by law, we may use contact details to send PrizeRun news, competition announcements or offers. Marketing consent is separate from transactional messages. You can unsubscribe through the message or contact privacy@prizerun.vip. We may still send service, security, purchase, competition and prize messages that are necessary to administer your account or entry.

14. Children and young people

Paid Prize Competitions are available only to eligible people aged 18 years or older. A parent or guardian cannot enter or purchase a Run Pack for a person under 18. Where classification permits public practice without an account, PrizeRun limits collection to what is needed to provide and secure that mode and does not use a child's practice data for behavioural advertising or direct paid-competition marketing.

15. Changes and contact

We may update this policy when our services, providers or legal obligations change. We will publish the updated effective date and give additional notice where a change materially affects how existing personal information is handled.

Privacy contact: privacy@prizerun.vip Support: support@prizerun.vip Operator: ALLYCHAT PTY LTD ACN 696 543 727, ABN 39 696 543 727 Business location: NSW 2095, Australia

This policy was prepared with reference to the OAIC's Guide to developing an APP privacy policy and APP 1 guidance.