ELO RATED Privacy Policy

Effective date: October 13, 2026

Last updated: October 13, 2026

This Privacy Policy explains how ELO RATED collects, uses, shares, keeps and protects personal information when you use the ELO RATED mobile app, the ELO RATED web app and website, and related services (together, the "Service"). Please read it together with our Terms of Service at https://elorated.com/terms, which contain the licence you give us for your content and the limits on our liability.

This Privacy Policy explains our practices; it is not a contract and does not create rights or obligations beyond those provided by applicable privacy law.

The short version

• Adults only. ELO RATED is only for people who are 18 or older, and at least the age of majority where you live (for example, 19 in British Columbia, New Brunswick, Nova Scotia, Newfoundland and Labrador and the three territories). If we learn that someone under that age has an account, we deactivate it and delete their information after notice, except shared match records, which are de-identified (see sections 12 and 19).
• Much of your profile is public by design. ELO RATED is a ranked competition platform. Your display name, photo or avatar, gym, weight, gender, Elo rating, rank, record and leaderboard placement are visible to other users, and some of it (such as your profile photo and the information on your invite links) can be seen by anyone who has the link. We do not display your date of birth on your profile.
• Match video and AI. If you, your opponent or a timekeeper records a match, the video (with audio) is uploaded, processed and analyzed by artificial intelligence (AI) to find key moments, describe techniques, make highlight reels and tell the athletes apart. AI is also used to create a cartoon-style avatar that resembles you. We do not create, store or keep facial recognition templates, faceprints or other biometric identifiers, and we do not use facial recognition to identify people by comparing them against a database of faces. Our AI providers do look at photos, still frames and footage showing your face and body, to tell the athletes apart and to draw avatars.
• Promotion and AI training, with an opt-out. We may post match reels featuring you on our own social media accounts (for example, Instagram) and may use match footage to improve and train our own features. You can opt out of either, and ask us to take down a specific post, by emailing info@elorated.com (or in the app's settings where available).
• Location. With your permission, the app uses your precise location while the app is in use (never in the background) to confirm that you and your opponent are on the same mat and to show nearby athletes. Precise coordinates are scrubbed within a few minutes, or within about 4 hours for a go-live tag; a rounded, approximate location (about 110 metres) is kept longer for ranking integrity and fraud prevention. The app does not show your coordinates to other users.
• No ads, no sale. We do not sell your personal information, we do not share it for targeted or cross-context behavioural advertising, we do not show ads, and we do not use advertising IDs or track you across other companies' apps and websites.
• Where your data lives. We store your data primarily in Canada (Montreal). Some service providers, including our AI, crash-reporting, push-notification and web-hosting providers, process data in the United States and elsewhere.
• Deleting your account. You can delete your account in the app (Settings > Delete account) or by email. Your profile and personal-only data are erased. Match results, rating history and match videos are shared records with your opponents, so they stay attached to a de-identified "Deleted athlete" record. You can email us to ask for specific footage to be removed.
• Questions or requests: email our Privacy Officer at info@elorated.com.

1. Who we are and who is responsible

The Service is operated by ELO RATED ("ELO RATED", "EloRated", "we", "us" or "our"), a business carried on by its owners in Toronto, Ontario, Canada. ELO RATED is responsible for the personal information under its control.

Privacy Officer. We have designated a person responsible for our compliance with privacy law, including PIPEDA and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25). You can reach our Privacy Officer at info@elorated.com. A mailing address is available on request at that email address.

2. Scope of this policy

This policy applies to personal information we handle through:

• the ELO RATED mobile app for iOS and Android;
• the ELO RATED website and web app at elorated.com, including invite link pages;
• our communications with you (for example, support emails and push notifications); and
• our use of match footage, reels, names, likenesses and ratings on our own social media accounts.

It does not apply to third-party websites, apps or platforms (such as Instagram, WhatsApp, Google or your gym's own systems), even if you reach them from the Service. Their own privacy policies apply (see section 20).

3. Information we collect

We collect personal information in four ways: information you give us, information created when you and other users use the Service (including information other users provide about you), information collected automatically from your device, and information from sign-in services you choose and other sources.

3.1 Information you give us

• Account information: your email address and password. Passwords are handled by our authentication provider and stored only in hashed form; we cannot see them. If you sign in with Google, see section 3.4.
• Profile information: first name, last name, display name (unique and public), date of birth, gender (used for competition divisions and brackets), current weight, city, primary gym (or "free agent"), optional Instagram handle, and an optional profile photo. A still frame from a match video may also be used as your profile image (see section 4).
• Photos you provide: a profile photo you take or choose from your photo library. We only access the photos you select.
• Disputes and reports: the free text you write when you dispute a match result, report an issue, or contact us.
• Feedback: feedback you send through the app (including the shake-to-report or "Report a bug" form, which can include your name, email, a description and a screenshot you choose to attach), feedback on highlight reels, and emails you send us.
• Messages: where messaging is available to you, the messages and images you send.

3.2 Information created when you use the Service (including information about you from other users)

Because ELO RATED is a two-person competition platform, some information about you is created by you, some by your opponent or a timekeeper, and some by the Service:

• Match records: challenges and invites, matches, results, submissions and methods, confirmations, disputes, your practice match, and match timing.
• Ratings: your Elo rating, rating history, rank, record and statistics, calculated automatically from your results (see section 15).
• Weight checks: at the face-off, your opponent may confirm or flag the weight they observe for you. Those checks and flags are recorded with the match.
• Match video and audio: recordings of matches you take part in, captured by you, your opponent or a timekeeper, including audio. A participant who records does not need your separate approval in the app, although you will see a "RECORDING" indicator. See section 4.
• Derived content: processed copies of videos, still frames, highlight reels (which can include names and ratings), and AI analysis (scoring moments, techniques, and coaching notes attributed to each athlete). Highlight reels made for your opponent can also show you.
• AI avatar: a stylized, cartoon-like avatar generated to resemble you.
• Social activity: invites you send and claim, how you shared them (for example, the share channel you picked, such as WhatsApp), friendships (joining through someone's invite makes you friends), going live in the Arena, and when you share a reel (for example, to Instagram or the share sheet).
• Integrity and moderation information: dispute history, flags, and notes our administrators create when reviewing disputes, possible abuse or repeated disputes.

3.3 Information collected automatically

• Location: precise location from your device, only while you are using the app and only with your permission. See section 5.
• Device and app information: push notification token, device operating system and model, app version, and a general device memory class (used to choose a suitable video quality).
• Diagnostics and performance: crash reports, error reports and performance traces collected through our crash-reporting provider (Sentry). These reports are linked to your account (your user ID, email address and username, and your IP address where collected) so we can fix problems you run into, and an error report may include a screenshot of the screen you were on when the error happened. We also record reliability events, such as whether a video upload or playback succeeded; these carry only your user ID.
• Technical logs: our hosting and infrastructure providers automatically log technical information such as IP address, request times and errors, for security and operations.
• Web cookies: see section 17.

We do not use advertising SDKs, advertising identifiers (such as Apple's IDFA or Google's advertising ID), marketing or advertising analytics, or cross-app tracking.

3.4 Information from sign-in services you choose and other sources

• Sign-in services you choose: if you choose to sign in with Google, Google shares your name, email address and a unique account identifier with us (and may share your profile picture). We do not receive your Google password. If we add other sign-in options (such as Sign in with Apple), the same principle will apply.
• Other users: as described in section 3.2 (match results, confirmations, disputes, weight checks, footage, and invites).
• Service providers: for example, the results of AI analysis that our AI providers return to us.

3.5 Summary table

4. Match video, AI analysis and your likeness

4.1 Recording

Recording is chosen per device at the face-off. Any participant in a match (you, your opponent, or a timekeeper who joins with the match code) may record it. Your opponent cannot veto a recording, and you cannot veto theirs, but the app shows "RECORDING" so both athletes know. Recordings include audio. Anyone who records is responsible for having the consent of everyone recorded and the permission of the gym, and must not record bystanders who have not agreed (see the Terms of Service).

4.2 Processing and AI analysis

Uploaded videos are stored and processed on our infrastructure in Canada (for example, to create playable copies, still frames and highlight reels). We use two AI providers:

• Google (Gemini API) receives match video, still frames, and the athletes' display names, ratings and weight divisions. We use it to identify scoring moments, techniques and positions, write coaching notes attributed to each athlete, select highlights, and tell the two athletes apart in the footage (for example, by comparing still frames of each athlete with the video) so that analysis and highlights are attributed to the right person. Gemini is also used as a fallback to generate avatars; in that case it receives match footage, which can also show your opponent.
• OpenAI receives your profile photo or still frames of you, and is used only to generate your stylized avatar (for example, reflecting your face shape, hairstyle and skin tone).

AI output can be wrong. It is informational only and is not medical, coaching or safety advice. We may hide some AI output from users while we improve its accuracy, and our administrators may review it.

4.3 Your face and biometrics

We do not create, store or keep facial recognition templates, faceprints or other biometric identifiers, and we do not use facial recognition to identify people by comparing them against a database of faces. However, to be clear about what does happen: our AI providers look at photos, still frames and footage showing your face and body in order to tell the two known participants in a match apart and to draw your avatar. If you do not want an AI avatar generated from your photo or footage, email info@elorated.com (or use the app's settings where available) and we will stop generating one and remove the existing avatar.

4.4 Who can see match video

In the app, the match film (the recorded video) is available to the match participants and to the timekeeper for that match, and to our authorized administrators. Highlight reels are made for and shown to the athletes in the match, not to the timekeeper. Participants may save, download or share videos and reels outside the Service (for example, to their photo library, Instagram or messaging apps). Once someone shares a video outside the Service, its handling is controlled by them and by the platform they used, not by us.

4.5 Promotional and social media use (opt-out)

As described in our Terms of Service, we may edit and publicly post match footage, highlight reels, names, likenesses and ratings to operate and promote ELO RATED, including on our own social media accounts (for example, Instagram). This can include footage that someone else recorded of you.

• Opt out: you can opt out of promotional and social use at any time by emailing info@elorated.com (or in the app's settings where available). The opt-out applies going forward.
• Takedown: you can ask us to remove a specific post that features you. We act on requests within a reasonable time and aim to do so within a few business days.
• When content is posted on a third-party platform, that platform's own policies apply, and other people may have viewed, saved or re-shared it before removal. We cannot control or recall copies made by others.

4.6 Product improvement and AI training (opt-out)

We may use match video, still frames and AI analysis to improve, test and train our own features and models (for example, to improve technique detection or athlete attribution). We do not sell footage, and we do not license it to third parties to train their own general-purpose AI models.

For this purpose, original footage may be kept in long-term archival storage until you ask us to delete it or it is no longer needed. You can opt out of training use by emailing info@elorated.com (or in the app's settings where available); we will then exclude footage in which you appear from future training use.

5. Location

5.1 When and why we use location

With your permission, the app uses your device's precise location only while the app is open and in use (foreground). We never collect location in the background. We use it:

• when you go live in the Arena, to show you to nearby athletes (for example, "on the mat" or "online and close", within about 2 km) and to show nearby athletes to you;
• when you book or claim an invite; and
• at the face-off, to confirm that you and your opponent are on the same mat before a ranked match starts.

Other users can see that you are nearby or on the mat. The app does not show your coordinates to other users; at most, an athlete you are matched or booked with may receive the result of the distance check between you.

5.2 If you say no

Location is optional at the device level: you can refuse or withdraw permission at any time in your device settings. Without location, you will not be able to go live in the Arena, see nearby athletes, or pass the same-mat check, so you may not be able to start ranked matches that require it. The rest of the app continues to work.

5.3 How long we keep location

• Precise coordinates from presence checks are scrubbed (removed) within a few minutes of our receiving them. The location tag for going live keeps its precise coordinates for up to about 4 hours so that your live status stays valid, and is then scrubbed. The underlying records are deleted 3 days after receipt.
• An approximate location, rounded to about 110 metres, is kept in a location log of go-live attempts and match starts for up to 24 months, and with the record of each go-live session, for ranking integrity and fraud prevention (for example, detecting fake matches). Go-live session records are kept while your account exists. All of this is deleted when you delete your account.
• The distance between the participants and the result of the proximity check are kept with the match record, because they support the integrity of that ranked result.

5.4 Technology that locates you

The Arena, invite and face-off features use technology that can locate you. These location functions are off until you grant location permission on your device, they work only while the app is in use, and you can turn them off at any time in your device settings. This section and your device's permission prompt describe how they work and what they are used for.

6. How we use personal information

We use personal information to:

1. Provide the Service: create and manage your account, show your profile, run challenges, invites, friends, the Arena, matches, practice matches and leaderboards.
2. Calculate and display ratings: compute your weight-aware Elo rating, rank and statistics.
3. Record, process and analyze match video: store recordings, create stills, highlight reels and AI analysis, and attribute moments to the right athlete.
4. Protect the integrity of rankings: verify that athletes are on the same mat, run weight checks, handle disputes, detect fake or manipulated matches, flag repeat disputers, and enforce our Terms.
5. Communicate with you: send push notifications (for example, when a friend goes live, an invite is claimed, a result needs confirming, or a highlight reel is ready), service emails (such as sign-up confirmation and password reset), and replies to your requests.
6. Keep the Service secure and working: authenticate users, prevent abuse and fraud, diagnose crashes and errors, and monitor performance.
7. Improve the Service: understand what works and what does not, and improve and train our own features and models (subject to your opt-out in section 4.6).
8. Promote ELO RATED: post match reels on our own social media accounts (subject to your opt-out in section 4.5).
9. Comply with law and protect rights: respond to lawful requests, keep required records (including your acceptance of the Terms), establish or defend legal claims, and protect the safety and rights of users, the public and ELO RATED.

We do not use your personal information for advertising, and we do not build advertising profiles about you.

7. Consent and how to withdraw it

By creating an account and accepting the Terms of Service (and acknowledging this Privacy Policy), you consent to the collection, use and disclosure of your personal information as described here, including the public parts of your profile, which are essential to a ranked competition platform. We ask for separate permission through your device for location, camera, microphone, photos and notifications.

Promotional and social media use of footage (section 4.5) and use of footage for AI training (section 4.6) are separate choices from using the Service. You can opt out of each at any time, without losing access to the Service, and we will ask for any further consent where the law requires it.

You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean that some features stop working:

Some processing does not depend on consent that you can withdraw while keeping your account, because it is necessary to provide a ranked competition service: for example, calculating ratings, showing your public profile and keeping match records. If you do not want this processing, you can delete your account.

8. What other people can see

ELO RATED is public by design. Please think before you share.

• Visible to other signed-in users: your display name, profile photo or avatar, gym, weight, gender, Elo rating, rank, record and statistics, Instagram handle (if you add one), and leaderboard placement. When you go live, nearby athletes can see that you are nearby or on the mat (never your coordinates), and your friends get a notification that you have gone live.
• Visible to anyone with the link: profile photos are stored at publicly accessible web addresses, and the invite link page shows your first name, last initial, avatar, rating and weight to anyone who has your invite link.
• Match participants and timekeepers: can see the match details, results, weight checks and match film for that match, and the athletes can see their highlight reels and analysis (see section 4.4).
• Not displayed on your profile: we do not display your date of birth on your profile.

You are responsible for what you choose to share, including your Instagram handle, the content you post, and any video, reel or information you share outside the Service (for example, to Instagram, messaging apps or your camera roll). We are not responsible for how other users or third parties use, copy or re-share information you or others have made public or shared off the Service. If someone has shared content about you that you think breaks our Terms, email info@elorated.com.

9. How we share personal information

We do not sell your personal information and we do not share it for targeted or cross-context behavioural advertising. We share personal information only as follows.

9.1 Service providers

We use service providers that process personal information on our behalf to run the Service, and we share only what they need. We use providers whose terms for business or paid customers restrict them to processing the information to provide their services to us (subject to their legal obligations, such as limited retention for abuse monitoring).

9.2 Other users

Information is shared with other users as described in section 8, as a core part of the Service.

9.3 Social platforms and sharing you choose

• When you share: if you share a reel or invite to Instagram, WhatsApp, the share sheet or another app, the content goes to that platform at your direction, under its own terms and privacy policy.
• Our own social accounts: if we post a reel featuring you on our own accounts (for example, Instagram, operated by Meta), that content becomes public on that platform, subject to your opt-out and takedown rights in section 4.5.

9.4 Legal requirements and protection of rights and safety

We may disclose personal information where we believe in good faith it is required or permitted by law, for example to comply with a subpoena, warrant, court order or other legal process; to respond to a lawful request from a government institution; to investigate or prevent fraud, abuse, or a breach of our Terms; to establish, exercise or defend legal claims; or to protect the life, health, safety, property or rights of any person, our users, the public or ELO RATED, including in an emergency.

9.5 Business transfers

If ELO RATED is involved in a sale, merger, financing, reorganization, incorporation, or a transfer of all or part of the business or assets, personal information may be disclosed to the parties involved (including during due diligence) and transferred to the successor, which will be required to use it consistently with this policy, subject to applicable law. Where required, we will notify you.

9.6 Aggregated or de-identified information

We may use and share information that has been aggregated or de-identified so that it no longer identifies you (for example, overall match statistics).

10. International transfers and processing outside your province or Canada

We store personal information primarily in Canada (Montreal, Quebec). Some of our service providers process personal information in the United States and other countries (see section 9.1). When information is processed outside Canada, or outside your province, it is subject to the laws of that place and may be accessible to courts, law enforcement and national security authorities there.

Before transferring personal information outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purposes, the safeguards in place and the applicable legal framework, and we use contractual and other measures to protect it. You can contact our Privacy Officer for more information about our practices regarding service providers outside Canada.

11. How long we keep information

We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law (for example, to resolve disputes, enforce our Terms or defend legal claims). In particular:

• Account and profile information: until you delete your account (see section 12).
• Match records, ratings, confirmations, disputes and weight checks: kept for as long as the Service operates, because they form part of other athletes' records and rating history. After you delete your account, they remain attached to a de-identified "Deleted athlete" record.
• Match video, stills and AI analysis: kept so that participants can access them, and for the purposes in section 4. They remain after account deletion as shared records (see section 12) unless removal is requested and granted. Original footage may be kept in long-term archival storage for product improvement and training until you ask us to delete it and the request is granted, or until it is no longer needed. If you opt out of training use, footage in which you appear is excluded from future training use (section 4.6).
• Your highlight reels: until you delete your account or ask us to remove them. After account deletion, your reel files are removed shortly afterwards (not instantly).
• Your opponents' highlight reels: reels made for your opponent can show you and the display name you had at the time. They stay with your opponent's record, including after you delete your account, unless you ask us to remove or re-render them.
• Location: as described in section 5.3.
• Terms acceptance records: kept as proof of your agreement, including after account deletion.
• Crash reports, error reports and bug reports in Sentry: generally up to about 90 days.
• Operational and security logs: short-term, according to our providers' standard log retention.
• Backups: our providers keep rolling backups for disaster recovery; deleted information can remain in backups until they are overwritten in the normal cycle.
• Support emails: as long as needed to handle your request and keep a reasonable record of it.

When information is no longer needed, we delete it or de-identify it.

12. Deleting your account (with or without the app)

You can delete your account in the app at Settings > Delete account. If you no longer have the app or cannot sign in, you can request deletion by emailing info@elorated.com, preferably from the email address on your account; we will verify your request and delete the account for you. Deletion cannot be undone. You cannot delete your account in the middle of a live match.

What is deleted or erased:

• your login (your account at our authentication provider) and email address;
• your first and last name, display name (replaced with "Deleted athlete"), profile photo, still image, AI avatar, date of birth, gender, city, weight, gym and Instagram handle;
• your friendships, open invites, push notification devices and notification preferences;
• messages and images you sent (where messaging was available to you);
• your highlight reels, highlight feedback and reel share records (your reel files are removed shortly after deletion, not instantly);
• your live session history and location logs, and any remaining presence records; and
• your listing in rankings, leaderboards and the Arena. Your open challenges and bookings are cancelled.

What remains, attached to a de-identified "Deleted athlete" record:

• match results, rating history (your rating stays part of your opponents' rating calculations), submissions, confirmations, disputes and weight checks;
• match videos, still frames and AI analysis, because they are shared records that also belong to your opponents' history;
• highlight reels made for your opponents, which can show you and the display name you had at the time, unless you ask us to remove or re-render them;
• records of claimed or expired invites, in a form that no longer links to your profile; and
• records of your acceptance of the Terms of Service.

We treat account deletion as an opt-out of promotional use (section 4.5) and of AI training use (section 4.6) of footage in which you appear.

The "Deleted athlete" record is de-identified, not anonymous: it keeps the same internal ID, rating and match history, your face can remain visible in match video, and it may still be recognizable to people who were at the match or who see the footage. To ask us to remove specific footage in which you appear, email info@elorated.com. We will consider each request and honour it where reasonable, balancing the interests of the other participant(s) in their own match record. Reels posted on our social media accounts are removed on request.

Information that you or others have already shared outside the Service (for example, saved videos or posts on Instagram) is not affected by account deletion. Crash reports in Sentry and backups expire on their normal cycle (section 11).

13. How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls and row-level security in our database, private storage for match videos, hashed passwords, limiting staff and contractor access to those who need it, and scrubbing or rounding of location data. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of your information. You are responsible for keeping your password and device secure and for telling us promptly if you think your account has been compromised.

Breaches. If a breach of security safeguards involving your personal information creates a real risk of significant harm (or, in Quebec, a risk of serious injury), we will notify you and the relevant privacy regulators, and keep records of breaches, as required by applicable law.

14. Your privacy rights (Canada, including Quebec)

Subject to applicable law, you have the right to:

• access the personal information we hold about you, and learn how it has been used and to whom it has been disclosed;
• in Quebec, also learn the categories of persons within our organization who have access to your information, how long it is kept, and the contact information of our Privacy Officer;
• correct information that is inaccurate or incomplete (you can update most profile information in the app);
• withdraw consent (section 7);
• request deletion of your information, or request that we stop disseminating it or de-index it where the law allows (section 12);
• in Quebec, request that computerized personal information you provided be given to you, or to another organization, in a structured, commonly used technological format (data portability), where the law provides it; and
• be informed about automated decisions (section 15).

How to make a request: email info@elorated.com from the email address on your account if possible. We may need to verify your identity before acting, and we may ask for more information to locate your data. We respond within the time required by law, generally 30 days, or tell you within that period if we need an extension allowed by law, and why. Requests are free, except where the law permits a reasonable fee for unusual costs, which we would tell you about first. We may refuse a request where the law allows (for example, where it would reveal personal information about another person, such as an opponent, or where the information is protected by legal privilege), and we will explain why.

Complaints. If you have a concern, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to:

• the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); or
• if you live in Quebec, the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

15. Automated processing and ratings

• Elo ratings are calculated automatically by an algorithm, based on match results (taking weight into account). Ratings affect your rank and leaderboard placement. Ratings are not a decision about your rights, eligibility for services or finances, and are not a measure of safety or skill matching.
• AI analysis (moments, techniques and coaching notes) and athlete attribution are generated automatically and can be wrong.
• Integrity checks (such as the same-mat proximity check and weight checks) are partly automated and can affect whether a match can start.

You can ask us about the personal information used to produce a result, the main factors and parameters that led to it, and to have it reviewed by a person. For a match result, use the in-app dispute process before the result locks; for anything else, or after a result has locked, email info@elorated.com. Disputed results are reviewed by our administrators, whose decisions are final as described in the Terms of Service.

16. United States residents: your state privacy rights

This section applies to residents of US states with consumer privacy laws, including California (the CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others, to the extent those laws apply to us. It supplements the rest of this policy.

16.1 Notice at collection: categories we have collected in the last 12 months

We collect this information for the business purposes described in section 6. We do not create, store or keep facial recognition templates, faceprints or other biometric identifiers, and we do not use facial recognition to identify people by comparing them against a database of faces. Our AI providers do look at photos, still frames and footage showing your face and body to tell the athletes apart and to draw avatars (see section 4.3).

16.2 No sale, no sharing, no targeted advertising

We do not sell personal information, we do not "share" it for cross-context behavioural advertising, and we do not process it for targeted advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16 (the Service is only for people who are 18 or older, and at least the age of majority where you live (for example, 19 in British Columbia, New Brunswick, Nova Scotia, Newfoundland and Labrador and the three territories)). We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

16.3 Sensitive personal information

We use sensitive personal information (your account login credentials and precise geolocation) only for purposes permitted by law, such as providing the Service you request, security and integrity, and preventing fraud. We do not use it to infer characteristics about you. For this reason, a "limit the use of my sensitive personal information" right does not apply. We collect precise geolocation only after you give permission on your device, and you can withdraw that permission at any time in your device settings.

16.4 Consumer health data (Washington, Nevada and similar laws)

Some state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, regulate "consumer health data". We collect your weight, and weight checks made by opponents, for weight-aware ratings and competition divisions, not to learn about your health. To the extent this information is treated as consumer health data, we collect and use it only to provide the Service you request, we share it only with our service providers and with other users as described in this policy, we do not sell it, and you can access or delete it, or withdraw consent, by emailing info@elorated.com or by deleting your account.

16.5 Your rights

Depending on your state, you may have the right to:

• know and access the categories and specific pieces of personal information we collected about you, the sources, purposes, and categories of recipients;
• delete personal information we collected from you, subject to legal exceptions (for example, records that other users depend on, as described in section 12);
• correct inaccurate personal information;
• data portability: receive your information in a portable format;
• opt out of sale, sharing, targeted advertising and certain profiling (we do not do these, so there is nothing to opt out of); and
• not be discriminated against for exercising your rights. We will not deny you the Service, charge you a different price or give you a different quality of service because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

How to exercise them: email info@elorated.com. We will verify your request by matching information you provide with information we hold (for example, by asking you to write from your account email or confirm account details). We respond within the time required by law (generally 45 days, extendable where permitted).

Authorized agents: you may use an authorized agent to make a request. We may require the agent to provide your signed permission, and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Appeals: if we decline your request, you may appeal by replying to our decision or emailing info@elorated.com with "Privacy appeal" in the subject line. We will respond to the appeal within the time required by law (generally 45 or 60 days). If you are not satisfied, you may contact your state Attorney General.

16.6 California "Shine the Light"

We do not disclose personal information to third parties for their own direct marketing purposes.

16.7 Do Not Track and Global Privacy Control

Because we do not sell or share personal information or use it for targeted advertising, and do not track you across third-party sites, we do not change our practices in response to Do Not Track browser signals. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing, which is already our practice.

17. Cookies and similar technologies

We use only a small number of first-party cookies and similar storage:

• Essential authentication cookies and local storage on the web, and secure storage on your device in the mobile app, to keep you signed in and protect your account.
• An invite cookie (`er_invite`), a first-party cookie that lasts 7 days, to remember which invite link brought you to the website so the right invite and friendship can be connected when you sign up.

We do not use advertising cookies, third-party tracking pixels, or cross-site tracking. If you block cookies in your browser, sign-in and invites on the web may not work.

18. Push notifications

If you allow notifications, we send push notifications through Expo, Apple and Google about activity in the Service, for example when a friend goes live, an invite is claimed, a match result needs your confirmation, or a highlight reel is ready. You can turn notifications off at any time in your device settings (and in the app's notification preferences where available). Turning them off may mean you miss time-sensitive events, such as a result that locks automatically after 24 hours.

19. Age requirement

The Service is only for people who are 18 or older, and at least the age of majority where you live (for example, 19 in British Columbia, New Brunswick, Nova Scotia, Newfoundland and Labrador and the three territories). We do not knowingly collect personal information from anyone under that age. If we learn that a user is under 18, or under the age of majority where they live, we will deactivate the account and delete their personal information after notice, except the shared match records described in section 12, which we will de-identify. Where we can, we will also remove match footage and social media posts in which that person appears, and we will not use that footage for promotion or training. If you believe someone under 18, or under the age of majority where they live, is using the Service, please email info@elorated.com.

20. Third-party links, platforms and services

The Service links to or works with third-party platforms, such as Instagram, WhatsApp, Google, Apple and the share features of your device. When you use them, including when you share content to them or sign in with them, their own terms and privacy policies apply, and we are not responsible for their content, privacy practices or security. Please review their policies before you share.

21. Changes to this policy

We may update this policy from time to time, for example when we add or change features (such as new sign-in options or automated posting to our social accounts) or when the law changes. We will post the updated version with a new "Last updated" date. If we make a material change, we will give you reasonable advance notice in the app or by email, where practicable, before it takes effect, and where the law requires your consent to a new purpose, we will ask for it.

22. Contact us

For any question, request or complaint about this policy or your personal information, contact our Privacy Officer:

ELO RATED, Privacy Officer

Toronto, Ontario, Canada

Email: info@elorated.com

(A mailing address is available on request at this email address.)