Account data
Email or phone, password (hashed), display name, and home city. Used to operate your account.
Read more →WinCome Sports privacy policy
WinCome Sports collects only the data needed to operate the platform, verify your identity, process deposits and withdrawals, and protect against fraud. We do not sell your data, share it with advertisers, or use it for purposes outside of operating WinCome Sports.
What we collect
KYC data
Aadhaar or other OVD, PAN, and liveness selfie. Used to verify identity and comply with anti-money-laundering law.
Read more →Payment data
UPI handle, bank account number, IFSC, transaction IDs. Used to process deposits and withdrawals.
Read more →Gameplay data
Squad selections, captain picks, contest joins, leaderboard ranks. Used to operate contests and improve scoring engine.
Read more →How we protect your data
Encryption
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Passwords are hashed with bcrypt and never stored in plain text.
Access control
Only WinCome engineers with a documented business need can access production data. All access is logged and audited.
Retention
Account data is retained while your account is active and for 7 years after closure (per Indian tax law). KYC documents are deleted within 7 days of account closure.
Your rights
You can request a copy of your data, correct inaccuracies, or delete your account at any time. Email [email protected] for data requests.
Questions about privacy?
Email [email protected] for any data request, deletion, or correction. We respond within 7 business days.
Win Bracket Context
Tournament context for Privacy
The WinCome Sports privacy policy covers what we collect, what we use it for, what we never share, and what your rights are. The policy is reviewed by external counsel every quarter and the plain-English summary is published alongside the legal text on every section.
7
Data Categories
Account, payment, gameplay, device, location, support, calibration
0
Third-Party Sharing
We never sell or share player data
7 years
Data Retention
Per Indian financial regulation requirements
Frequently asked questions
Does WinCome Sports sell player data to advertisers?
No. We have never sold, and we will never sell, player data to advertisers. The WinCome Sports business model is funded by the platform's share of contest entry fees, not by advertising. Player data stays inside the platform.
Can I request a copy of all my WinCome Sports data?
Yes. Open the privacy page and submit a data export request. We will email you a complete archive of your account, gameplay, calibration, and support data within 14 days. The export is delivered as an encrypted ZIP with a one-time password.
Privacy is a feature, not a marketing line. The WinCome Sports privacy policy has zero third-party sharing, a 7-year data retention window (required by Indian financial regulation), and a 14-day data export turnaround. The next time you wonder what we do with your data, the answer is: we use it to make your tournament brackets sharper, and nothing else.
Win Bracket Deep Dive
The 7 data categories that WinCome Sports collects
WinCome Sports collects 7 data categories: account, payment, gameplay, device, location, support, and calibration. Each category is described in detail in the privacy policy. The categories are collected only for the purposes stated in the privacy policy; we never use the data for any other purpose. The account category includes the user's name, email, phone number, date of birth, and PAN or Aadhaar number. The account data is collected at signup and KYC. The account data is used to identify the user, to verify the user's age and residency, and to communicate with the user. The account data is never shared with third parties. The payment category includes the user's deposit method, withdrawal method, and transaction history. The payment data is collected at the first deposit and the first withdrawal. The payment data is used to process deposits and withdrawals, to comply with AML and PMLA regulations, and to detect fraud. The payment data is never shared with third parties. The gameplay category includes the user's bracket history, captain pick history, and scoring engine logs. The gameplay data is collected at every contest entry. The gameplay data is used to score brackets, to calibrate captain picks, and to detect responsible-play anomalies. The gameplay data is never shared with third parties.
How WinCome Sports protects player data
WinCome Sports protects player data with 6 layers of security. Layer 1 is encryption at rest: all data is encrypted with AES-256 in the production database. Layer 2 is encryption in transit: all data is encrypted with TLS 1.3 in transit. Layer 3 is access control: data access is limited to authorized personnel on a need-to-know basis. Layer 4 is audit logging: every data access is logged and reviewed weekly. Layer 5 is backup encryption: backups are encrypted with a separate key and stored in a separate, access-controlled system. Layer 6 is incident response: the incident response team is on call 24/7 and responds to any security incident inside 30 minutes. The encryption keys are rotated every 24 hours. The TLS certificates are rotated every 90 days. The access control list is reviewed every 30 days. The audit logs are reviewed every 7 days. The backups are tested every 30 days. The incident response team runs a tabletop exercise every 90 days. WinCome Sports has not had a data breach in its 3-year history. The last security audit was conducted in Q1 2026 by an independent third-party (KPMG India). The audit found no critical or high-severity issues. The audit report is available on request to enterprise customers and regulatory bodies. The report is not published publicly to avoid revealing the platform's security architecture to potential attackers. WinCome Sports is committed to keeping player data safe. The 6-layer security architecture, the 24-hour key rotation, the 24/7 incident response, and the third-party audits are the foundation of that commitment. The next security audit is scheduled for Q1 2027.
Win Bracket Insider View
The WinCome Sports data subject rights in detail
Every WinCome Sports user has 6 data subject rights under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011. The 6 rights are: right to access, right to correction, right to erasure, right to portability, right to restriction, and right to objection. The 6 rights are operationalized in the WinCome Sports privacy policy. Right 1 is the right to access. The user can request a copy of all the data that WinCome Sports holds about the user. The request is processed inside 14 days. The data is delivered as an encrypted ZIP with a one-time password. The encrypted ZIP includes the account profile, the gameplay history, the captain-pick history, the wallet history, the support ticket history, and the audit logs. Right 2 is the right to correction. The user can request a correction of any data that is inaccurate or incomplete. The request is processed inside 7 days. The correction is applied to the production database, the analytics database, and the backup storage. The user receives an email confirmation when the correction is applied. Right 3 is the right to erasure. The user can request the deletion of all the data that WinCome Sports holds about the user. The request is processed via the account deletion flow, which has a 7-day cooling period. The deletion is processed in 3 stages: production database (immediate), analytics database (within 7 days), and backup storage (within 30 days). The user receives an email confirmation at each stage.
Right 4 is the right to portability. The user can request the data in a machine-readable format (JSON, CSV). The request is processed inside 14 days. The data is delivered as an encrypted ZIP with a one-time password. The machine-readable format helps allow the user to import the data into another platform. The portability request is free for the user. Right 5 is the right to restriction. The user can request that WinCome Sports restrict the processing of the user's data. The restriction can be applied to specific data categories (e.g., the gameplay history) or to the entire account. The restriction is applied inside 7 days. The restriction does not delete the data; it just prevents WinCome Sports from processing the data for any purpose other than storage. Right 6 is the right to objection. The user can object to the processing of the user's data for any purpose. The objection is processed inside 7 days. The objection can be applied to specific data categories or to the entire account. The objection can also be applied to specific processing activities (e.g., captain calibration, anomaly detection). The 6 data subject rights are free for the user. WinCome Sports does not charge any fee for the exercise of the 6 rights. The 6 rights are operationalized via the privacy page, the account settings page, and the contact desk. The user can exercise the 6 rights via any of the 3 channels. The user can also file a complaint with the Data Protection Board of India if the user believes the rights have not been respected.
