Privacy Policy

Sole Showdown operates on principles of strict data minimization and purposeful limitation. We process only the data strictly necessary to provide authentication, 1v1 Arena matchups, digital card collections, and system security.

We do not sell personal data, display third-party advertisements, employ behavioral tracking pixels, or build cross-site consumer marketing profiles.

User authentication and identity management are powered by Clerk (@clerk/nextjs). When you create an account or sign in, Clerk handles user credentials, email addresses, names, avatar images, and session security tokens.

In the Sole Showdown application database (PostgreSQL on Neon), we store only your internal User record with your unique Clerk identifier (clerkId). Raw user passwords and credential hashes are never stored in our application database.

When authenticated, our servers record gameplay events linked to your user record to maintain your progression and collection:

• Arena Voting Activity: Matchups issued to you and the sneaker you selected as the winner.

• Matchup History: Timestamped matchup records (ArenaMatchup) including reward allocations.

• Virtual Coin Balance: Current total of virtual Coins earned through voting and spent in the shop.

• Daily Vote Usage: Atomic daily vote counts per calendar date (DailyVoteUsage) to enforce fair play limits.

• Card Collection Inventory: Digital cards unlocked (CollectedCards), associated sneaker references, and rarity tiers.

• Booster Pack Transactions: Idempotent transaction records of pack openings (PackOpening).

Sneaker Elo ratings, total matches, win rates, and community leaderboard positions belong to the public sneaker catalog entity. They are calculated dynamically from aggregate votes and are not personal data of any individual user.

To safeguard our servers against denial-of-service attacks, automated botting, and vote flooding, we implement distributed rate limiting via Upstash Redis:

• Authenticated Rate-Limiting: Tracked using internal user identifiers (user:<clerkUserId>).

• Anonymous IP Rate-Limiting: Client IP addresses extracted from HTTP headers are cryptographically hashed using HMAC-SHA256 with a private secret key (ip:<sha256(HMAC(client_ip, secret))>). Raw IP addresses are never persisted in Redis rate-limit keys.

• Upstash analytics is explicitly disabled (analytics: false).

• Server Logs: Technical HTTP logs (request path, status code, timestamp) generated by our hosting infrastructure for operational diagnostics and security monitoring.

• No payment, credit card, or banking details (virtual Coins are earned exclusively through gameplay; no real-money purchases are currently offered).

• No real-time GPS location data.

• No third-party advertising tracking cookies, social media tracking pixels, or cross-site tracking beacons.

To authenticate users, present 1v1 sneaker matchups, record user votes, credit virtual coin rewards, process booster pack openings, and maintain digital card collections.

Legal Basis (GDPR Art. 6(1)(b)): Performance of a contract / providing the service requested under our Terms of Use.

To enforce daily vote allowances, prevent vote manipulation and botting scripts, mitigate API abuse, and ensure high availability.

Legal Basis (GDPR Art. 6(1)(f)): Legitimate interests in maintaining application integrity, fair rankings, and server security.

To fulfill statutory accounting, dispute resolution, and regulatory compliance duties where applicable.

Legal Basis (GDPR Art. 6(1)(c)): Compliance with legal obligations.

Provides user registration, sign-in flows, session tokens, and security controls.

Role: Data Processor / Auth Provider.

Hosts our primary application database storing user records, card collections, and matchup history.

Role: Data Processor / Database Hosting.

Provides distributed rate-limiting infrastructure for API endpoint protection with analytics disabled.

Role: Data Processor / Cache & Rate Limiter.

Hosts application code, serves static assets, and executes Next.js serverless functions at the edge.

Role: Data Processor / Application Hosting.

Our authentication provider (Clerk) sets strictly necessary session and security cookies (such as __session and __client_uat) to maintain your login state and protect against Cross-Site Request Forgery (CSRF).

The animated introduction sequence is managed exclusively using in-memory application state within your active browser session. Sole Showdown does not write UI preferences or tracking identifiers to localStorage or sessionStorage.

Because Sole Showdown utilizes only strictly necessary authentication/security cookies and zero non-essential tracking or marketing storage, no cookie consent banner is required under EU ePrivacy regulations and EDPB guidelines.

Sole Showdown complies with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, ensuring lawful collection, purposeful use, and reasonable technical security safeguards.

We acknowledge the enactment of the Digital Personal Data Protection Act, 2023 and the progressive notification of the DPDP Rules, 2025 by the Ministry of Electronics and Information Technology (MeitY). As the Data Protection Board of India (DPBI) and specific statutory compliance mechanisms are phased into legal effect, our practices will align with all binding notifications.

In advance of full statutory operationalization, Golden Hour Labs voluntarily adheres to core data minimization, transparency, and responsive grievance redressal principles.

For privacy inquiries, data access, or grievance redressal under Indian regulations, contact Michael Schubert at: contact@goldenhourlabs.tech

As a data subject in the EU/EEA, you have the following enforceable rights:

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation and a copy of personal data processed about you.

• Right to Rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.

• Right to Erasure / Right to be Forgotten (Art. 17 GDPR): You may request deletion of your account and associated personal data.

• Right to Restriction of Processing (Art. 18 GDPR): You may request restriction of processing under certain legal conditions.

• Right to Data Portability (Art. 20 GDPR): You may request your personal data in a structured, commonly used format.

• Right to Object (Art. 21 GDPR): You have the right to object to processing based on legitimate interests (Art. 6(1)(f)).

To exercise any GDPR right, contact: contact@goldenhourlabs.tech.

You also have the right to lodge a complaint with a competent Data Protection Supervisory Authority in your EU Member State (Art. 77 GDPR) if you consider that our data processing infringes the GDPR.