Privacy Policy

Effective: 18 May 2026

This Privacy Policy explains what we collect, why, and who we share it with. By accepting our Terms of Service during registration you also consent to this policy.

LFG Interactive Ltd (BVI BC No. 2156033), a company organised under the laws of the British Virgin Islands ("we", "us" or "our"), is the operator of Blackjack Battles. We are a wholly-owned subsidiary of Lightning Forge Games Pty Ltd (ACN 678 849 440), Australia.

We understand that protecting your personal information is important. This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or collected by us, when providing the websites at bjb.gg and game.bjb.gg, the Blackjack Battles game and any related applications, APIs, smart contracts and connected services (the "Services"), or when otherwise interacting with you.

Blackjack Battles is a real-money skill-based wagering platform. Some of our processing is necessary to comply with anti-money-laundering, counter-terrorism financing, sanctions, age verification, and gambling regulations. Where we rely on these grounds, you cannot opt out of the processing and continue to use the wagering features of the Services.

The information we collect

Personal information is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable. The types of personal information we may collect about you include:

As a Blackjack Battles player, contributor or community member

Identity Data including your legal name, date of birth, country of residence (and US state or Canadian province where applicable), nationality, chosen display name, profile portrait/avatar selection, and any government-issued identifiers you provide for enhanced verification.
Contact Data including your email address, and where you choose to link them, your Discord, X (Twitter) and Telegram account identifiers and handles.
Financial Data including your Avalanche (AVAX) wallet address, signed wallet messages used to prove ownership, on-chain transaction history relating to our smart contracts, soft-currency ("coins") balance, in-game transaction ledger, deposit and withdrawal history, AVAX tickets, VIP points, affiliate commissions and pay-out history.
Eligibility Data including the geolocation derived from your IP address used to enforce regional access rules, and any sanctions, politically-exposed-person or watch-list screening results we obtain from our compliance providers.
Marketing and Communications Data including your preferences in receiving marketing from us and our partners, your communication preferences, and your acceptance status and version for our Terms of Service and this Privacy Policy.
Interactions Data including information you provide when you participate in any interactive feature (surveys, feedback forms, contests, promotions, tournaments, leaderboard races, referral programs, social-task verification), details of products and services we have provided to you or that you have enquired about, our responses to you, support requests you submit to us, and our responses to those requests.
Gameplay Data including matches you play, results, MMR/Glicko ratings, win/loss records, hand cards and decks ("loadouts") you build, card energy/durability, deterministic match seeds, replays of matches you participate in (including matches in which you appear as an opponent or spectator of another player), tournament bracket positions and results, and analytics events emitted by your client and our servers (e.g. match_start, queue_join, coin_pack_purchase).
AI Training Data derived from your gameplay where you train a player-owned AI ("LFG Agent") via imitation learning on your own match replays, and gameplay decisions made by AI agents you operate via the Model Context Protocol ("MCP Agent").
Technical and Usage Data when you access any software or websites we make available to you, including your IP address, user agent (browser family and operating system family), device type (mobile, tablet, desktop), screen resolution and device pixel ratio, viewport size, browser language and IANA timezone, best-effort connection type (e.g. "4g"), search queries, browsing behaviour (including through cookies, pixels and analytics SDKs), session and reconnection tokens, and security-relevant signals such as failed authentication attempts.
Additional Data including personal information that you provide to us through associated applications, social platforms or accounts from which you permit us to collect information, or any other personal information you or a third party provides in connection with the Services.

When you visit our website (bjb.gg or game.bjb.gg) without an account

Identity Data such as a name and date of birth where you begin a registration flow.
Contact Data such as an email address where you submit one.
Marketing and Communications Data including your preferences in receiving marketing from us and our partners.
Technical and Usage Data including IP address, user agent (browser family and operating system family), device type (mobile, tablet, desktop), screen resolution and device pixel ratio, viewport size, browser language and IANA timezone, best-effort connection type, page URLs, attribution parameters (UTM tags, referrer URL) and analytics events.

Sensitive information

Sensitive information is a sub-set of personal information that is given a higher level of protection and includes information about racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information, or biometric information. We do not actively request sensitive information about you. However, depending on the documents you submit during identity verification, we may receive sensitive information incidentally (for example, an image of a religious head-covering on a government-issued identity document). Unless otherwise permitted by law, we will only use such information for the verification or compliance purpose for which it was collected.

How we collect personal information

We collect personal information in a variety of ways, including:

when you provide it directly to us, including over email, in our registration wizard, in our in-app forms or in support tickets;
when you complete a form, such as registering an account, completing identity verification, opting in to a leaderboard race, accepting a tournament seat, or responding to surveys;
when you sign a message or transaction with your cryptocurrency wallet;
when you authenticate via Discord, X (Twitter) or Telegram for our social-task verification;
when you use any software, website, smart contract, or API we operate (including from analytics, cookie and marketing providers — see "Cookies" below);
from compliance, identity verification, sanctions-screening and fraud-prevention providers we engage;
from publicly available sources, including the Avalanche blockchain and other public registries; and
from our affiliates, employees, contractors and related entities.

Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose your personal information for the following purposes:

As a Blackjack Battles player, contributor or community member

to enable you to access and use our website, game client, smart contracts and related Services, including to provide you with a login and a session;
to verify your identity, age, country of residence and nationality and otherwise determine your eligibility to use the Services in your jurisdiction;
to comply with applicable anti-money-laundering, counter-terrorism financing and sanctions obligations, including OFAC, UN, EU, UK and Australian sanctions screening;
to provide and operate the wagering features (matchmaking, tournaments, races, leaderboards, VIP/loyalty, affiliate program, ticket system, vault and escrow integration);
to record, settle and audit financial transactions in coins and AVAX, including platform-fee accounting, prize distribution, refunds, dispute handling and tax reporting where required;
to enable on-chain functionality including signing match settlements and tournament completions, posting Merkle commitments for provably-fair RNG, and operating the non-custodial vault/escrow flow;
to detect, investigate and prevent fraud, collusion, multi-accounting, wagering abuse, bot abuse outside our authorised AI features, and other security or integrity events;
to contact and communicate with you about the Services, including in response to support requests or other enquiries;
to notify you of updates to the Services, our Terms of Service, this Privacy Policy or fee schedules;
for internal record-keeping, administrative, invoicing, audit and billing purposes;
for analytics, market research and business development, including to operate, secure and improve the Services and associated applications;
to run promotions, competitions, leaderboard races, tournaments and referral/affiliate programs, and to issue prize payments;
to train and operate AI features, including imitation-learning agents you train on your own gameplay and external AI agents you operate via the Model Context Protocol;
for advertising and marketing, including to send you promotional information about products and services we consider may be of interest to you (subject to your communication preferences); and
to comply with our legal obligations or where otherwise required or authorised by law.

Device Identifiers and similar persistent identifiers

We collect device identifiers and persistent identifiers (such as your browser fingerprint, advertising identifiers where present, and our own first-party session and reconnection tokens) for the following purposes:

to provide and improve the Services, including for analytics and performance monitoring;
for fraud prevention, anti-cheat, anti-collusion and security purposes (including detection of multi-accounting, account takeover and chargeback abuse);
to enable advertising attribution and measure the effectiveness of marketing campaigns;
to facilitate matchmaking, ensure fair gameplay and enforce queue cooldowns; and
to enable third-party analytics and advertising services integrated into the Services.

When you visit our website without an account

to provide our website to you;
to contact and communicate with you about any enquiries you make with us via our website or pre-registration flow;
to track marketing attribution and pre-registration funnel performance; and
to comply with our legal obligations or if otherwise required or authorised by law.

Our disclosures of personal information to third parties

We will only disclose your personal information to third parties where it is necessary as part of our business, where we have your consent, or where permitted or required by law. We may disclose personal information to:

our employees, contractors, affiliates and related entities (including Lightning Forge Games Pty Ltd (ACN 678 849 440), our Australian parent);
marketing or advertising providers;
analytics and advertising partners (including Immutable Audience for analytics, attribution and audience measurement);
identity-verification, KYC, sanctions-screening and anti-fraud providers;
email-delivery providers (used to deliver one-time login codes and transactional emails);
professional advisers, accountants, auditors, bankers, insurers and insurance brokers;
our existing or potential agents, business partners or sponsors;
third-party service providers including IT service providers, data storage, data analysis, web-hosting and server providers, infrastructure providers (including Amazon Web Services for hosting, storage, compute, and CDN), error-reporting providers, cryptocurrency RPC providers, cryptocurrency wallet providers, decentralised storage providers, and digital-asset trading exchanges or platforms;
counterparties and the operators of payment, deposit, withdrawal and settlement rails relating to AVAX deposits and withdrawals;
if we merge with, or are acquired by, another company, or sell all or a portion of our assets — your personal information may be disclosed to our advisers and any prospective purchaser's advisers and may be among the assets transferred;
courts, tribunals, regulatory authorities and law enforcement officers (including the British Virgin Islands Financial Investigation Agency and equivalent financial-intelligence units in your jurisdiction), as required or authorised by law, in connection with any actual or prospective legal proceedings, sanctions enforcement, AML/CTF reporting, suspicious-activity reporting, or in order to establish, exercise or defend our legal rights;
third parties that collect and process data, such as analytics providers and cookie providers; and
any other third parties as required or permitted by law, such as where we receive a subpoena, court order or binding regulatory request.

A current list of material sub-processors and their roles is available on request from support@bjb.gg.

Public-blockchain disclosure

Where you connect a cryptocurrency wallet or wager AVAX, your wallet address and on-chain transactions involving our smart contracts are publicly visible on the Avalanche blockchain. This information is permanent and outside our control. Anyone — including data brokers, chain-analysis firms, regulators and counterparties — may inspect, copy, archive, link or correlate your on-chain activity. You should not connect a wallet that you wish to keep private, and you should be aware that linking your account display name to a wallet address can publicly associate your identity with your on-chain history.

Privacy of children

The Services are not intended for, and may not be used by, persons under the age of 18, regardless of any lower age of majority in their jurisdiction. We enforce this through identity verification at registration and may re-verify at any time. If we learn that a person under the age of 18 has provided us with personal information or has accessed the wagering features of the Services, we will promptly suspend the account, freeze any associated balances, and delete or anonymise the information from our active systems (subject to retention obligations described below). Where AVAX has been deposited to a Player Vault under an account later determined to belong to a minor, the AVAX remains under the minor's (or their guardian's) sole control via the non-custodial vault contract; any winnings settled out of escrow will be reversed where the on-chain state permits, and any unsettled entries will be refunded. If you are a parent or guardian and you become aware that your child has provided us with personal information, please contact us at the email address at the end of this Policy so that we can take appropriate action.

Overseas disclosure

We are incorporated in the British Virgin Islands and our parent company is incorporated in Australia. We store your personal information in the United States (Amazon Web Services), Australia and the British Virgin Islands. Where we disclose your personal information to third parties, those third parties may store, transfer or access personal information in the United States, the European Union, the United Kingdom, Australia, the British Virgin Islands and other jurisdictions where they or their sub-processors operate. We will only disclose your personal information overseas in accordance with applicable data-protection laws, including, where relevant, the Australian Privacy Principles, the EU/UK GDPR, and equivalent laws.

Your rights and controlling your personal information

Your choice: Please read this Privacy Policy carefully. If you provide personal information to us, you understand that we will collect, hold, use and disclose your personal information in accordance with this Policy. You do not have to provide personal information to us; however, if you do not, we may not be able to register you, verify your eligibility, allow you to wager or pay out winnings.

Information from third parties: If we receive personal information about you from a third party (for example, a verification provider, sanctions list or social platform), we will protect it as set out in this Privacy Policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide it to us.

Anonymity: Where practicable we will give you the option of not identifying yourself or using a pseudonym in your dealings with us. You can use a pseudonymous display name in-game. Anonymity is not available for KYC/identity verification, AML/CTF compliance, sanctions screening, financial transactions, or any other process where we are legally required to identify you.

Restrict and unsubscribe: To object to processing for direct marketing, unsubscribe from our email database, or opt-out of communications, please contact us using the details below or use the opt-out mechanism in the relevant communication. You cannot opt-out of transactional, security and compliance communications (including OTP codes, balance and pay-out notices, security alerts, and notices required by law).

Access: You may request access to the personal information we hold about you. An administrative fee may be payable. In some situations we may be legally permitted or required to withhold access (for example, where disclosure would prejudice an AML investigation). If we cannot provide access, we will advise you of the reasons and any complaint mechanism.

Correction: If you believe any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us. We will take reasonable steps to correct it. Note that once your KYC profile is verified, certain fields (legal name, date of birth, country of residence, nationality) cannot be changed except by submitting updated identity documentation. Display name and portrait remain self-service.

Portability: Where required by applicable law, you may request a copy of certain personal information you have provided to us in a structured, commonly used and machine-readable format.

Complaints: If you wish to make a complaint, please contact us using the details below with full details. We will promptly investigate and respond. If you are not satisfied, you may contact the Office of the Information Commissioner of the British Virgin Islands, or the data-protection authority in your country of residence.

Account and Data Deletion

You may request deletion of your account and associated personal data at any time by emailing support@bjb.gg from the email address associated with your account, including your in-game display name or player UUID.

Once we receive and verify your request, we will take steps to delete your account and associated personal data from our active systems within 30 days, unless a longer retention period is required or permitted by law.

Data Deletion Scope

When an account deletion request is completed, we will permanently delete or anonymise personal data associated with your account, which may include:

account identifiers and authentication data;
gameplay progression, statistics and ratings;
in-game purchases, inventories and entitlements;
VIP/loyalty and affiliate participation data;
support communications linked to your account.

Data we cannot delete or must retain

On-chain data. Transactions on the Avalanche blockchain involving your wallet are immutable. We cannot remove them.
AML/CTF, financial and tax records. Identity-verification records, financial transaction logs, suspicious-matter reports and related data are retained for periods required by anti-money-laundering, gambling and tax laws (typically up to seven years after the end of the customer relationship, or longer where required).
Sanctions and fraud signals. Where you have been associated with a sanctions match, fraud, collusion, multi-accounting or chargeback abuse, we may retain identifiers indefinitely to prevent re-registration.
Aggregated and anonymised data. Data that has been aggregated or irreversibly anonymised so it can no longer identify you.
Match replays. Replays of multi-player matches you participated in may be retained because they also contain another player's gameplay data.
Legal-hold data. Data subject to a current or reasonably anticipated legal proceeding, regulatory investigation or audit.

We are committed to ensuring that the personal information we collect is secure. We have put in place suitable physical, electronic and managerial procedures to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure. While we are committed to security, we cannot guarantee the security of any information transmitted over the Internet. Transmission and exchange of information is carried out at your own risk.

User-Generated Content

We may enable you to submit user-generated content (display names, profile portraits, agent names and personalities, custom card configurations, comments, support messages and similar content). Any content you choose to make publicly available will be accessible by anyone, including third parties not associated with us. We have no control over how others may use such content. We are not responsible for the privacy, security or accuracy of any user-generated content you choose to make public, or for the use or misuse of that information by any third parties.

Wallet connections and the Avalanche blockchain

Connecting a cryptocurrency wallet (for example, MetaMask, Core Wallet or via WalletConnect) discloses your wallet address to us. We use your wallet address to:

verify your ownership via signed messages;
credit AVAX deposits and process AVAX prize pay-outs;
record participation in on-chain matches and tournaments;
post and verify provably-fair RNG commitments on-chain;
detect sanctions-list addresses, sanctioned jurisdictions and blacklisted contracts; and
comply with applicable Travel Rule and AML/CTF obligations.

We never take custody of your AVAX. Wagering uses non-custodial vault and escrow contracts that you control. However, your wallet address, balance and transaction history are publicly visible on Avalanche, are linked through our smart contracts to your activity in Blackjack Battles, and are outside our control once published.

Third-Party SDKs and Services

Our Services integrate third-party software development kits (SDKs) and services that may collect data from your device. These third parties include:

Authentication and identity

Third-party authentication services — email one-time-password (OTP) authentication.
Identity-verification, sanctions-screening and anti-fraud providers (engaged on an as-needed basis).

Infrastructure

Amazon Web Services (AWS) — hosting, storage, compute, and CDN.

Analytics and attribution

Immutable Audience — game analytics, attribution and audience measurement. Receives event names, page URLs, attribution parameters, IP, user agent, an anonymous device identifier, and (after you accept this Policy) your email address as a user trait. See Immutable's privacy policy.

Cryptocurrency

Blockchain RPC providers — to read and write blockchain data on your behalf.
WalletConnect and individual wallet vendors (e.g. MetaMask, Core Wallet) — for wallet connection and message/transaction signing.
Decentralised storage providers — for storage of NFT metadata, where applicable.

Social platforms (only if you opt-in)

Discord, X (Twitter), Telegram — used for social-task verification (guild membership, follow check, Login Widget HMAC). We perform a verify-once check and do not store OAuth tokens.

Error reporting and operations

Error-reporting and crash-diagnostics providers, where used.

These third parties may collect device identifiers, IP, and other Technical and Usage Data in accordance with their own privacy policies. We encourage you to review the privacy policies of these third-party services.

Cookies and Analytics

We may use cookies, tracking pixels and similar technologies on our websites and in our emails. Cookies are text files placed in your browser to store preferences. Tracking pixels are small images embedded in pages or emails that send information to our servers when loaded.

We use the following first-party cookies:

bjb_session — your authenticated session cookie.
bjb_logged_in — non-sensitive flag so the UI knows you're logged in.
An anonymous analytics cookie set by Immutable Audience.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. You can block tracking pixels by using ad-blocking or privacy-focused browser extensions, or by configuring your email client to block remote images. If you block all cookies (including essential cookies) and tracking pixels you may not be able to access all or parts of the Services and you may not receive personalised content.

We may add additional analytics or advertising partners in future; we will update this Policy and re-prompt you for consent before doing so.

Links to other websites

Our websites may contain links to other parties' websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information you provide whilst visiting them. Those websites are not governed by this Privacy Policy.

Personal information from single sign-on accounts and social verification

If you connect your account using a single sign-on or social-verification flow (Discord, X (Twitter) or Telegram), we will collect personal information from that provider in accordance with the privacy settings you have chosen. The information we may receive includes your name, ID, username, handle, profile picture, language, list of friends or follows, guild memberships, and any other personal information you choose to share. We use this information to verify completion of social tasks for the purpose of awarding pre-registration rewards and to link a profile to our platform. We do not store OAuth tokens after verification is complete.

Use of Artificial Intelligence (AI)

Overview: Blackjack Battles makes substantial use of artificial intelligence and machine-learning technologies, both built in-house and provided by third parties (collectively, "AI Technologies"). We will only use AI Technologies when legally permitted and necessary for the operation, improvement or security of the Services.

How we use AI Technologies

Built-in AI opponents. We operate AI bot opponents (with named personalities) for single-player practice and to fill matchmaking when needed.
Imitation-learning agents (LFG Agents). Players may train a player-owned AI agent on replays of their own matches. The trained agent plays unattended on the player's behalf in ranked matches. Imitation training uses the player's gameplay decisions; we do not feed your personal information (legal name, email, etc.) into our AI training pipeline.
External AI agents (MCP Agents). Players may operate external AI agents (e.g. Claude Code) that connect to the Services via the Model Context Protocol and play with their own identity. We log the gameplay actions and metadata exchanged with these agents.
Anti-fraud, anti-cheat and anti-collusion. We may use AI Technologies to detect bot abuse outside our authorised AI features, multi-accounting, collusion, and other integrity threats.
Content moderation. We may use AI Technologies to screen user-supplied content (e.g. display names) for prohibited terms.
Customer support. We may use AI Technologies to assist with triage and responses to customer support enquiries.
Operations. We may use AI Technologies to assist with development, code generation, code review and quality assurance.

Data Protection and Security: Where we use service providers who provide AI Technologies, we take reasonable steps to ensure they handle personal information in accordance with privacy law, including by ensuring contracts require them to protect personal information. We will not input your personal information into any AI Technology platform that trains its model on that information, except where you have specifically opted in (for example, by training your own LFG Agent on your own gameplay).

Your Rights and our Commitments: We treat information generated or inferred by AI Technologies about individuals as personal information, and you maintain all rights over your personal information as outlined in this Policy regardless of whether AI Technologies are used in processing. We will:

inform you when AI Technologies are being used to make decisions that may significantly affect you (for example, automated suspension following a fraud-detection signal), and provide a route to human review;
implement processes to verify the accuracy of AI-generated outputs, including human oversight of significant decisions;
implement appropriate technical and organisational measures to maintain the security and integrity of personal information processed with AI Technologies; and
regularly assess and document the risks associated with our use of AI Technologies and implement appropriate mitigation measures.

Notice to California Residents

This section supplements the rest of this Privacy Policy and applies only to California residents. It is provided in accordance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). Capitalised terms used in this section have the meaning given to them under the CCPA.

Categories of personal information we collect

In the past twelve months we have collected the following CCPA categories of Personal Information about California residents:

Identifiers — display name, email, IP address, device identifiers, account UUID, AVAX wallet address.
Customer records — legal name, date of birth, and government-issued identifiers where you provide them for enhanced verification.
Protected classifications — age and nationality (collected for eligibility and sanctions screening only).
Commercial information — Coin and AVAX transaction history, purchase history, inventory and prize records.
Internet or other electronic network activity — gameplay events, replays, session and reconnection tokens, analytics events, browsing on our Site.
Geolocation — coarse geolocation derived from your IP address, used to enforce regional access rules.
Inferences — matchmaking rating, win/loss records and integrity-risk signals derived from gameplay.
Sensitive Personal Information — account log-in credentials and government identifiers (where you provide them). We use Sensitive Personal Information only for the purposes permitted by section 7027(m) of the CCPA regulations (to provide the Services you request, to verify identity, to detect security incidents, and to comply with our legal obligations).

The sources of this information are: you, your Connected Wallet, our identity-verification and sanctions-screening providers, analytics and infrastructure providers, and the Avalanche blockchain. The purposes and third parties we share with are described in the "Why we collect" and "Our disclosures" sections above.

Sale and sharing of personal information

We do not sell your Personal Information for monetary consideration. We do not knowingly sell or share the Personal Information of any consumer under 16 years of age. We do not engage in cross-context behavioural advertising. If we use analytics partners that may constitute "sharing" under the CCPA, we do so only with your prior consent, which you can withdraw at any time using the cookie consent controls or by contacting support@bjb.gg. We honour Global Privacy Control (GPC) signals as an opt-out request.

Your California rights

You have the following rights, subject to verification:

Right to know — request the categories and specific pieces of Personal Information we have collected, sources, purposes, and the categories of third parties we disclose to.
Right to delete — request deletion of Personal Information we have collected, subject to the retention exceptions described above.
Right to correct — request correction of inaccurate Personal Information.
Right to opt-out of sale or sharing of Personal Information.
Right to limit the use and disclosure of Sensitive Personal Information to those purposes set out in section 7027(m) of the CCPA regulations.
Right to non-discrimination — we will not deny, charge differently, or provide a different level or quality of Services because you exercised a CCPA right.

How to exercise your rights

Email support@bjb.gg from the address associated with your Account, with the subject line "CCPA Request" and a description of the right you wish to exercise. We will respond within 45 days (extendable by a further 45 days where necessary). We may need to verify your identity before fulfilling certain requests. You may use an authorised agent to make a request on your behalf; the agent must provide written permission signed by you and we may require you to verify your identity directly.

Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Policy on our website. Material changes will be notified to you via in-game news and, where required, will trigger a re-prompt on next login. We recommend you check our website regularly to ensure you are aware of our current Policy.

Contact

For any questions, requests or notices, please contact us at:

LFG Interactive Ltd (BVI BC No. 2156033), a wholly-owned subsidiary of Lightning Forge Games Pty Ltd (ACN 678 849 440)
Email: support@bjb.gg

Back to Blackjack Battles