This policy explains what personal data AI WIN ("the Service") collects, how it is used, how long it is kept, and how you can exercise your rights. It applies to aiwin.app and to the Service's LINE sign-in page.
1. What we collect
1.1 Received when you sign in with LINE
- Your LINE user ID, used to match your account and your subscription entitlement
- Your display name and profile picture URL
- Whether you granted push message permission
- Whether you are a friend of the Service's LINE Official Account: LINE notifies the Service when you add or block the Official Account, and the Service also asks LINE when you sign in or tap "Check again" in the member center
We never receive your friend list, your chat messages or your phone number, and we do not collect your email address.
1.2 Provided by you
- The category, subject and body of any support ticket you open
- Your age confirmation and document acceptance records: document code, version, language, timestamp, and a hash of the full text you accepted
1.3 Generated automatically as you use the Service
- Support code: a random short code used in support conversations and in the paid-content watermark; it contains no personal information
- Session records: where you signed in from (inside the LINE app or a browser), IP address, browser identification string, and when the session was issued and last used
- Paid-content access records: time, count, delivery language, watermark string, IP address and browser identification string
- Interface language preference, stored in a cookie named aiwin_locale
- Subscription, order and payment records: order number, plan, amount, period, payment method, payment status and time, and the transaction data returned by the payment provider. For card payments this includes the first 6 and last 4 digits of the card number (used to reconcile transactions and handle disputes). The Service never receives or stores your full card number, expiry date or security code; you enter those directly on the payment provider's page
1.4 Stored in your browser
Sign-in credentials are held in your browser's sessionStorage and localStorage purely to keep you signed in, and are cleared when you sign out. The Service uses the Meta (Facebook) Pixel to measure advertising performance, which stores advertising-measurement cookies (such as _fbp) in your browser, and Google Analytics to analyse site traffic, which stores a cookie that tells browsers apart (such as _ga). You can clear or block these cookies in your browser settings without affecting your use of the Service.
2. Why we use it
- To create and maintain your account and identify you
- To determine what your purchases entitle you to, and what free members can view (today's free games and finished past games open once you add the Official Account as a friend)
- To process payments, open and extend subscriptions, and handle reconciliation and payment disputes
- To protect paid content, using watermarks and access records to trace leaks
- To provide support and handle tickets
- To evidence compliance: when you confirmed your age and which version of each document you accepted
- For system security and the prevention of abuse and abnormal access
- Site traffic analysis: which pages were viewed, where visits came from, and which devices and browsers were used, as aggregate statistics that cannot identify an individual, to improve the Service
- To measure advertising performance: which pages were viewed, whether a subscribe or sign-up button was clicked, and whether sign-up was completed
3. What we do not do
- We do not sell or rent your personal data
- We do not use it for cross-site advertising tracking or advertising profiles
- We do not train or fine-tune AI models on your personal data. What is sent to the analysis model is team and fixture statistics only, with no user personal data in it.
4. Third-party services
The Service relies on the following providers, which process some of this data on its behalf:
- LINE (LY Corporation): account sign-in and official account messages
- Supabase: database and authentication hosting
- Google Cloud: application runtime
- Google Analytics (Google LLC): site traffic analysis. It reports pages viewed, where visits came from, and device and browser type; the Service does not give Google your name, your LINE account or any member identifier, and has turned off Google signals and ad personalization. What your browser sends to Google (such as IP address, device information and cookies) is handled by Google under its own privacy policy
- Cloudflare: connection delivery, protection and site traffic statistics
- Meta Platforms (Facebook): advertising measurement. The Meta Pixel reports pages viewed, clicks on subscribe and sign-up buttons, and completed sign-ups; the Service does not give Meta your name, email address or LINE account, and what your browser sends to Meta (such as IP address, device information and cookies) is handled by Meta under its own privacy policy
- Anthropic (Claude API): generation of fixture analysis; nothing personal is sent
- Insanetec (payment provider): processes subscription payments. The Service sends only the order number, amount and plan name; you enter your payment details directly on its payment page, and it returns the payment result and the transaction data described above
Cross-border transfer: these providers may operate outside Taiwan, so your data may be stored or processed abroad.
5. How long we keep it
- Document acceptance and age confirmation records: kept permanently as compliance evidence
- Paid-content access records: 180 days
- Signed-out or expired session records: 30 days
- Order and payment records, including transaction data returned by the payment provider: for the period required by tax and accounting law
- All other personal data: until you delete your account
After you delete your account your personal data is anonymized. Order and payment records are retained where the law requires it, but are no longer linked to your identity.
6. Your rights
Under Taiwan's Personal Data Protection Act you may ask to review, read, obtain a copy of, supplement or correct, stop the collection, processing or use of, or delete the personal data the Service holds about you.
How to exercise them:
- Display name, profile picture and language preference can be viewed and changed yourself on the account page
- To delete your account, open a request in the support area; we verify your identity first and then handle it as described in section 5
- For anything else, open a ticket in the support area and we will act on it as soon as we receive it
Records the law requires us to keep, such as transaction and consent records, cannot be deleted on request.
7. How we protect it
- All connections are encrypted with HTTPS
- The database uses row-level access control; paid content, payment and log tables are readable only by the backend service
- Keys are stored encrypted, and the material needed to decrypt them is never held in the database
- Sign-in tokens are stored hashed; the plain value is returned once, when it is issued
- Logs redact sensitive fields such as tokens and keys, and never record the raw transaction data returned by the payment provider
No system can be guaranteed absolutely secure. If a security incident affects your rights, we will notify you as the law requires.
8. Minors
The Service is for people aged 18 and over and does not collect personal data from minors. Any account found to belong to someone under 18 will be terminated and its personal data deleted.
9. Changes to this policy
When this policy is revised, a new version is published with its effective date. Substantive changes to what we collect or why are put to you again for confirmation.
10. Contact
For requests or questions about personal data, open a ticket in the support area of the site, or contact the Service through its LINE official account, daily 09:00-23:00 Taipei time (GMT+8).
The registered name, business number, address and data protection contact of the operating entity will be added in the next version of this policy once business registration is complete.