Privacy Notice

Effective date: August 6, 2026

SuperLeagues, Inc., and as applicable, its subsidiaries and affiliates (collectively, "SuperLeagues," "we," "our," or "us") own and operate the SuperLeagues mobile application and website, located at superleagues.com, through which we offer free-to-play fantasy sports leagues, collectible player cards, powerups, and related products and services (collectively, the "Services"). Before accessing or using the Services, please read this Privacy Notice (the "Privacy Notice" or "Notice").

This Privacy Notice is supplemental to, and hereby incorporates by reference, our Terms of Service (the "Terms"). This Notice and the Terms, together with any additional terms or documents referenced herein, form an agreement between you and us in connection with the Services. Any capitalized terms not defined herein have the meaning given to them in the Terms. IF YOU DO NOT AGREE TO THIS PRIVACY NOTICE, YOU MUST NOT ACCESS OR OTHERWISE USE THE SERVICES.

This Privacy Notice sets forth our practices for handling the information that we collect from or about you. It applies to all Services offered by SuperLeagues where this Notice is linked or otherwise referenced. By accessing the Services, you are consenting to the information collection and use practices described herein.

1. Collection of Information

We collect several types of information from and about users of our Services. This information is provided to us either directly by you or through your use of our Services.

Information you provide to us

• Sign-in information. You sign in to SuperLeagues with your Apple or Google account. When you do, we receive your name, email address, a unique account identifier, and (if provided) your avatar from that provider. We never see or store your Apple or Google password.
• Profile information. Your display name, handle, bio, and any profile or cover photos you upload.
• Services engagement information. Your league activity and fantasy gameplay data — league memberships, roster compositions, lineups, matchup results, draft picks, waiver activity, trade histories, SuperPacks you open, player cards you collect, powerups you play, watchlists, and achievements — as well as information collected when you invite friends to use the Services.
• Chat, message, and call information. Messages you send in league chat and direct messages, including photos and images you attach, and your participation in voice calls within leagues.
• Commercial information. Records of your in-app purchases — SuperCoins purchases and your SuperPass subscription status. Purchases are processed by the app store you downloaded SuperLeagues from — the Apple App Store or Google Play — and we receive transaction and product identifiers so we can deliver what you bought. We never see or store your payment card details.
• Correspondence and other information that you provide when you contact us through our support channels, respond to communications we send you, or otherwise submit information through the Services.

Information we collect automatically

When you use the Services, we may automatically collect certain information from your device, including:

• Device type, operating system, and app version;
• Internet protocol (IP) address;
• A push notification token, so we can deliver notifications you've enabled;
• Your device's timezone setting, so notifications arrive at sensible times;
• Application usage information — screens viewed, features used, and session activity — collected through our analytics provider and linked to your account identity;
• Error and diagnostic information, including information about the error, the time it occurred, and the state of the application when it occurred;
• Standard server log information.

We do not collect precise geolocation, and we do not use the advertising identifier (IDFA) or any cross-app tracking technology.

Information from third parties

We receive limited information about you from the third-party sign-in providers described above (Apple and Google) when you create your account or sign in. Information collected by those providers is also subject to their own privacy policies.

2. Use of Information and Purpose of Data Processing

We use and otherwise process each of the categories of information identified above for various business purposes, including but not limited to:

• Administering and providing the Services — allowing you to participate in leagues, drafts, matchups, SuperPacks, powerups, and trades; engaging with other users through chat, direct messages, and voice calls; managing your account; and delivering your purchases;
• Communicating with you — sending you service notifications (for example, draft reminders, matchup updates, and trade activity), responding to your support requests, and notifying you about changes to this Notice or our Terms;
• Improving our Services — troubleshooting, data analytics, testing, and research so we can understand which features are used, where things break, and how to make SuperLeagues better; we may also create aggregate or de-identified information that is no longer subject to this Notice;
• Keeping our Services, business, and users safe and secure — including detecting, preventing, and investigating fraud, cheating, abuse, and violations of our Terms or other rules; we may review chat and message content for these purposes, for example in response to a user report;
• Complying with applicable laws and regulations and protecting or exercising our legal rights, including defending against legal claims;
• As described to you when collecting your information, or with your consent.

3. Disclosure of Information

We are committed to maintaining your trust, and we want you to understand when and with whom we may share the information we collect:

• Authorized service providers. We share information with third-party vendors who provide services to us, only what they need to do their job: Apple (sign-in and payment processing), Google (sign-in, and payment processing via Google Play), RevenueCat (subscription management for SuperPass), Amplitude (usage analytics), LiveKit (real-time infrastructure for voice calls), DigitalOcean (application and database hosting), Amazon Web Services (S3 storage for images and media), and Cloudflare (network security and content delivery). These providers are bound to use your data only to provide services on our behalf.
• Other users and social features. The Services are inherently social and league-based. Certain information about you — such as your display name, handle, avatar, team name, rosters, lineups, matchup results, trades, card collection activity, and powerup plays — is visible to other members of your leagues. Messages you send in league chat are visible to all members of that league. Depending on your activity, other users may share or reference this information. Use caution in what you disclose in chat and on your profile; we are not responsible for information you choose to share with other users.
• Public share links. If you or a league member shares a link to certain content (for example, a share card or public profile link), the shared content is accessible to anyone with the link, including people who are not SuperLeagues users.
• Corporate affiliates and business transfers. We may share your information with our corporate affiliates, and in connection with a corporate transaction such as a sale, merger, consolidation, financing, or in the unlikely event of a bankruptcy.
• Legal purposes. We may disclose your information to respond to subpoenas, court orders, legal process, law enforcement requests, and government or regulatory inquiries, and to protect and defend the rights, interests, safety, and security of SuperLeagues, our affiliates, users, and the public.
• With your consent or at your direction. We may share your information for any other purpose disclosed to you at the time we collect it, pursuant to your consent or direction.

4. What We Don't Do

• We do not sell your personal information, and we have not done so in the preceding 12 months.
• We do not share your personal information for cross-context behavioral or targeted advertising.
• We do not show third-party ads or include advertising SDKs in the app.
• We do not track you across other companies' apps or websites, and we do not use the advertising identifier (IDFA).
• We do not collect precise geolocation, government identification numbers, or financial account numbers.

5. Cookies and Similar Technologies

Our website uses a small number of cookies and similar technologies that are essential to operate and secure the site (for example, those set by our content delivery and security provider). We do not use advertising cookies on our website or in our app.

Global Privacy Control and Do Not Track. Because we do not sell personal information or share it for targeted advertising, there is no "sale" or "sharing" to opt out of. Where applicable law requires us to honor a Global Privacy Control ("GPC") signal, we will make reasonable efforts to do so. Because there is not yet a common understanding of how to interpret "Do Not Track" signals, we do not currently respond to them.

6. Device Permissions

SuperLeagues may ask for access to your camera and photo library (to set profile photos and share images in chat), your microphone (for voice calls in leagues), and notifications. Each permission is optional, is requested only when you use the related feature, and can be revoked at any time in your device settings.

7. U.S. State Privacy Rights

Depending on your state of residence, you may have specific rights regarding your personal information under applicable U.S. state privacy laws. This section describes those rights and how to exercise them. For any of the following requests, we will first verify your identity, and we may request additional information from you to do so.

• Right to know and data portability. You may request that we disclose the categories of information we collect about you, the categories of sources, our purposes for collecting it, the categories of third parties with whom we share it, and the specific pieces of information we hold about you, in a portable format.
• Right to delete. You may request that we delete the personal information we have collected about you, subject to certain exceptions described in the "Data Retention" section below.
• Right to correct. You may request correction of any inaccurate information we hold about you. You can update most profile information directly in the app.
• Right to opt out of sale or targeted advertising. We do not sell your personal information or use it for targeted advertising, so there is no such processing to opt out of.
• Right to non-discrimination. We will not discriminate against you for exercising any of your privacy rights.
• Automated decision-making and profiling. We do not carry out profiling or automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, email us at support@superleagues.com. If you are in a jurisdiction that permits the use of an authorized agent, your agent may submit a request on your behalf to the same address, along with documentation of their authority. If you are in a jurisdiction that provides a right of appeal and we decline your request, you may appeal our decision by replying to our response or emailing us with the word "Appeal" in the subject line, along with the state you are writing from.

8. Minors

Our Services are intended only for people aged 18 and over. They are not directed at anyone under 18, and we do not knowingly collect or retain personal information from anyone under 18. If we discover that someone under 18 has submitted personal information through the Services, we will promptly delete the information and the associated account. If you are a parent or legal guardian and believe your child has provided personal information to us, please contact us at support@superleagues.com and we will ensure the information is deleted.

9. Availability and Data Location

The Services are offered from the United States and are intended for users located in the United States. We and our third-party vendors are based in the United States, and by using our Services you understand that your information is collected, stored, and processed on servers located in the United States. To the extent we disclose your information to third-party vendors, we use contractual safeguards to help ensure that such vendors are bound to duties of confidentiality. If you do not consent to these data practices, please do not use the Services.

10. Data Retention, Security, and Integrity

Your information will be retained only for as long as reasonably necessary for the purposes set out in this Notice and in accordance with applicable law. When your account is deleted, we delete your personal information, except where we are required to retain certain records to: (a) meet legal or accounting obligations (for example, purchase records); (b) prevent fraud or promotional abuse; (c) prevent attempts to create duplicate accounts; or (d) for any other reason permitted under law. You can delete your account and data at any time in the app under Profile → Settings → Profile → Delete Account, or by emailing support@superleagues.com.

We maintain physical, electronic, and procedural safeguards designed to protect your information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction, and we restrict access to non-public personal information to those who need it to provide the Services. However, no data storage system or transmission of data over the internet can be guaranteed to be 100% secure.

11. Changes to this Privacy Notice

We may modify this Notice from time to time. When we do, we will revise the "Effective date" above and post the updated Notice. If we make material changes, we may also notify you in the app. We recommend that you review this Notice periodically to stay informed of our practices.

12. Contact

Any questions, comments, complaints, or requests pertaining to this Privacy Notice should be emailed to support@superleagues.com.