REVL Privacy Policy

Last updated: September 1, 2026

This Privacy Policy explains how LUPOHMIGNS KFT, the company that operates REVL ("REVL," "we," "us") collects, uses, shares, and protects personal information when you visit revl.gg, use the REVL app, join our waitlist, or otherwise interact with our services (the "Service"). It also describes your privacy rights and how to exercise them.

By using the Service you agree to this Policy. If you do not agree, do not use the Service. This Policy is incorporated into our Terms of Service.

The Service is intended only for individuals 18 and older. We do not knowingly collect information from anyone under 18 (see Section 9).

1. Information We Collect

A. Information you provide

• Waitlist / contact: email address and any details you submit.
• Account: name, email, phone number, password, and username.
• Signing in with Google or Apple. If you choose to sign in with Google or Apple, that provider gives us your name, email address, and a unique identifier for your account — and nothing else. We never receive your password, and we do not request or access your contacts, files, calendar, photos, or any other content in your Google or Apple account. We use this information only to create and secure your REVL account, to recognise you when you return, and to contact you about your account. We do not sell it, and we do not use it for advertising or to build a profile of you. It is stored with your account and deleted when you delete your account (see Section 8). If you use Apple's Hide My Email, we only ever see the relay address Apple provides, never your real one.
• Identity & age verification (KYC): date of birth, government-issued ID, and related documentation we or our verification providers use to confirm your identity, age, and residency.
• Payment & transactions: billing details and a record of your purchases, Reveals, Cards, sell-backs, Store Credit, Plays/Tokens, EXP, Reveal Credit, and redemptions. Full payment-card numbers are handled by our payment processor; we do not store complete card numbers.
• Shipping: mailing address and delivery information.
• Communications: messages, support requests, and survey or feedback responses.
• Store Credit and transactions. Your Store Credit balance and a ledger of every credit and debit (purchases, buyback proceeds, promotional credit) are stored on our servers so your balance is always accurate and auditable. Store Credit is not money: it cannot be purchased, withdrawn, or transferred, and it is spendable only inside REVL. Your balance and ledger are deleted permanently when you delete your account, apart from the fraud-prevention record described in Section 5, which notes only that a promotional credit was issued and carries no balance, no transaction history and no readable identifier.
• Lucky Cam recordings. If you turn on Lucky Cam, the app records a short front-camera video (with audio) of your reveal. The clip uploads to our servers so you can preview it; it is visible to other users only if you choose "Post to Live." You can discard a clip instead of posting, and all your clips are deleted when you delete your account.

B. Information collected automatically

• Device & technical data: IP address, device identifiers, browser type, operating system, and app version.
• Usage data: pages and screens viewed, features used, Reveals, clicks, and timestamps.
• Location: approximate location derived from IP address, used to confirm eligibility and apply geographic restrictions.
• Cookies & similar technologies: see Section 6.
• Advertising identifiers. When you use our mobile apps we may collect your device's advertising identifier — the Identifier for Advertisers (IDFA) on iOS, or the Google Advertising ID (GAID) on Android. These are resettable identifiers provided by Apple and Google. On iOS we only collect the IDFA if you grant permission when we ask; on Android you can reset the identifier or opt out of personalised advertising at any time in your device settings.

C. Information from third parties

• Identity-verification and fraud-prevention providers, payment processors, analytics providers, and fulfillment/shipping partners may share information with us to deliver and secure the Service.

Sensitive personal information. Government ID and date of birth are treated as sensitive personal information. We collect and use them only to verify identity and age, to comply with law, and to prevent fraud — not to infer characteristics about you.

2. How We Use Information

We use personal information to:

• create and manage your account and provide the Service;
• verify your age, identity, and eligibility, and meet legal, regulatory, anti-fraud, and anti-money-laundering obligations;
• process purchases, shipments, sell-backs, and Store Credit;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• support responsible-use tools such as spending limits and self-exclusion;
• analyze and improve the Service and develop new features;
• communicate with you about your account, transactions, and service updates;
• send marketing communications where permitted or with your consent, from which you can opt out at any time; and
• comply with law and enforce our Terms.

Legal bases (where GDPR/UK GDPR applies): performance of our contract with you; compliance with legal obligations; our legitimate interests in operating, securing, and improving the Service; and your consent (which you may withdraw).

3. How We Share Information

We do not sell your personal information for money. We share it only as follows:

• Service providers / processors acting on our behalf, including payment processing, identity/age verification, fraud prevention, cloud hosting and database, email and messaging, analytics, and shipping/fulfillment. They may use the information only to provide services to us.
• Legal, safety, and compliance: to comply with law, lawful requests, or regulators; to enforce our Terms; or to protect the rights, safety, and property of REVL, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

"Sharing" for cross-context behavioral advertising (California). If we use advertising cookies that constitute "sharing" under California law, you may opt out as described in Sections 6 and 8.

4. Analytics and Advertising Technologies

Product analytics

We use analytics tools (which may include Google Analytics, Vercel Web Analytics, Mixpanel and PostHog) to understand how the Service is used and to improve it — for example, which screens you view, your taps and interactions, purchases, and app-lifecycle events. These analytics events may be linked to your account identifier and email so we can support you and improve your experience. These tools collect usage and device data, may set cookies or use similar identifiers, and process data under their own privacy terms.

Measuring our advertising

We advertise REVL on other platforms, and we measure which of those advertisements actually bring people to the app so we do not waste money on the ones that do not work. To do this we use:

• AppsFlyer, a mobile measurement partner, which records that an app install or app action followed a particular advertisement. AppsFlyer may process your advertising identifier, device information, IP address and an identifier we assign to your account.
• Google (Google Analytics for Firebase and Google Ads), for analytics and for measuring the performance of advertising campaigns.
• Meta (Facebook and Instagram) and TikTok, to measure and attribute advertising campaigns run on their platforms.

What we send to advertising platforms

When you take certain actions — for example opening the store, viewing a product, starting a checkout, or completing a purchase — we may report that event to the advertising platforms above so they can attribute it to the advertisement you saw. That report may include the identifier we assign to your account, your advertising identifier, your IP address, an advertisement click identifier, and your email address in an irreversibly hashed form. We do not send your email address, name, or payment details to advertising platforms in a readable form.

Apple's App Tracking Transparency

On iOS we ask for your permission before using your IDFA to measure advertising across other companies' apps and websites. If you decline, we do not use your IDFA, and the app works exactly the same. You can change this at any time in iOS Settings → Privacy & Security → Tracking.

Android advertising ID

On Android you can reset your advertising identifier, or opt out of personalised advertising, in Settings → Google → Ads.

"Sharing" for cross-context behavioral advertising (California)

The advertising measurement described in this section may constitute "sharing" under California law. You may opt out as described in Sections 6 and 8.

Where required, we obtain consent before deploying non-essential analytics or advertising technologies. You can control these through the methods in Sections 6 and 8.

5. Data Retention

We keep personal information for as long as needed to provide the Service and for legitimate business and legal purposes — for example, identity-verification and transaction records are retained as long as required by anti-money-laundering, tax, and consumer-protection laws. When information is no longer needed, we delete or de-identify it. When you delete your account, we delete your personal information, except limited records we are legally required to retain (such as transaction and tax records), which we keep only as long as the law requires and then delete. We also keep one record for fraud prevention: a one-way, salted hash of the email address or sign-in identifier you signed up with, retained after deletion solely so that a promotional credit already given out once cannot be claimed again by deleting and recreating an account. It is not reversible to your email address, we cannot use it to identify or contact you, and it is used for nothing else.

6. Cookies and Similar Technologies

We use:

• Strictly necessary cookies to operate the Service, keep you logged in, and secure it;
• Functional cookies to remember your preferences;
• Analytics cookies to measure and improve performance; and
• Advertising cookies (if used) to measure and tailor marketing.

Your choice on this website. When you first visit revl.gg we ask before storing anything on your device. Unless you accept, Google Analytics runs in a restricted mode: it sets no cookies and keeps no identifier for you, and reports only aggregate, cookieless measurement — enough to count visits, not to recognise you or follow you between sessions. Accept and it measures your visit in the ordinary way, with cookies. Either way we never send it the seed values from the Provably Fair page. You can change your mind at any time with the Cookie settings link in the footer of every page. Our Meta advertising pixel is gated more strictly still: unless you accept, it is not loaded at all, your browser never contacts Meta, and no advertising cookie is set. There is no reduced mode for it — before you accept, it is simply absent.

Vercel Web Analytics is not gated behind that choice: it is first-party, sets no cookies, stores nothing on your device, and does not track you across other sites. We record only the page viewed, and campaign parameters where present.

You can also manage cookies through your browser settings. Blocking some cookies may affect how the Service works. We honor Global Privacy Control (GPC) browser signals as a valid opt-out of "sale"/"sharing" where applicable.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and tokenization of payment data by our processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a strong, unique password and keeping your credentials confidential.

8. Your Privacy Rights

All users. You may access, update, or delete account information and unsubscribe from marketing at any time via your account or by emailing privacy@revl.gg. Some records may be retained where the law requires — see Section 5.

California residents (CCPA/CPRA). You have the right to: know and access the personal information we collect; know what is disclosed or "shared"; correct inaccurate information; delete personal information; opt out of any "sale" or "sharing" of personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising these rights. We do not sell personal information. To exercise rights, including opting out of the "sharing" described in Section 4, contact us at privacy@revl.gg or, where offered, use "Your Privacy Choices." You may use an authorized agent. We will verify your request before responding.

EEA/UK residents (GDPR/UK GDPR). You have the right to access, rectify, erase, restrict, or object to processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your supervisory authority. Contact privacy@revl.gg.

Other states. Residents of states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out; contact us to exercise them.

We respond to verifiable requests within the timeframes required by applicable law.

Canadian residents (PIPEDA). You may request access to the personal information we hold about you, request correction of inaccurate information, and withdraw consent subject to legal and contractual restrictions. You may also complain to the Office of the Privacy Commissioner of Canada. Contact privacy@revl.gg.

9. Children's Privacy

The Service is for adults 18 and older. We do not knowingly collect personal information from children. Consistent with the Children's Online Privacy Protection Act (COPPA), if we learn we have collected information from anyone under 13 — or from any minor under 18 — we will delete it. If you believe a minor has provided us information, contact privacy@revl.gg.

10. International Data Transfers

REVL is operated by LUPOHMIGNS KFT, which is established in Hungary (European Union). We and our service providers may access and process personal information in the European Union, the United States, Israel, and other countries. These countries may have data-protection laws different from your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or reliance on adequacy decisions) for cross-border transfers. By using the Service, you understand your information may be processed in these locations.

11. Third-Party Links

The Service may link to third-party sites or services (for example, eBay listings used for valuation reference, or payment pages). We are not responsible for their privacy practices. Review their policies before providing information.

12. Changes to This Policy

We may update this Policy. If we make material changes, we will provide notice (for example, by email or in-app) and update the "Last updated" date. Continued use after the effective date means you accept the updated Policy.

13. Contact Us

LUPOHMIGNS KFT 1204 Budapest, Mártírok útja 290, Hungary EU VAT HU27450037 Data controller: LUPOHMIGNS KFT Privacy requests: privacy@revl.gg General: hello@revl.gg