REVL Privacy Policy

Last updated: August 7, 2026

This Privacy Policy explains how LUPOHMIGNS KFT, the company that operates REVL ("REVL," "we," "us") collects, uses, shares, and protects personal information when you visit revl.gg, use the REVL app, join our waitlist, or otherwise interact with our services (the "Service"). It also describes your privacy rights and how to exercise them.

By using the Service you agree to this Policy. If you do not agree, do not use the Service. This Policy is incorporated into our Terms of Service.

The Service is intended only for individuals 18 and older. We do not knowingly collect information from anyone under 18 (see Section 9).

1. Information We Collect

A. Information you provide

• Waitlist / contact: email address and any details you submit.
• Account: name, email, phone number, password, and username.
• Identity & age verification (KYC): date of birth, government-issued ID, and related documentation we or our verification providers use to confirm your identity, age, and residency.
• Payment & transactions: billing details and a record of your purchases, Reveals, Cards, sell-backs, Store Credit, Plays/Tokens, EXP, Reveal Credit, and redemptions. Full payment-card numbers are handled by our payment processor; we do not store complete card numbers.
• Shipping: mailing address and delivery information.
• Communications: messages, support requests, and survey or feedback responses.
• Store Credit and transactions. Your Store Credit balance and a ledger of every credit and debit (purchases, buyback proceeds, promotional credit) are stored on our servers so your balance is always accurate and auditable. Store Credit is not money: it cannot be purchased, withdrawn, or transferred, and it is spendable only inside REVL. Your balance and ledger are deleted permanently when you delete your account.
• Lucky Cam recordings. If you turn on Lucky Cam, the app records a short front-camera video (with audio) of your reveal. The clip uploads to our servers so you can preview it; it is visible to other users only if you choose "Post to Live." You can discard a clip instead of posting, and all your clips are deleted when you delete your account.

B. Information collected automatically

• Device & technical data: IP address, device identifiers, browser type, operating system, and app version.
• Usage data: pages and screens viewed, features used, Reveals, clicks, and timestamps.
• Location: approximate location derived from IP address, used to confirm eligibility and apply geographic restrictions.
• Cookies & similar technologies: see Section 6.
• Advertising identifiers. When you use our mobile apps we may collect your device's advertising identifier — the Identifier for Advertisers (IDFA) on iOS, or the Google Advertising ID (GAID) on Android. These are resettable identifiers provided by Apple and Google. On iOS we only collect the IDFA if you grant permission when we ask; on Android you can reset the identifier or opt out of personalised advertising at any time in your device settings.

C. Information from third parties

• Identity-verification and fraud-prevention providers, payment processors, analytics providers, and fulfillment/shipping partners may share information with us to deliver and secure the Service.

Sensitive personal information. Government ID and date of birth are treated as sensitive personal information. We collect and use them only to verify identity and age, to comply with law, and to prevent fraud — not to infer characteristics about you.

2. How We Use Information

We use personal information to:

• create and manage your account and provide the Service;
• verify your age, identity, and eligibility, and meet legal, regulatory, anti-fraud, and anti-money-laundering obligations;
• process purchases, shipments, sell-backs, and Store Credit;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• support responsible-use tools such as spending limits and self-exclusion;
• analyze and improve the Service and develop new features;
• communicate with you about your account, transactions, and service updates;
• send marketing communications where permitted or with your consent, from which you can opt out at any time; and
• comply with law and enforce our Terms.

Legal bases (where GDPR/UK GDPR applies): performance of our contract with you; compliance with legal obligations; our legitimate interests in operating, securing, and improving the Service; and your consent (which you may withdraw).

3. How We Share Information

We do not sell your personal information for money. We share it only as follows:

• Service providers / processors acting on our behalf, including payment processing, identity/age verification, fraud prevention, cloud hosting and database, email and messaging, analytics, and shipping/fulfillment. They may use the information only to provide services to us.
• Legal, safety, and compliance: to comply with law, lawful requests, or regulators; to enforce our Terms; or to protect the rights, safety, and property of REVL, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

"Sharing" for cross-context behavioral advertising (California). If we use advertising cookies that constitute "sharing" under California law, you may opt out as described in Sections 6 and 8.

4. Analytics and Advertising Technologies

Product analytics

We use analytics tools (which may include Mixpanel and PostHog) to understand how the Service is used and to improve it — for example, which screens you view, your taps and interactions, purchases, and app-lifecycle events. These analytics events may be linked to your account identifier and email so we can support you and improve your experience. These tools collect usage and device data, may set cookies or use similar identifiers, and process data under their own privacy terms.

Measuring our advertising

We advertise REVL on other platforms, and we measure which of those advertisements actually bring people to the app so we do not waste money on the ones that do not work. To do this we use:

• AppsFlyer, a mobile measurement partner, which records that an app install or app action followed a particular advertisement. AppsFlyer may process your advertising identifier, device information, IP address and an identifier we assign to your account.
• Google (Google Analytics for Firebase and Google Ads), for analytics and for measuring the performance of advertising campaigns.
• Meta (Facebook and Instagram) and TikTok, to measure and attribute advertising campaigns run on their platforms.

What we send to advertising platforms

When you take certain actions — for example opening the store, viewing a product, starting a checkout, or completing a purchase — we may report that event to the advertising platforms above so they can attribute it to the advertisement you saw. That report may include the identifier we assign to your account, your advertising identifier, your IP address, an advertisement click identifier, and your email address in an irreversibly hashed form. We do not send your email address, name, or payment details to advertising platforms in a readable form.

Apple's App Tracking Transparency

On iOS we ask for your permission before using your IDFA to measure advertising across other companies' apps and websites. If you decline, we do not use your IDFA, and the app works exactly the same. You can change this at any time in iOS Settings → Privacy & Security → Tracking.

Android advertising ID

On Android you can reset your advertising identifier, or opt out of personalised advertising, in Settings → Google → Ads.

"Sharing" for cross-context behavioral advertising (California)

The advertising measurement described in this section may constitute "sharing" under California law. You may opt out as described in Sections 6 and 8.

Where required, we obtain consent before deploying non-essential analytics or advertising technologies. You can control these through the methods in Sections 6 and 8.

5. Data Retention

We keep personal information for as long as needed to provide the Service and for legitimate business and legal purposes — for example, identity-verification and transaction records are retained as long as required by anti-money-laundering, tax, and consumer-protection laws. When information is no longer needed, we delete or de-identify it. When you delete your account, we delete your personal information, except limited records we are legally required to retain (such as transaction and tax records), which we keep only as long as the law requires and then delete.

6. Cookies and Similar Technologies

We use:

• Strictly necessary cookies to operate the Service, keep you logged in, and secure it;
• Functional cookies to remember your preferences;
• Analytics cookies to measure and improve performance; and
• Advertising cookies (if used) to measure and tailor marketing.

You can manage cookies through your browser settings and, where offered, through our in-product cookie controls or a "Your Privacy Choices" link. Blocking some cookies may affect how the Service works. We honor Global Privacy Control (GPC) browser signals as a valid opt-out of "sale"/"sharing" where applicable.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and tokenization of payment data by our processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a strong, unique password and keeping your credentials confidential.

8. Your Privacy Rights

All users. You may access, update, or delete account information and unsubscribe from marketing at any time via your account or by emailing privacy@revl.gg. Some records may be retained where the law requires — see Section 5.

California residents (CCPA/CPRA). You have the right to: know and access the personal information we collect; know what is disclosed or "shared"; correct inaccurate information; delete personal information; opt out of any "sale" or "sharing" of personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising these rights. We do not sell personal information. To exercise rights, including opting out of the "sharing" described in Section 4, contact us at privacy@revl.gg or, where offered, use "Your Privacy Choices." You may use an authorized agent. We will verify your request before responding.

EEA/UK residents (GDPR/UK GDPR). You have the right to access, rectify, erase, restrict, or object to processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your supervisory authority. Contact privacy@revl.gg.

Other states. Residents of states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out; contact us to exercise them.

We respond to verifiable requests within the timeframes required by applicable law.

9. Children's Privacy

The Service is for adults 18 and older. We do not knowingly collect personal information from children. Consistent with the Children's Online Privacy Protection Act (COPPA), if we learn we have collected information from anyone under 13 — or from any minor under 18 — we will delete it. If you believe a minor has provided us information, contact privacy@revl.gg.

10. International Data Transfers

REVL is operated by LUPOHMIGNS KFT, which is established in Hungary (European Union). We and our service providers may access and process personal information in the European Union, the United States, Israel, and other countries. These countries may have data-protection laws different from your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or reliance on adequacy decisions) for cross-border transfers. By using the Service, you understand your information may be processed in these locations.

11. Third-Party Links

The Service may link to third-party sites or services (for example, eBay listings used for valuation reference, or payment pages). We are not responsible for their privacy practices. Review their policies before providing information.

12. Changes to This Policy

We may update this Policy. If we make material changes, we will provide notice (for example, by email or in-app) and update the "Last updated" date. Continued use after the effective date means you accept the updated Policy.

13. Contact Us

LUPOHMIGNS KFT 1204 Budapest, Mártírok útja 290, Hungary EU VAT HU27450037 Data controller: LUPOHMIGNS KFT Privacy requests: privacy@revl.gg General: hello@revl.gg