Privacy Policy — Zero Phone-List Sharing & Minimal Data Storage

1. Minimal Onboarding Data — Why We Skip Intrusive Document Uploads

Data breaches happen when companies hoard sensitive scans they never needed in the first place. When you open an account on Play99win via our official desk (8626043284), we deliberately keep your personal footprint down to the bare operational minimum required to run an accurate rupee ledger:

• Your WhatsApp mobile number used to request credentials and authorize payouts.
• Your chosen exchange username and salted, hashed login passphrase.
• Transaction timestamps, rupee amounts, and 12-digit NPCI UTR references for UPI/IMPS reconciliation.
• Basic browser session metadata (IP address and device user-agent) solely to block automated credential-stuffing attacks on your account gateway.

We do not collect Aadhaar biometrics, credit card numbers, contact-book permissions, or background GPS location data.

Why does that restraint matter so much in the Indian online gaming space? Over the past four years, dozens of offshore portals and careless white-label panels demanded full front-and-back Aadhaar photos, PAN scans, and live selfies from ₹500 depositors, only to store those unencrypted JPEGs inside misconfigured cloud folders that later leaked onto public forums. By limiting standard onboarding to your WhatsApp phone number and bank-verified 12-digit UTR trail, we eliminate document-harvesting exposure at the root.

Only when an account exhibits clear anti-fraud anomalies, such as attempting to deposit from one person's UPI handle and withdraw to an unrelated third party's IMPS bank account, or disputing bank ownership after a SIM swap, will our compliance supervisor ask for minimal holder confirmation to protect the rightful owner of those funds. Even then, any verification image is reviewed solely by the shift compliance lead and deleted immediately once bank ownership is confirmed.

Browser analytics on our informational guides are similarly stripped of personal identifiers. We measure aggregate page load speed, mobile viewport ratios, and broken-URL 404 counts from server logs without building individual cross-site advertising profiles or selling retargeting audiences to ad networks.

2. How WhatsApp Chat Threads and Bank UTR Receipts Are Handled

Payment screenshots sent to 8626043284 are used strictly by our duty cashier to match incoming UPI credits and outgoing IMPS settlements. Once reconciled against our accounting ledger, raw chat media attachments are purged on a rolling 90-day cycle so old banking screenshots do not sit indefinitely on operator devices.

Internal cashier access follows strict shift-role separation: front-line support operators assisting with mirror links or market grading queries cannot export customer phone lists or view historical payout accounts.

Database backups holding rupee wallet ledgers are encrypted at rest using AES-256 standards on isolated Linux volumes with restricted SSH key authentication and zero public port exposure. Administrative actions, such as manual password resets or registered bank-handle updates requested by the user on 8626043284, write an internal audit entry recording the shift operator ID and timestamp so no unauthorized staff member can touch user records unnoticed.

We also refrain from sending unsolicited promotional WhatsApp broadcasts, festival deposit nudges, or push notifications that could appear unexpectedly on a locked phone screen at work or home. Every message from our desk is a direct reply to an inquiry, deposit receipt, mirror request, or withdrawal instruction initiated by you.

3. Transport Encryption and Lightweight Browser Storage

Every request to `play99win.ai` runs exclusively over HTTPS with TLS 1.2/1.3 encryption, Strict-Transport-Security headers, and strict Content-Security-Policy rules. On our public informational pages, we do not load invasive cross-site ad trackers, Facebook pixels, or third-party behavioral fingerprinting scripts.

Our site stores a single lightweight timestamp key (`p99w_popup_dismissed_until`) inside your browser's own `localStorage` when you close the WhatsApp instant-ID prompt so the notice stays quiet for seven days. Inside the authenticated trading panel, an encrypted HTTP-only session cookie keeps your slip state active and expires automatically on logout or idle timeout.

4. Zero Third-Party Phone List Broking and Account Closure Rights

If you have ever signed up with a shady street panel and suddenly received twenty spam SMS messages a day from rival bookies, your number was sold on a Telegram lead sheet. We enforce an absolute zero-sale, zero-rental, zero-sharing rule on user phone numbers and transaction histories.

You may close your wallet and request erasure of active contact records anytime: first withdraw any remaining rupee balance down to ₹0 via our 24/7 cashier desk, then send "CLOSE AND PURGE ACCOUNT" from your registered mobile number to 8626043284. Also see our self-exclusion safeguards if you need an immediate cooling-off lock.

Your device-side privacy habits play an equally important role in keeping rupee exchange activity private on shared or commuter phones. Enable WhatsApp fingerprint or Face ID chat lock on our 8626043284 thread so colleagues or family members borrowing your handset cannot read deposit receipts or temporary reset codes. Avoid signing into your exchange wallet on public cyber-cafe desktops or hotel smart TVs, never let shared browsers auto-save your passphrase, and log out cleanly after late-night matches.

Whenever upstream hosting providers or content delivery nodes process encrypted HTTPS requests for `play99win.ai`, standard short-lived access logs rotate automatically within fourteen days and are used exclusively for DDoS mitigation, broken-link diagnostics, and server health monitoring. Should we ever update this privacy notice to reflect new NPCI payment verification standards, the revision date in our page metadata updates transparently so returning users can review every change in plain English.

Look closely at what our front-end pages refuse to load compared with ad-bloated sports portals. Open your browser's Network inspector on any page of this site and verify for yourself: zero Google DoubleClick ad beacons, zero TikTok or Meta retargeting scripts, zero third-party chat iframes phoning home to unknown domains, and zero external webfont requests leaking your IP address to third-party font CDNs. Every stylesheet, SVG icon, and Latin font file serves directly from our own encrypted server container without tracking cookies following your phone across unrelated news or shopping apps later in the evening.

If you ever receive an unexpected message on another app claiming your account ledger was transferred to a "sister website," treat that claim as a phishing attempt and report the sender screenshot to 8626043284 so our security shift can warn fellow users promptly. We operate strictly under our single verified domain `play99win.ai` and our single published WhatsApp cashier number, never selling, migrating, or sub-licensing active member accounts to outside operators or marketing affiliates. Your privacy, banking hygiene, and quiet peace of mind come before every rupee of volume on our exchange.