FantasyArena Pro — Privacy Policy
Version 2026-10-11
1. Who we are and what this policy covers
1.1 FantasyArena Pro ("FantasyArena", "we", "us") is made and run by AX Labs, a business registered in Bangladesh under a trade licence. AX Labs decides what personal information the app uses and why, so under Bangladesh's data protection law we are responsible for it (the "data fiduciary").
1.2 This policy covers the FantasyArena Pro app, our website fantasyarenapro.online, and Support. It says what we keep, why, who handles it for us, how long we keep it, and what you can do about it.
1.3 You can reach us through Support in the app (More › Support, on Telegram) or by email at privacy@fantasyarenapro.online. A request about your data can be made either way; we treat it as a written request.
1.4 This policy is written in English. A Bengali translation is published on our website; if the two differ, the English text decides.
2. The short version
- We keep what we need to run your account, your contests and your wallet, and to keep the game fair. We do not collect anything for advertising.
- We never sell your information, show ads, or give your information to anyone for their own use. We never read your location, contacts, photos or messages.
- Other players see your Team Name and colour, and your teams, points, ranks and prizes. They never see your mobile number, your name, your private details or your money.
- A few companies run parts of the app for us (hosting, security, notifications, SMS, email). Some of them are outside Bangladesh (sections 6 and 7).
- If you close your account, we erase your private details. The record of your money stays on our books for 6 years, then without anything that links it to you (section 9).
- You can see, correct and get a copy of your information, withdraw a consent, pause your account or close it (section 10).
3. What we keep, and why
3.1 Your account. Your mobile number (it is your account and how we send you codes); your Team Name and the Team Names you had before (so nobody can take a name you just gave up and pose as you); your Player ID; your password, kept only as a one-way scrambled form (bcrypt) that nobody can turn back into your password, not even our staff; your email address, if you add one (for codes when you forget your password); when you registered, and which version of the Terms and of this policy you accepted and when; and, if you registered with a refer code, which code.
3.2 Your private details (My Profile). Your full name, which we need before your first withdrawal: it must be the name on the bKash, Nagad or Rocket account you withdraw to. Optional: your date of birth, gender, district, upazila, the area, road and house line of your address, and your postcode. You choose whether to give these. The area, road and house line is stored encrypted, with a key kept apart from the database.
3.3 Your play. The teams you make, your captain and vice-captain, the contests you join, your points, ranks and prizes, and your choices in the app (for example which notifications you want).
3.4 Your wallet. Every deposit, withdrawal, entry fee, prize, refund, bonus and refer reward: the amount and the time; for a deposit or a withdrawal, the method (bKash, Nagad or Rocket), the number you sent from or were paid to, the transaction ID (TrxID), our receiving number, and our staff's decision and notes. We need these to keep your wallet right, to check deposits and pay withdrawals, and to keep our books and pay our taxes.
3.5 Facts about your phone and connection. When you register and each time you log in, the app (from version 2.2.0) sends us:
- a code made from your phone's Android ID, scrambled with our own key so that the Android ID itself never reaches us;
- whether the app runs in a second user, a work profile or a cloned app;
- whether the phone looks like an emulator, and whether a VPN is on.
Our server adds your network (IP) address and the country our network provider (Cloudflare) sees for it, and notes when each phone was first and last seen on your account. We also note the network address that asked for each SMS or email code.
Why: to spot one person holding several accounts (Terms 3.3 and 4.6), to protect the sign-up bonus and refer rewards, to limit how many codes can be asked for, and to keep accounts safe.
What they can do on their own: if your phone was already used by another account, runs a second profile or looks like an emulator, your sign-up bonus or a refer reward can be held automatically until one of our staff looks at it. A VPN, a foreign country or a shared address is only shown to staff and never holds anything by itself. A person makes the decision, and we tell you what was decided (Terms 4.6 and 12.3).
3.6 Codes and notifications. For each SMS code: the number it went to, when, and whether it was sent; the code itself is kept only in a scrambled form. The same for each email code, with the email address. For notifications: the address Firebase gives the app on your phone (a "push token") and the app's version, and the notifications we showed you in the app.
3.7 Support and our staff's records. What you tell Support, and requests you make (for example asking the admin to reset your password). Our staff's log records every action staff take on your account: who did what, and when.
3.8 Our website. It uses no cookies and asks you for nothing. It counts visits without identifying you. When you open a refer link, we count the click for that code, without keeping your network address.
3.9 On your phone. The app keeps your sign-in, your number and Team Name to fill in the login card, and your notification choices. Logging out removes the sign-in; uninstalling the app removes everything.
3.10 What we never collect. Your location, contacts, photos or files, camera or microphone, your text messages, your NID, or an advertising ID. The app has no advertising or analytics tools and does not follow you across other apps or sites. When you register or reset your password, Android's SMS Retriever may hand the app the one text that carries our code; the app has no permission to read your messages. The app asks only for the internet, notifications (you may refuse) and permission to install its own updates (Android asks you each time).
4. Your consent, and when we do not need it
4.1 To run what you signed up for, we do not need a separate consent. Your account, your contests, your wallet, your withdrawals and the fair-play checks are the agreement between us (the Terms), and the law lets us use the information that agreement needs. Without it the app cannot work.
4.2 We still ask for your consent, apart from the Terms. When you register, a box of its own (never ticked for you) asks you to agree to this Privacy Policy, including the facts about your phone (3.5) and keeping your information with service providers outside Bangladesh (section 7). We record when you agreed and to which version.
4.3 Some things are only by your choice: your date of birth, gender and address, your email address, and notifications. You give them when you want and can remove them at any time.
4.4 Withdrawing a consent. You can remove your optional details in My Profile, remove your email address, and turn notifications off in the app's Settings or in Android. If you no longer agree to the rest of this policy, tell Support: the app cannot run without its servers and fair-play checks, so we will close your account as section 9 says. Withdrawing a consent does not make what we did before it wrong.
5. Who can see your information
5.1 Other players see your Team Name and colour. When a match locks, everyone can see everyone's teams (Terms 5.2), and contest leaderboards show each team's points, rank and prize. The season table shows each player's matches, wins and points. Other players never see your mobile number, full name, private details, wallet, deposits or withdrawals.
5.2 Refer codes. If you registered with a player's refer code, that player sees your Team Name and colour, the day you joined, and how far you have come: joined, being checked, rewarded, or not counted. They never see your money, or whether you have deposited. A partner sees only totals for their codes, not who.
5.3 Our staff and agents (people working for AX Labs, including those who hold our receiving numbers). Each has only the permissions their role needs:
- Support sees your account (number, Team Name, full name, wallet) to help you;
- the person who checks your deposit or sends your withdrawal sees what that needs: the amount, the numbers, the TrxID and, for a withdrawal, your full name;
- your date of birth, gender and address can be opened only by staff given that permission, and every opening is recorded.
Staff sign in with a password and a 6-digit code, and everything they change is recorded in a log nobody can edit. Our staff will never ask for your password, your codes or your MFS PIN.
5.4 Service providers that run parts of the app for us (section 6).
5.5 Authorities. We give information to a court, the police or another authority only against a proper legal order or a written demand the law entitles them to make. We check that it is genuine, give only what it covers, and tell you unless the law does not allow us to.
5.6 If the business changes hands. If AX Labs's business passes to someone else, your information goes with it only under this policy, and we tell you first.
5.7 Nobody else. We never sell, rent or trade your information, and never give it to anyone for advertising or for their own use.
6. The companies that run parts of the app for us
6.1 These companies handle information only to do their job for us, under their own security and privacy terms:
| Company | What it does for us | What it handles | Where |
|---|---|---|---|
| Heroku (Salesforce) | runs our server and database | everything in section 3 that we keep | the European Union (Ireland) |
| Cloudflare | protects and delivers our server, our website and our staff's website | every request to us, with your network address | its network worldwide |
| Google (Firebase Cloud Messaging) | delivers notifications to your phone | your push token and the notification's words | worldwide |
| SMSnoc | sends SMS codes | your mobile number and the text with the code | Bangladesh |
| Mailtrap (Railsware) | sends email codes | your email address and the email with the code | outside Bangladesh |
| GitHub (Microsoft) | stores the app's install file | your network address when you download it | the United States |
6.2 We may change these companies as FantasyArena grows, for example to move our server and database to another provider or country. We then update this table before the change takes effect (section 14). Your information moves with the same protection, the times in section 8 stay the same, and the old provider's copy is deleted once the move is done.
6.3 Not ours to run:
- bKash, Nagad and Rocket. You send and receive money through your own account with them, under their terms. We see only what a transaction shows us.
- Telegram. When you message Support on Telegram or follow our channel, Telegram handles that under its own policy. We use what you tell Support only to help you. Our staff's alerts on Telegram never contain your name, number, account numbers or TrxIDs.
- Our cricket data provider receives nothing about you.
7. Information outside Bangladesh
7.1 Our server and database run in the European Union (Ireland), and some of the companies in section 6 keep or pass your information elsewhere outside Bangladesh, mainly in the United States. The law allows this with your consent and as part of the service you signed up for. We use only providers that encrypt information on its way and control who can reach it.
7.2 SMS codes are sent within Bangladesh. If the law comes to require that a copy of some information be kept in Bangladesh, we will do so.
8. How long we keep it
| What | How long |
|---|---|
| Your account (number, Team Name, Player ID, password, email) | While your account is open. When it closes, see section 9 |
| Team Names you had before | With your account |
| Private details (full name, date of birth, gender, address) | Until you remove them or close your account |
| Teams, entries, points, ranks and prizes | Kept as the game's record. 6 years after your account closes, they no longer carry your Team Name |
| Wallet and refer records | While your account is open, and for 6 years after it closes (for tax, VAT and accounting rules, and for any question or dispute). Then we remove what links them to you (your number, Team Name, MFS numbers and TrxIDs) and keep only the amounts our books need. If a dispute or a legal order about them is still open then, we keep them until it ends |
| Facts about your phones | The latest for each phone, while your account is open. When it closes the network address is erased; the scrambled phone code stays for 6 years |
| SMS and email codes, and the network address that asked for them | 30 days |
| The record of each SMS or email we sent (to whom, when, whether it went) | 90 days |
| Push tokens | Until you log out, or 90 days after the app was last seen on that phone |
| Notifications in the app | 30 days (14 for the ones everyone got) |
| Our staff's log | Kept, and never edited |
| Server logs, at Heroku and Cloudflare | A short time, usually days |
| Backups of our database | A limited time, then replaced; erased information leaves them as they expire |
9. Pausing and closing your account
9.1 A pause (Terms 14.2): you ask Support to pause your account until a day you choose, from tomorrow up to a year. Until that day you cannot log in: every phone is logged out and stops getting notifications. Nothing is deleted. Teams already in a contest still play and their prizes are paid. On the day you chose, you log in as before.
9.2 Closing (Terms 16): when your account closes, we erase your full name, date of birth, gender, district, upazila, address and postcode; your email address, with the email codes and emails we sent it; your push tokens; and the network addresses of your phones. Your password stops working, and nothing can reopen the account.
9.3 We keep, for 6 years after the closing, your mobile number, Team Name and Player ID, the scrambled phone code, your teams and entries, and the record of every deposit, withdrawal (with its MFS numbers and TrxID), entry fee, prize, bonus and refer reward. After that we remove your number, Team Name, MFS numbers, TrxIDs and phone code, and keep only the amounts. Our staff's log is kept as it is; if Support ever corrected your full name, that entry keeps the names it changed. The SMS record and the notifications go when their time in section 8 ends.
9.4 Why we keep them: the law requires us to keep the records of money; we may need them to answer a question or a dispute; and the number and the phone code stop a second account taking a second sign-up bonus. That is also why a closed account's number cannot register again during those 6 years.
10. Your rights
10.1 To know and to see. This policy says what we hold. Much of it is in the app: My Profile, your wallet's history, My Contests. You can ask for a copy of everything we hold about you, with what we use it for, who we shared it with, how long we keep it and how a fair-play hold was decided.
10.2 To correct. Change your details in My Profile. Your full name and date of birth lock after your first withdrawal is paid in that name; then Support corrects them, and may ask for proof. If we cannot make a change you ask for, we tell you why in writing, and you can ask us to mark the information as disputed.
10.3 To erase. Remove your optional details yourself, or close your account. We erase what section 9 says, and tell you what we must keep and why.
10.4 To withdraw a consent or to object. See 4.4. If you think the way we use your information could harm you, tell us: we look into it and stop where we can, and tell you what we did.
10.5 To pause or close your account (section 9).
10.6 How. Ask Support or email privacy@fantasyarenapro.online. We may first check that it is you, for example with a code to your number. We answer within 30 days, at no charge.
10.7 To complain. Tell us first; most things we can put right quickly. You can also complain to the National Data Management Authority, which oversees Bangladesh's data protection law.
11. Under 18
FantasyArena is only for people 18 or older (Terms 3.1), and we do not knowingly keep information about anyone younger. If we learn that an account belongs to someone under 18, we close it, return the money they deposited and did not play, and erase their private details. A parent or guardian can tell Support.
12. How we protect your information
12.1 Everything between the app and us travels encrypted (HTTPS), through Cloudflare's protection. Passwords and codes are kept only in scrambled forms, and the area, road and house line of your address is encrypted. Your private details are behind a permission, and every opening is recorded. Staff sign in with a password and a 6-digit code, and their every change is logged. A sign-in on a phone lasts 30 days at most, and changing your password logs out every other phone.
12.2 To test an update safely we sometimes use a copy of our database on our own computer. Your address line stays encrypted in it, and the copy is deleted afterwards.
12.3 No system is perfectly safe. If a breach is likely to harm you, we tell the Authority as the law requires, and we tell you what happened and what you can do.
13. The messages we send
13.1 SMS: only codes. Email: only codes, when you add an email address or forget your password. We do not track whether you open our emails.
13.2 Notifications: about matches, your contests, your wallet and your account, and news about free contests. Choose which in the app's Settings, or turn them all off in Android.
13.3 We never send advertising, and no message from us ever urges you to deposit or to play paid contests.
14. Changes to this policy
14.1 We show a new version in the app and on our website before it takes effect, including when the companies in section 6, or the country where our server is, change. If a change means using your information in a new way or for a new purpose, we ask for your consent before it applies to you.