Privacy Policy

Privacy Policy

Last Updated: Jan 9, 2026

Introduction

At THNDR LTD ("THNDR", "we", "us", or "our"), we respect your privacy and are committed to protecting your personal data. This privacy notice will inform you of our practices around handling personal data when you use our services, including the Clinch mobile application, our website (https://clinch.gg/), and our games integrated into third-party platforms via widgets ("Partner Platforms").

This privacy notice is provided in a layered format. Please refer to the Glossary at the end of this document to understand the specific meaning of terms used in this privacy notice.

1. Important infomation about who we are

Purpose of this Privacy Notice

This privacy notice aims to provide information on how THNDR collects and processes personal data. It is important that you read this privacy notice together with our Terms of Service so that you are fully aware of how and why we are using your data.

Controller vs. Processor (The Hybrid Model)

THNDR operates in a hybrid model, which dictates our legal responsibility for your data:

1. Direct Users (B2C): If you play directly via our App or Telegram, THNDR LTD is the Controller and responsible for your personal data.
2. Partner Users (B2B): If you play our games via a third-party website (e.g., a betting site or gaming operator), that Partner Platform is the Controller of your account and funds. THNDR acts as a Data Processor regarding gameplay mechanics, but acts as an independent Controller regarding game integrity, anti-cheat measures, and global matchmaking data.

Third-Party Links

Our App may include links to third-party websites, plug-ins, and applications (e.g., Bitcoin Wallets like Wallet of Satoshi, ZBD, Strike). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our App, we encourage you to read the privacy notice of every website or wallet you visit.

Contact Details

• Full name of legal entity: THNDR LTD
• Email address: hello@thndr.games
• Postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Data Privacy Manager: Desiree Dickerson

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

2. The data we collect about you

We collect, use, store, and transfer different kinds of personal data about you. However, unlike traditional banking or gaming apps, we minimize data collection to what is strictly necessary for skill-based gaming on the Lightning Network.

We have grouped our data collection as follows:

A. Identity & Contact Data

• Standard Users (B2C): We generally do not collect your real name, physical address, or phone number. We identify you primarily by your User ID or Gamertag.
• Social Login: If you choose to log in via Apple, Google, or X (Twitter), we collect the User ID provided by that platform. We may receive your Email Address only if you authorize the platform to share it.
• Prize Winners: We collect your Physical Address and Telephone Number only if you win a physical prize (e.g., merchandise, hardware) and we need to ship it to you.

B. Financial Data

• Lightning Network: We collect your public Lightning Address and Bolt11 invoice data to process payouts.
• No Custody: We do not store credit card numbers or bank account details.

C. Technical & Usage Data (Collected Automatically)

• Technical Data: Includes internet protocol (IP) address, your login data, device type and version, time zone setting, operating system, unique device identifiers (Apple IDFA or Google AAID), and battery status.
• Gameplay Data: Includes match history, ELO scores, move sequences, and touch/interaction patterns (used for anti-cheat analysis).
• Location Data: We collect coarse location based on your IP address to ensure you are not in a Prohibited Jurisdiction (e.g., Montana, Tennessee). We do not collect precise GPS coordinates unless explicitly required by state regulations for Real Money Gaming and only with your express consent.

D. Data from Partner Platforms (B2B Only)

If you play via a Partner Platform, they send us a Session Token, User ID, and Balance Information. We do not receive your full identity verification (KYC) packet from Partners.

Special Note on AML & KYC

We do not perform routine KYC (Know Your Customer) checks on all users.
However, to comply with Anti-Money Laundering (AML) laws, we reserve the right to request ID verification documents (e.g., Passport, Driver’s License) only in specific cases:

1. Suspicious activity indicative of fraud or money laundering.
2. High-value disputes.
3. Regulatory inquiries.

3. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Performance of Contract: Where we need to perform the contract we are about to enter into or have entered into with you (e.g., matchmaking, settling a wager).
• Legitimate Interest: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g., fraud prevention, anti-cheat).
• Legal Obligation: Where we need to comply with a legal or regulatory obligation (e.g., geo-blocking restricted states).

Purposes for which we will use your personal data:

4. Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table above.

• Partner Platforms (B2B): We share match results and replay data with the Partner Platform you are using to enable them to settle your wager.
• External Third Parties:
  
  • Cloud Hosting: AWS (Amazon Web Services) and Google Cloud.
  • Analytics: Google Firebase, Crashlytics (for app stability).
  • Support Tools: Customer support ticketing systems.
• Legal Authorities: HM Revenue & Customs, regulators, and other authorities acting as processors or joint controllers based in the UK or USA who require reporting of processing activities in certain circumstances.
• The Public Blockchain: IMPORTANT: Transactions on the Bitcoin Lightning Network may be publicly visible. Data written to the blockchain is immutable and cannot be deleted by THNDR.

5. International transfers (Server location)

Please be aware that our primary servers and databases are located in the United States.

If you are accessing the Service from the United Kingdom (UK) or the European Economic Area (EEA), your personal data (e.g., IP address, Device ID, Gameplay Logs) will be transferred to and processed in the United States.

To ensure your data remains protected in accordance with GDPR and UK data protection laws, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We implement standard data protection clauses approved by the European Commission and the UK Information Commissioner’s Office (ICO) in our contracts with our cloud hosting providers (e.g., AWS, Google Cloud).
• Data Minimization: We only transfer data that is strictly necessary for the gameplay (telemetry, IDs) and avoid transferring direct identifiers like real names unless absolutely necessary.

By using the Service, you explicitly acknowledge and consent to this transfer of data to the United States.

6. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so

7. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Gameplay History: We retain match results indefinitely to maintain the integrity of our ELO/Skill Rating system and for anti-cheat analysis.
• Account Data: Retained while your account is active.
• Anonymization: If you request account deletion, we will delete your personal identifiers (e.g., link between your IP/Device ID and the account). While we will anonymize your gameplay history, it cannot be deleted. Your past matches will remain in the system (to preserve opponents' history), but they will be linked to an "Anonymous User" and cannot be traced back to you.

8. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons (e.g., blockchain immutability) which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the rights set out above, please contact us at hello@thndr.games.

Notice to California Residents (CCPA/CPRA)

If you are a California resident, you have the right to opt-out of the "sale" or "sharing" of personal information. THNDR does not sell your personal data for monetary value. However, we may share technical data with analytics partners. You may opt-out of this sharing by adjusting your device settings ("Limit Ad Tracking"). You also have the right to request disclosure of the categories of information we collected about you in the last 12 months.

9. Children's privacy

Our Service is strictly for users aged 18+ (or the age of majority in your jurisdiction). We do not knowingly collect data from children under 18. If we discover that a minor has provided us with personal data, we will immediately delete such information and terminate the associated account. If you believe we might have any data from or about a child under 18, please contact us at hello@thndr.games.

10. Glossary

Comply with a legal or regulatory obligation

Means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

External Third Parties

Service providers acting as processors based in the UK, USA, or EU who provide IT and system administration services.

Legitimate Interest

Means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure to consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests.

Lightning Network

A decentralized layer-2 protocol for Bitcoin that enables instant payments. Transactions on this network are public and immutable.

Performance of Contract

Means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

‍