Privacy Policy

1. Who we are

HKPL Fantasy / 港超 Fantasy (the “Service”) is operated by Kinoko Studio (“we”, “us”). This policy explains what personal data we collect and how we handle it, in accordance with the Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap. 486).

2. Data we collect

• Account data: your email address, display name, and (if you sign up with Google) your Google account name.
• Gameplay data: your team name, squad selection, lineups, transfers, and scores.
• Usage analytics: page views, and sponsor views and clicks. Some of this is collected in aggregate by our analytics provider; we also record sponsor views and clicks in our own database. We do not store your IP address, but to stop the same visitor being counted twice we store a short one-way code derived from it. That code is not reversible by us in normal use and is never linked to your account.
• Technical data: error reports and basic device and browser information collected via our error monitoring service for diagnostic purposes.
• Marketing consent: whether you have opted in to marketing communications, and when.
• Session cookie: an authentication cookie issued when you log in.

We do not collect payment card details, government identity documents, or other sensitive personal data categories.

3. How we use your data

• To create and maintain your account and run the fantasy game.
• To keep the Service secure and diagnose technical problems.
• To understand how the Service is used and improve it.
• To send you transactional emails (e.g. password reset). Marketing emails are sent only if you opt in.
• To comply with our legal obligations, including any lawful requests from Hong Kong authorities (see Section 8 below).

We do not sell your personal data. Any marketing emails, including offers relating to our sponsors, are sent by us; we do not share your personal data with sponsors.

4. Service providers

We use a small number of reputable third-party providers to run the Service on our behalf, covering:

• authentication and database hosting (account management and data storage);
• application hosting and content delivery;
• aggregate usage analytics; and
• error reporting and diagnostics.

Each provider may only process your data on our instructions, under its own terms and privacy policy. These providers operate internationally, so your data may be processed on servers outside Hong Kong.

5. Cookies

We use the following cookies:

• Authentication cookie: required to keep you signed in. Cleared when you sign out or after your session expires.
• Analytics cookie: aggregate usage measurement, set only after you accept analytics cookies. It does not store your name or email; see section 2 for how we handle IP addresses.
• Preference cookies: remember your language and light/dark theme.

You can control or clear cookies in your browser settings. Deleting the authentication cookie will sign you out.

6. Data security

We take reasonable technical and organisational steps to protect your personal data against loss, misuse, and unauthorised access, including encryption in transit and access controls that limit access to those who need it. Our service providers are required to handle your data confidentially and only on our instructions. No online service can be guaranteed completely secure, but if a serious data breach occurs we will take appropriate steps and notify affected users and the Privacy Commissioner where appropriate.

7. Links to other sites

The Service may contain links to third-party websites, including sponsor links. We do not control those sites and are not responsible for their content or privacy practices. When you follow such a link, that site's own privacy policy applies, so please review it.

8. Law enforcement and legal disclosure

We operate under the laws of the Hong Kong Special Administrative Region. We may be legally required to disclose user data and content to law enforcement or other relevant authorities, and will comply with lawful orders and requests.

We may also disclose data where necessary to protect the safety of users or the public, or to defend against legal claims.

9. Retention

We keep your account and gameplay data while your account is active. If you ask us to close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it by law.

You can permanently delete your account and all associated data yourself at any time from your Account page. This removes your profile and your fantasy data (team, squad, leagues, and scores). Limited information may remain briefly in backups, and we may retain data where the law requires.

10. Your rights under the PDPO

Under the Personal Data (Privacy) Ordinance you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate personal data.
• Withdraw consent to marketing communications at any time via your Account page or by contacting us.

You can update your own account details (such as your display name) at any time from your Account page.

To exercise these rights, contact us at connect@kinokostudio.com.hk. We will respond within 40 days as required by the PDPO.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has registered, contact us and we will remove the account.

12. Changes to this policy

We may update this policy at any time. Material changes will be posted here with an updated date. Continued use of the Service after changes are posted means you accept the revised policy.

13. Contact

For privacy questions, data access requests, or complaints: connect@kinokostudio.com.hk

You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).