What this privacy policy covers
This privacy policy covers the Fantoss website (this site), the Fantoss app (Android, iOS and the APK mirror) and the editorial newsletter. It explains what data we collect, how long we retain it, who we share it with and how you can exercise your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act). The policy is written in plain English; the legal version is published in the help section.
If we discover that we have collected data from a minor, we delete it within 24 hours. Age verification is mandatory at signup; if the verification fails, the account is closed.
You have the right to complain to the Data Protection Board of India. The complaint process is published on the DPDP Act website.
We share anonymised, aggregated data with the Self-Regulatory Body (SRB) under the Online Gaming Act, 2025. The aggregated data cannot be traced back to individual players.
Data is stored on Fantoss servers in India. Backups are stored in a separate Indian data centre with end-to-end encryption.
If a material change affects your rights under the DPDP Act, we email you 30 days before the change takes effect. You can opt out of the change by deleting your account within the notice period.
Account data is retained for the lifetime of the account plus 7 working days after deletion. KYC documents are retained for the lifetime of the account plus 7 years (the retention period required by the Prevention of Money Laundering Act).
We share anonymised, aggregated data with the Self-Regulatory Body (SRB) under the Online Gaming Act, 2025. The aggregated data cannot be traced back to individual players.
We share data with KYC verification vendors (for PAN and Aadhaar checks), payment processors (for UPI deposits and withdrawals) and tax authorities (for TDS reporting under Section 194BA).
We do not sell personal data to advertising networks, data brokers or marketing partners. The desk's marketing is opt-in only and the data is processed inside Fantoss.
What data we collect
When you sign in to Fantoss, we collect your mobile number, your OTP, your device fingerprint and your IP address. The mobile number is the primary key — it links your PAN, your UPI handle and your team history.
When you deposit, we collect your UPI handle and your deposit reference. The deposit reference is used for the wallet transaction history and the TDS receipt.
When you withdraw, we collect your UPI handle, your PAN, your bank account reference and the TDS receipt. The data is retained as required by Section 194BA of the Income Tax Act.
How long we retain your data
Account data is retained for the lifetime of the account plus 7 working days after deletion (the cooling-off period required by the DPDP Act).
KYC documents (PAN, Aadhaar) are retained for the lifetime of the account plus 7 years (the retention period required by the Prevention of Money Laundering Act).
Contest ledgers, withdrawal records and TDS receipts are retained for 8 years (the retention period required by the Income Tax Act).
Who we share data with
We share data with KYC verification vendors (for PAN and Aadhaar checks), payment processors (for UPI deposits and withdrawals) and tax authorities (for TDS reporting under Section 194BA).
We do not share data with marketing partners, advertising networks or data brokers. The desk's marketing is opt-in only and the data is processed inside Fantoss.
We share anonymised, aggregated data with the Self-Regulatory Body (SRB) under the Online Gaming Act, 2025. The aggregated data cannot be traced back to individual players.
Your rights under the DPDP Act 2023
You have the right to access your data. Open the profile tab and choose 'Download my data' — the export is delivered as a password-protected ZIP within 7 working days.
You have the right to correct your data. Open the profile tab and update the relevant field. Corrections are reflected within 24 hours.
You have the right to delete your data. Open the profile tab and choose 'Delete account' — the cooling-off period is 7 working days and KYC documents are deleted on closure.
You have the right to complain to the Data Protection Board of India. The complaint process is published on the DPDP Act website.
Cookies and tracking
The Fantoss website uses first-party cookies for the editorial newsletter opt-in and the responsible-play tools. The cookies are not used for tracking or advertising.
The Fantoss app uses first-party identifiers (the device fingerprint) for the wallet and the responsible-play tools. The app does not use third-party trackers or advertising SDKs.
If you opt out of cookies or the app's tracking, the responsible-play tools and the wallet may not work as expected. The opt-out is reversible inside the same profile tab.
Children's privacy
Fantoss is 18+ only. We do not knowingly collect data from anyone under 18. If we discover that we have collected data from a minor, we delete it within 24 hours.
Age verification is mandatory at signup. If the verification fails, the account is closed. The wallet re-checks the age at every deposit.
Changes to this policy
We may update this policy from time to time. The current version is published on this page with the last-updated date at the top.
If a material change affects your rights under the DPDP Act, we email you 30 days before the change takes effect. You can opt out of the change by deleting your account within the notice period.
When you sign in to Fantoss, we collect your mobile number, your OTP, your device fingerprint and your IP address. The mobile number is the primary key — it links your PAN, your UPI handle and your team history.
When you deposit, we collect your UPI handle and your deposit reference. When you withdraw, we collect your UPI handle, your PAN, your bank account reference and the TDS receipt.
The Fantoss website uses first-party cookies for the editorial newsletter opt-in and the responsible-play tools. The cookies are not used for tracking or advertising.
Contest ledgers, withdrawal records and TDS receipts are retained for 8 years (the retention period required by the Income Tax Act).
Frequently asked questions
How do I download my data?
Open the profile tab and choose 'Download my data'. The export is delivered as a password-protected ZIP within 7 working days.
How do I delete my account?
Open the profile tab and choose 'Delete account'. The cooling-off period is 7 working days and KYC documents are deleted on closure.
Does Fantoss share my data with marketing partners?
No. We do not share data with marketing partners, advertising networks or data brokers. The desk's marketing is opt-in only and the data is processed inside Fantoss.
Can I opt out of cookies?
Yes. Open the profile tab and update the cookie preferences. The opt-out is reversible inside the same panel.
Where is my data stored?
Data is stored on Fantoss servers in India. Backups are stored in a separate Indian data centre with end-to-end encryption.
What if I have a complaint about my data?
Email [email protected]. The desk replies within 48 hours. You can also complain to the Data Protection Board of India under the DPDP Act.