Jakalooki™

Privacy Policy — Jakalooki Multiplayer

Upper Loft Enterprises, LLC · jakalooki.upperloftenterprises.com and the Jakalooki — Multiplayer apps for iOS and Android · Effective Date: June 29, 2026 · Last Updated: July 24, 2026 (v1.3)

This Privacy Policy describes how Upper Loft Enterprises, LLC ("Upper Loft," "we," "us," or "our"), a California limited liability company, collects, uses, discloses, and protects personal information in connection with the Jakalooki Multiplayer service, available at jakalooki.upperloftenterprises.com and through the Jakalooki — Multiplayer apps for iOS and Android (together, the "Service").

The Service is an online Jamaican Kalooki card game and connections-first social platform. Players create accounts, build profiles, add friends, become discoverable to other players (including people they do not already know, worldwide), schedule and play games, earn rankings and medals, and may purchase optional cosmetic card art and memberships.

By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

1. Scope of This Policy

This Privacy Policy applies to the Jakalooki Multiplayer service, whether you access it in a web browser at jakalooki.upperloftenterprises.com or through the Jakalooki — Multiplayer app for iOS or Android. Your account and information are the same across these access methods, and this one policy governs them.

It does not apply to:

• The separate Jakalooki — Solo app for iPhone and iPad. That app is a different product that collects no data and is governed by its own privacy policy.
• The Upper Loft Enterprises marketing website (upperloftenterprises.com) and our other brands, which are covered by our general Privacy Policy.
• Third-party websites, services, or platforms that this Service may link to or integrate with, each of which has its own privacy practices.

Your acknowledgment. When you create an account, you are asked to confirm that you have read, understood, and agree to this Privacy Policy, and we record that acknowledgment at registration. By creating an account or using the Service, you confirm that you have read and agree to this Privacy Policy.

2. Information We Collect

We collect the following categories of information when you use the Service:

a. Account information

• Email address (if you provide it) — used for sign-in support, account recovery, and transactional messages. Your email is treated as private and is never displayed to other players.
• Username — your unique login handle (stored in lowercase).
• Date of birth — collected at registration to confirm you meet our 18-and-over age requirement. We use it only for age eligibility and account integrity; it is treated as private and is not shown to other players.
• Password — stored only as a secure one-way hash (bcrypt). We never store your password in plain text and cannot see it.
• Phone number (optional) — if you choose to provide it. Treated as private and never displayed to other players.
• Security question and answer (optional) — for password recovery. The answer is stored only as a secure one-way hash, never in plain text.

b. Profile information

• Display name (the name shown at the table) and avatar. Your avatar may be a preset image, or a photo you upload or capture with your device camera that is then framed; we store the framed image and the underlying photo so the avatar can be re-framed.
• Optional bio and interests — free-text "about me" content you choose to share for discovery.
• Location — country, state/province, city, and time zone (and a legacy free-text region field). Location is used to power the "Find Players" discovery directory and location filters. We treat your location as private profile data; see Section 9 on your choices and the discovery toggles.

c. Social and gameplay information

• Friends and connections, friend requests, and your discovery settings (whether you are listed in the player directory, and whether strangers may invite you to public games — both are opt-in and off by default).
• Scheduled games and related invitations and RSVPs.
• Gameplay and usage data, including game history, results, rankings and skill rating, medals, wins, scores, and per-turn timing.
• Referral connections — if you join through another member's referral link or code, we record that referral relationship (who referred you) and whether it results in a paid membership, solely to administer referral rewards.
• Acquisition source — if you arrive through one of our own marketing links, we may record a single tag identifying which of our pages or campaigns brought you to registration. We use it only to understand which of our own marketing efforts work; it is first-party data and is never shared.

d. Payment, subscription, and purchase information

• Purchases on the web (memberships and optional cosmetic card art bought at jakalooki.upperloftenterprises.com) are processed by our third-party payment processor, Stripe. We do not collect or store your full payment card number; Stripe handles card data directly.
• Purchases in the iOS and Android apps (memberships and optional cosmetic card art bought in-app) are billed by Apple or Google as the merchant of record under your App Store or Google Play account. Apple and Google handle your payment details under their own terms and privacy policies; we never receive your payment card information. We receive purchase and entitlement records (such as the product purchased, a transaction identifier, and subscription status), and we use RevenueCat, a subscription-infrastructure service provider, to validate store receipts and manage subscription entitlements on our behalf.
• For all purchase channels, we store your membership status, plan, and renewal dates, records of your purchases, and what cosmetic items you own. Memberships are billed up front and renew automatically until cancelled (see the Terms of Service and your platform's subscription settings).
• If you participate in the artist program and sell card art, payouts are handled through Stripe Connect; we store your Stripe account identifier and payout-eligibility status, but not your bank details.

e. Information collected automatically

• Session tokens used to keep you signed in.
• IP address, and cookies, local storage, and similar technologies used to operate and secure the Service.
• Server logs and technical data such as request times, device/browser information, and error data.
• Aggregate usage statistics — when you use the Service in a web browser, we use Simple Analytics, a cookieless, privacy-first analytics service hosted in the EU, to count visits and page views. It sets no cookies, stores no personal information, and does not track you across sites; it briefly processes your IP address to derive non-identifying information (such as country) and then discards it. It is not used inside the iOS or Android apps.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your sign-in.
• Operate core features — matchmaking, gameplay, friends and connections, scheduled games, rankings, medals, and the player discovery directory.
• Display your public profile (display name, avatar, location, bio, and interests) to other players when you opt in to being discoverable.
• Process membership subscriptions and optional cosmetic purchases and, for artists, facilitate payouts.
• Send you transactional messages (for example, account recovery, purchase confirmations, and important service notices).
• Understand aggregate usage of the Service (visit and page-view counts) so we can improve it.
• Maintain the security and integrity of the Service, prevent fraud and abuse, and enforce our Terms of Service and Code of Conduct.
• Respond to your requests and provide support.
• Comply with legal obligations and exercise or defend legal claims.

4. What Other Players Can See

Privacy between players is a core design principle of the Service:

• Your email address and phone number are private and are never shown to other players.
• You are not listed in the player directory unless you opt in to being discoverable, and strangers cannot invite you to public games unless you opt in to that as well. Both settings are off by default and can be changed at any time.
• When you opt in to discovery, other players may see your display name, avatar, location (country/state/city/time zone), bio, and interests, along with public gameplay information such as rankings and medals.
• Ranked leaderboards are visible to other players and show your display name, avatar, and ranking statistics for every ranked player, regardless of your discovery settings. Your location appears on leaderboards only if you have opted in to being discoverable.
• Because the Service connects you with people worldwide, including people you may not already know, please use care about what you choose to include in your public profile, bio, interests, and avatar.

5. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies (and, in the apps, equivalent on-device storage) to keep you signed in, remember your preferences, operate the game, and keep the Service secure. As described in Section 2(e), these are used to provide the Service itself.

Most browsers let you refuse or delete cookies and clear local storage. If you disable these technologies, parts of the Service (including staying signed in) may not function properly.

6. How We Share Information

We do not sell your personal information. We share information only as described below:

Service providers / processors. We use trusted third parties to operate the Service, who process information on our behalf under contract:

• Fly.io — application hosting (United States).
• Neon — managed PostgreSQL database (United States).
• Stripe — payment processing for web purchases and artist payouts (Stripe Connect).
• Apple and Google — in-app purchase billing for the iOS and Android apps, as merchants of record under their own terms (see Section 2(d)).
• RevenueCat — store-receipt validation and subscription entitlement management for the apps.
• Simple Analytics (EU-hosted) — cookieless aggregate web analytics for the browser version of the Service; sets no cookies and stores no personal information.
• Google Workspace / Gmail — transactional email delivery.

Other players. Your public profile and public gameplay information are shared with other players as described in Section 4, based on your discovery settings.

Legal and safety. We may disclose information if we believe in good faith that it is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Upper Loft, our users, or the public.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

7. Where Your Information Is Stored

The Service is operated from, and your information is stored on servers located in, the United States (via Fly.io for hosting and Neon for database storage). If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where your information is transferred from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate transfer safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), as further described in Section 11.

8. Data Retention and Security

Retention. We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter as needed to comply with our legal obligations, resolve disputes, maintain security, and enforce our agreements. When you delete your account, we delete or de-identify your personal information within a reasonable period and, in any event, no later than five (5) years after your account is closed or deleted, except where retention is required or permitted by law (for example, transaction records that must be kept for tax or accounting purposes). The specific categories retained after account deletion — anonymized financial records, legally required safety-preservation records, de-identified game statistics, and artwork licensed to other players — are described on our Account Deletion page at jakalooki.upperloftenterprises.com/account/deletion.

Security. We use reasonable administrative, technical, and organizational safeguards designed to protect personal information — including hashing passwords and security answers, encrypting data in transit, restricting access, and storing data with reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Choices and Controls

• Access and edit. You can view and update your profile information (including display name, avatar, bio, interests, and location) at any time from your account settings.
• Discovery controls. You can turn your directory listing ("discoverable") and "open to public games" settings on or off at any time. Both are off by default.
• Email and location privacy. Your email and phone number are never shown to other players. Your location is shown to others only when you opt in to being discoverable.
• Delete your account. You may delete your account at any time, on a self-service basis — in the web service or the apps, go to My Account → Delete Account. Deletion removes your personal information as described in Section 8. Step-by-step instructions are at jakalooki.upperloftenterprises.com/account/deletion. If you subscribed through the App Store or Google Play, deleting your account does not cancel store billing — cancel the subscription in your App Store or Google Play settings.
• Communications. You can manage transactional communications as described in those messages or by contacting us.

10. California Privacy Rights (CCPA/CPRA)

(Unchanged from v1.0.) If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you certain rights regarding your personal information.

• Categories of personal information we collect. As described in Section 2, we collect identifiers (such as email, username, IP address); account credentials; customer records (such as phone number); commercial information (purchase records); internet/network activity (usage and log data); approximate geolocation (city-level location); profile content (avatar, bio, interests); and inferences used for rankings and matchmaking.
• Purposes. We use these categories for the business purposes described in Section 3 (operating the Service, security, support, payments, and legal compliance).
• Sources. We collect this information directly from you, automatically from your use of the Service, and from our service providers (such as our payment processors).
• No sale or sharing. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.
• Your rights. Subject to verification and legal exceptions, you have the right to: know/access the personal information we have collected about you; delete personal information we have collected from you; correct inaccurate personal information; opt out of the sale or sharing of personal information — although, as stated above, we do not sell or share personal information; limit the use of sensitive personal information, to the extent we use any such information beyond permitted purposes; and non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at support@upperloftenterprises.com. We may need to verify your identity before fulfilling your request, and you may use an authorized agent to submit a request on your behalf.

11. International Users

(Unchanged from v1.0, including the EEA/UK/Swiss rights, legal bases, transfer safeguards, complaint rights, and the Euverify Ltd EU and UK Article 27 representative details and DSAR portal link.)

The Service is operated from the United States and intended primarily for users in the United States. If you access the Service from another country, you do so on your own initiative and are responsible for compliance with local laws. By using the Service, you consent to the transfer and processing of your information in the United States as described in Section 7.

EEA, UK, and Swiss privacy rights (GDPR / UK GDPR). If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional rights and disclosures apply to you under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss FADP:

• Controller. Upper Loft Enterprises, LLC is the controller of your personal information and can be reached at support@upperloftenterprises.com.
• Legal bases. We process your personal information on these legal bases: (a) performance of our contract with you (to create your account and provide the Service); (b) your consent, where we ask for it (for example, optional features); (c) our legitimate interests in operating, securing, and improving the Service and preventing abuse, balanced against your rights and freedoms; and (d) compliance with our legal obligations.
• Your rights. Subject to applicable law, you have the right to access your personal information; to correct (rectify) inaccurate information; to request erasure (the "right to be forgotten"); to restrict or object to processing; to data portability; to withdraw consent at any time (without affecting processing already carried out); and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such automated decision-making). To exercise any of these rights, contact support@upperloftenterprises.com or use your in-product account settings.
• International transfers. Your personal information is transferred to and processed in the United States (see Section 7). Where required, we use appropriate safeguards for these transfers, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Complaints. You may complain directly to us about our handling of your personal data by contacting support@upperloftenterprises.com; we acknowledge complaints within 30 days and investigate without undue delay. You also have the right to lodge a complaint with your local data-protection supervisory authority at any time.

EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative: Euverify Ltd (Ireland) · Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland · Email: gdpr@euverify.com

UK Representative: Euverify Ltd (UK) · 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom · Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal at: https://gdpr.euverify.com/verify/f1f8b218-5b1e-4dba-9fbe-e4a8b3d97467 — this link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

12. Children's Privacy (18+ Service)

The Service is intended for adults age 18 and older and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under the age of 18. We use an age gate at registration to help enforce this minimum age.

If we learn that we have collected personal information from someone under 18, we will delete that information and terminate the associated account. If you believe a person under 18 has provided us personal information, please contact us at support@upperloftenterprises.com so we can take appropriate action.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here with a new "Last Updated" date and, where appropriate or legally required, provide additional notice. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices for the Jakalooki Multiplayer service, contact us:

Email: support@upperloftenterprises.com

Mail: Upper Loft Enterprises, LLC · 8605 Santa Monica Blvd. #761685 · West Hollywood, CA 90069