← Back to Sign Up

E-Codex Play — Privacy Policy

Last updated: October 4, 2026

1. Introduction and Scope

This Privacy Policy explains how E-Codex Play (the "Platform") collects, uses, shares, and protects personal data when you use the website, the Android app, and related services (the "Services"), including the Game Zone, the ECP Scholarship Program, the ECP Community, the wallet, messaging, voice/video calls, and loan features.

This Policy is intended to comply with the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations. By using the Services, you consent to the collection and processing of personal data as described here, to the extent permitted by law.

2. Information We Collect

Category	Examples	Why it's collected
Account/registration data	Name, email, and password (hashed)	To create and secure your account
Identity/age verification data	A selfie or photo taken through the app's verification camera, and government ID if requested	To verify eligibility, prevent fraud, and release winnings or withdrawals
Device and security data	Device identifier (Android ID), session tokens, login timestamps, new-device alerts	To secure your account and detect unauthorized access
Wallet and transaction data	ECP Points balance, top-ups, winnings, purchases, loan applications and repayments, withdrawals	To operate the wallet, loans, and shop, and to meet financial record-keeping obligations
Gameplay data	Game participation, scores, rewards earned	To run games and award rewards correctly
Scholarship Program data	Proof of enrollment, academic standing, and other eligibility or supporting documents you submit	To verify eligibility and administer scholarship awards
Community data	Posts, comments, and other content you submit to the ECP Community	To operate and moderate the Community feature
Messaging and call data	Chat messages, and call metadata such as who called whom, call duration, and whether it was voice or video	To provide messaging/calling and show call history in chat
Communications with support	Messages you send to customer support (including the Tagalog/Taglish support chatbot)	To assist you and improve support quality
Push notification tokens	FCM token (Android) or web-push subscription	To deliver notifications about your account, wallet, or messages

Voice and video call content itself is not recorded or stored by the Platform; calls are connected peer-to-peer wherever possible, using a relay server only to help the connection succeed.

3. How We Use Information

We use personal data to:

• Create, authenticate, and secure your account (including fraud and multi-accounting detection);
• Operate the wallet, process ECP Point transactions, and administer the loan system;
• Administer the ECP Scholarship Program, including verifying eligibility and supporting documents;
• Operate and moderate the ECP Community feature;
• Run games, and correctly award rewards;
• Provide messaging and voice/video calling, and show call history to both participants;
• Send account, wallet, and security notifications (push notifications, email, in-app alerts);
• Verify identity and age where required before releasing winnings or withdrawals;
• Respond to support requests and improve the support chatbot;
• Comply with legal, tax, and anti-money-laundering obligations;
• Investigate suspected violations of the Terms and Conditions.

We do not sell personal data to third parties.

4. Security Measures

We apply the following safeguards to personal data and account access:

• Passwords are never stored in plain text; they are hashed using scrypt, a memory-hard algorithm designed to resist brute-force and GPU-based cracking;
• Session tokens are signed with HMAC and expire, so a stolen token cannot be reused indefinitely;
• Sensitive actions (password reset, profile changes) require a one-time PIN (OTP) sent to your registered email or phone;
• Optional biometric login on the Android app is tied to a per-device identifier and never transmits your biometric data itself to our servers;
• New-device logins trigger an alert so you can detect unauthorized access quickly;
• Data in transit is protected using HTTPS/TLS encryption;
• Access to administrator tools is restricted to the System Administrator role, limiting who inside the organization can view sensitive member data;
• Regular security review of the codebase, including prompt rotation of any credential found to be exposed.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the National Privacy Commission as required by the Data Privacy Act.

5. Data Sharing

We share personal data only as needed to operate the Services:

• With SMS, email, and push notification providers (such as Firebase Cloud Messaging), solely to deliver OTPs and notifications;
• With payment or disbursement partners, where needed to process withdrawals, loan disbursement, or top-ups;
• With our hosting provider, strictly as needed to run the Services (the Platform runs on a dedicated VPS; data is not knowingly shared with that provider beyond what is needed for hosting);
• With law enforcement, regulators, or courts, where required by Philippine law, a valid legal order, or to protect the rights, property, or safety of the Platform or its members;
• With a successor entity, in the event of a merger, acquisition, or sale of the Platform's business, subject to the same privacy commitments.

We do not share your personal data with other members beyond what a feature itself is designed to show them (for example, your display name and call history with a specific contact).

6. Data Retention

We keep personal data for as long as your account is active, and afterward only as needed to:

• Meet financial, tax, and anti-money-laundering record-keeping obligations (wallet and loan transaction records are generally kept longer for this reason);
• Resolve an open dispute, investigation, or legal claim;
• Comply with a legal retention period under Philippine law.

Identity/age verification images (such as a selfie) are kept only as long as needed to complete verification and meet the retention obligations above, after which they are deleted or anonymized. You may request deletion of other personal data as described in Section 7, subject to these retention needs.

7. Your Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the right to:

• Be informed that your personal data is being collected and processed;
• Access a copy of the personal data we hold about you;
• Request correction of inaccurate or outdated personal data;
• Object to or withdraw consent for certain processing, where applicable;
• Request erasure or blocking of personal data that is no longer necessary, subject to our retention obligations in Section 6;
• Request a copy of your data in a portable format, where technically feasible;
• File a complaint with the National Privacy Commission (NPC) if you believe your rights under the Data Privacy Act have been violated.

To exercise any of these rights, contact support through the Platform. We will verify your identity before acting on a request, to prevent someone else from accessing or changing your data.

8. Children's Privacy

The Services are not intended for, and may not be used by, anyone under 18 years old, consistent with the age requirement in Section 2 of the Terms and Conditions. We do not knowingly collect personal data from minors. If we learn that an account belongs to someone under 18, we will suspend the account and delete the associated personal data, net of anything we are legally required to retain.

9. Cookies and Similar Technologies

The website may use cookies or similar local storage to keep you logged in, remember preferences (such as the site-wide Performance Mode toggle), and understand basic usage patterns. The Android app uses a device identifier for biometric login and new-device recognition, as described in Section 4. You can control cookies through your browser settings, though disabling them may affect features like staying logged in.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, new features, or legal requirements. Material changes will be announced through the Platform. Continued use of the Services after a change takes effect means you accept the updated Policy.

11. Contact and Data Protection Officer

For questions about this Privacy Policy, to exercise your data privacy rights, or to report a security concern, contact support through the Platform.

Under the Data Privacy Act, personal information controllers are generally required to designate a Data Protection Officer (DPO). Once a DPO is designated, their contact details should be added here.

This draft was prepared from the Platform's actual features and data practices as a starting point. Because it covers identity verification, financial/wallet data, and a loan system, it should be reviewed by a Philippine lawyer or privacy professional before publishing, to confirm compliance with the Data Privacy Act (RA 10173), its Implementing Rules and Regulations, and any NPC registration or DPO-designation requirement that applies to the Platform.