Privacy Policy

This Privacy Policy explains how the company that operates Midium (the "Operator", "we", "us", "our") collects, uses, and protects information about you when you use the Midium website at midium.live, the Midium mobile application, and any related services (together, the "Service"). We are the data controller for the personal data described in this policy. You can contact us at privacy@midium.live.

1. The information we collect

a. On the website (midium.live)

The website itself is intentionally low-data. When you visit, we collect:

• A salted SHA-256 hash of your IP address, used solely to evidence your consent to legal documents and to defend against fraud. We do not store raw IP addresses on the website.
• A SHA-256 hash of your User-Agent string, used for the same purposes.
• A two-letter country code derived at the network edge from your IP, used for geographic compliance and to determine whether the Service is available in your country. The country code is never linked back to your identity.
• Your cookie and consent choices, stored in browser cookies on your own device.
• Aggregate analytics events through Plausible Analytics, which is cookie-less and does not collect personal identifiers, fingerprints, or cross-site tracking data.

We do not collect names, telephone numbers, or account information through the website. If you use the privacy request form at /legal/privacy/request, we collect the email address and any message you enter there, only to handle that request (see Sections 5 and 8).

b. In the mobile application

Through the application we collect: account data that you provide (display name, email when you sign in by email magic link or via OAuth, authentication tokens issued by Apple, Google, or Midas Exchange); profile data that you choose to provide (avatar, country, preferred language, notification preferences); game data generated as you play (predictions made, cards seen, sessions played, XP earned, streaks, achievements, mini-league memberships, leaderboard positions); subscription and purchase data received from the Apple App Store and Google Play Store, sufficient to verify and grant access to the room you have subscribed to (card numbers and other payment instrument details are processed by the relevant app store, not by us); device data such as device model, operating system version, application version, language, time zone, advertising identifier where you have not opted out at OS level, and a push-notification token where you have granted notification permission; diagnostic data including crash reports, performance metrics, and error logs; in the free version of the app on Android and iOS, a random install identifier the app creates for itself (it is not your advertising identifier) together with counts of ad events, such as an ad being requested, shown, or tapped and the screen it appeared on, linked to your account when you are signed in (see Section 5); and any communications that you exchange with our support, abuse, privacy, or legal teams.

c. From Midas Exchange

Where you link your Midium account to Midas Exchange, we receive a stable user identifier and limited account-status data (for example, whether KYC is complete and what trading tier you are in) from Midas Exchange. We do not receive your trading positions, order book activity, balances, or banking information.

d. From Fantasy Premier League

If a Midium fantasy league is running, we mirror data from the Premier League's public Fantasy Premier League ("FPL") API. What we hold is:

• The Midium private league's standings — for every manager in that league: their FPL entry ID, their team name, the manager name FPL publishes, their rank, and their points. FPL publishes this for the league as a whole, so it includes managers who have never used Midium and who have no relationship with us. If that is you, we hold your team name, the name shown on your FPL account, and your score, for as long as you are a member of that private league.
• Your linked team, if you are a Midium user who has joined — the FPL entry ID you claimed, the team and manager name attached to it, the gameweek squads FPL makes public after each deadline, and your per-gameweek scores, which are what we convert into XP and rewards.
• Reference data about the game itself — clubs, footballers, fixtures and gameweek deadlines. This is not personal data about you.

We do not receive anything from FPL that is not already published on its public endpoints, we cannot change anything in your FPL account, and we do not use this data for advertising, profiling, or any purpose beyond running the league.

Why we are allowed to hold it. For Midium users, mirroring your own entry is necessary to perform our contract with you — it is the feature you asked for. For everyone else in the league, including managers who are not Midium users, we rely on our legitimate interest in running a league table that is accurate and complete: a standings table that silently omits members is not a standings table. We have weighed this against the fact that the data is limited to a name, a team name and a score, is already published by the Premier League to everyone who can see the league, and is not combined with anything else we hold.

How long we keep it. The standings table is a live mirror, replaced in full at each sync with what FPL currently publishes for the league. We also keep a per-gameweek record of ranks and scores, held against the FPL entry ID only and carrying no names, so that season history and settled results stay correct.

How to be removed. Membership of the private league is controlled inside FPL, not by us. If you leave the league there, you drop out of our mirror at the next sync — normally within an hour, and within minutes during a live gameweek. You can also write to privacy@midium.live or use the form at /legal/privacy/request and we will delete the mirrored row; we will also tell you plainly that it will reappear at the next sync unless you leave the league in FPL, because we will not pretend to control something we do not.

When your account closes. Closing your Midium account is done through Midas Exchange, which does not automatically reach our fantasy records. Tell us at privacy@midium.live or through /legal/privacy/request and we will delete your fantasy entry — the link between your account and your FPL team, the team and manager name stored against it, your mirrored squads, and your per-gameweek history — within 30 days.

2. How we use your information

We use the information we collect to: operate the Service, including matching cards, scoring predictions, ranking leaderboards, running campaigns, and crediting promotional benefits; create and maintain your account and authenticate you across sessions; provide customer support and respond to your enquiries; prevent and detect fraud, abuse, multi-accounting, automation, money-laundering, sanctions evasion, and security incidents; comply with legal and regulatory obligations, including tax, anti-money-laundering, and lawful disclosure requests; protect, exercise, or defend legal claims; understand how the Service is used and improve it; fund the free version of the app with advertising, and limit and measure how often ads are shown (see Section 5); and communicate operationally with you about the Service.

3. Legal bases (where required)

Where applicable law (including the EU and UK GDPR, the UAE PDPL, the Saudi Arabia PDPL, and the Turkish KVKK) requires us to identify a legal basis for processing, we rely on: performance of a contract for processing necessary to deliver the Service to you (your account, your gameplay, your subscriptions); legitimate interests for fraud prevention, network and information security, abuse detection, service analytics, product improvement, and showing non-personalised ads in the free version of the app, balanced against your rights and freedoms; consent, freely given, for non-essential analytics, optional marketing communications, the placement of non-essential cookies, and personalised advertising where the law requires consent for it (see Section 5), which you may withdraw at any time; legal obligation for record-keeping, tax, sanctions compliance, anti-money-laundering, and responses to lawful requests; and vital interests in rare circumstances where we must protect the life or physical safety of a person.

4. How we share your information

We do not sell your personal data for money. In the free version of the app, personal data is shared with our advertising partner Unity for advertising, as described in Section 5, unless you opt out; some laws, such as those of California and other US states, call that a "sale" or "sharing" of personal data, and Section 5 explains how to opt out. Otherwise, we share information only as follows:

• With service providers that process information on our behalf, including cloud hosting (Microsoft Azure), email delivery, customer support tooling, push-notification delivery, analytics, and crash reporting. Each is bound by contractual confidentiality and data-protection obligations and may use your data only on our instructions.
• With Midas Exchange for the purpose of crediting promotional benefits, verifying identity, and reconciling rewards. Midas Exchange is a separate controller for the personal data it processes.
• With Apple and Google in the limited scope necessary to deliver and verify in-app subscriptions and to send push notifications.
• With Unity Technologies ("Unity"), whose Unity Ads service shows the ads in the free version of the app, as described in Section 5. Unity is a separate controller for the personal data its software collects.
• With law-enforcement, courts, regulators, or other competent authorities where we are required to do so by valid legal process or where disclosure is necessary to protect the Service, our rights, or the rights and safety of users or the public.
• In connection with a corporate transaction such as a merger, acquisition, restructuring, or sale of assets, in which case we will require any successor to honour this Privacy Policy or notify you and offer a meaningful choice.

5. Advertising

The free version of the Midium app for Android and iOS shows ads from Unity Ads, a service of Unity Technologies ("Unity"): a banner at the bottom of some screens and, from time to time, a full-screen ad at a natural break, such as when you leave the results of a finished game. Midium Pro subscribers see no ads. There are no ads on the website or in the Telegram Mini App, and never during a game or on payment, account, legal, or support screens.

What is collected, and by whom. To choose and measure ads, Unity's software in the app collects, where permitted: your device's advertising identifier (the Android advertising ID, or Apple's IDFA if you allow tracking on iOS); your IP address and the approximate location (country and region) derived from it; device information such as model, operating system, language, and screen size; and how you interact with ads, for example which ads were shown and whether you tapped them. Midium receives from the app only the install identifier and the counts of ad events described in Section 1.b, linked to your account when you are signed in. We use them to limit how often you see ads and to report how ads perform, and we do not send them to Unity. We use the country of your connection to decide which advertising choices to offer you.

Why, and on what legal basis. Ads pay for the free version of the Service. If you are in the European Economic Area (including the EU's outermost regions, such as Réunion, Guadeloupe and Martinique, and the Åland Islands), the United Kingdom, Gibraltar, Jersey, Guernsey, the Isle of Man, Switzerland, Andorra, Monaco, San Marino, the Faroe Islands, Turkey, Saudi Arabia, the United Arab Emirates, Canada, or China, or if we cannot tell which country you are in, the app asks whether Unity may personalise ads before it requests any ad, and Unity personalises them only with your consent. If you say no, you still see ads, but they are not personalised and are chosen only from context, such as your country and device. On iOS, if you have not allowed tracking, ads are never personalised and the app does not ask this question, because your device has already given the answer; you then see non-personalised ads. Elsewhere, including the US states with consumer-privacy laws and Brazil, ads are personalised unless you opt out. We pass your choice to Unity through its consent settings, together with whether you have confirmed that you are an adult.

How to change your choice. In the app, open Me → Ad preferences at any time, whether or not you are signed in. On iOS, if you have not allowed tracking in the system prompt or under Settings → Privacy & Security → Tracking, ads are never personalised, whatever else you choose. If you are signed in, a choice to opt out of the sale or sharing of your personal data is saved to your account and applied on every device where you sign in; without an account it applies to the device where you made it. You can also opt out through the "Do not sell or share my personal information" link on our website, which leads to the form at /legal/privacy/request; we apply an opt-out made there to every Midium account that uses the email address you enter, and the app then applies it on every device where you sign in. You can reset or delete your advertising identifier in your device settings. A Midium Pro subscription removes ads altogether.

Unity's privacy policy. Unity handles the data its software collects under its own Game Player and App User Privacy Policy at https://unity.com/legal/game-player-and-app-user-privacy-policy, where you can also exercise your rights with Unity directly.

6. International transfers

Your data may be transferred to, stored in, or processed in countries other than your country of residence, including the European Union, the United Kingdom, and the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or another jurisdiction whose law restricts transfers, we use European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request a copy of the relevant safeguards at privacy@midium.live.

7. Retention

We retain personal data only for as long as is necessary for the purposes for which we collected it: legal-consent records (age confirmation, cookie consent, terms acceptance) for seven years; account data for the life of your account and for up to 24 months after closure for legal-claim defence and fraud prevention, except where a longer period is required by law (tax records: 10 years); game data linked to your account for the life of your account, with aggregated and anonymised game data retained indefinitely; analytics events in aggregated form indefinitely with raw events deleted after 12 months; crash and diagnostic logs for 12 months; support correspondence for 24 months from last contact; ad telemetry for 90 days as per-device daily rows (install identifier and counts of sessions, ads seen, and taps), and for 25 months in aggregated form with no device identifier; requests made through the privacy request form on the website (your email address, the request, and what we did about it) for 24 months, as the law requires us to keep a record of them; and mirrored Fantasy Premier League standings only for as long as the manager is a member of the Midium private league, with per-gameweek ranks and scores kept without names against the FPL entry ID for the season record. After the applicable retention period we delete the data or irreversibly anonymise it.

8. Your rights

Subject to applicable law, you have the right to: request access to the personal data we hold about you and a copy of it; request correction of inaccurate or incomplete data; request erasure of your personal data; request restriction of, or object to, certain processing; request portability of personal data you provided to us; withdraw any consent you have given (without affecting prior lawful processing); where the law of your place of residence gives you this right (for example in California and other US states), opt out of the sale or sharing of your personal data for targeted advertising, which you can do in the app under Me → Ad preferences ("Do not sell or share my personal information") without contacting us, or through the "Do not sell or share my personal information" link on our website, and which, when you are signed in, follows your account to every device; and lodge a complaint with the data-protection authority of your country of residence or place of work.

You can exercise these rights through the form at /legal/privacy/request or by writing to privacy@midium.live. We will respond within 30 days. We may need to verify your identity before acting on a request. There is no charge for a request unless it is manifestly unfounded or excessive.

9. Cookies and similar technologies

We use a small number of strictly necessary cookies on the website to remember your age confirmation, language, theme, and consent choices. Analytics is provided by Plausible, which is cookie-less. The website does not use advertising cookies and does not place third-party trackers. Full details are in our Cookie Policy at /legal/cookies. Advertising in the mobile app is described in Section 5.

10. Security

We protect personal data using administrative, technical, and physical safeguards designed to be appropriate to the risk, including encryption in transit and at rest, network segmentation, access controls, multi-factor authentication for staff with access to production data, code review, vulnerability scanning, and incident-response procedures. No system is impervious. If we become aware of a personal-data breach that is likely to result in a high risk to your rights and freedoms we will notify you and the relevant supervisory authority without undue delay and as required by law.

11. Children

The Service is not directed to children under 18 (or 21 where a higher local minimum applies). We do not knowingly collect personal data from a child. If you believe we hold personal data of a person under the applicable minimum age, please contact privacy@midium.live and we will delete the data and close any associated account. We do not target advertising to children and we never knowingly process the personal data of a child for advertising purposes.

12. Automated decisions

We use automated systems to detect fraud, abuse, multi-accounting, and security incidents, and to score the integrity of leaderboard activity. These systems may result in restrictions on your account. You have the right to obtain human review of any decision that significantly affects you, to express your point of view, and to contest the decision, by writing to privacy@midium.live.

13. Changes

We may update this policy from time to time. Material changes will be notified through the Service at least 30 days in advance. The current version is always available at /legal/privacy. Each prior version is preserved at /legal/privacy/v[version].

14. How to contact us

Email: privacy@midium.live. Postal address: the registered office of the Operator, available on request. If you reside in the European Economic Area, the United Kingdom, or another jurisdiction with a designated data-protection authority, you may also lodge a complaint with that authority. We would, however, appreciate the chance to address your concern first.