Privacy Policy – Tojay APK Data Protection Guide

1. Introduction

Welcome to the Tojay APK Privacy Policy. This document describes how Tojay APK — referred to throughout as "we", "us" or "the platform" — handles the personal information of players who register and use our gaming platform.

Tojay APK operates as a PKR-native online gaming platform serving players in Pakistan. The games we offer include slots, fish games, bingo and a broad range of other entertainment titles. To provide these services, we need to collect certain information about you. This policy explains what that information is, why we need it and how we keep it safe.

By registering an account on Tojay APK, you acknowledge that you have read and understood this Privacy Policy and that you consent to the data practices described here. This policy should be read alongside our Terms and Conditions and our Responsible Gaming page, both of which contain additional obligations that apply to your use of the platform.

We do not sell your personal data. We do not use your information for purposes beyond what is described in this policy. If we ever need to change how we use your data in a material way, we will inform you first.

2. Data We Collect

We collect only the information we genuinely need to operate the platform, process your PKR transactions and keep your account secure. The categories of personal data we hold are as follows:

We do not collect sensitive categories of data such as racial or ethnic origin, religious beliefs, political opinions, health records or biometric identifiers unless you voluntarily share such information during a support interaction — in which case it is used only to assist you and deleted from active records once your query is resolved.

3. How We Collect It

Personal data reaches us through three main routes: information you provide directly, information generated automatically when you use the platform, and — in limited circumstances — information received from third-party service providers.

• Direct input: When you register your account, complete identity verification, make a PKR deposit, contact support or update your profile settings.
• Automatic collection: When you browse, log in or play games on the platform. Technical and usage data is collected automatically via server logs and, where applicable, cookies.
• Payment processors: When you initiate a deposit or withdrawal via JazzCash, Easypaisa, Raast or a bank transfer, our payment partners share transaction confirmation data with us. We do not receive your full account credentials from these providers — only what is necessary to confirm and record the transaction.
• Fraud and security providers: We may receive risk-scoring or device fingerprint data from security partners to help detect unusual account activity. This data is used only for protective purposes.

We do not purchase contact lists, scrape social media profiles or collect data from sources unrelated to your direct use of the Tojay APK platform.

4. How We Use Your Data

Every use of your personal data is tied to a specific, legitimate purpose. We do not process your information speculatively or share it beyond what is described here. The primary purposes for which we use your data are:

• Operating your account: Registration, login authentication, session management and account settings.
• Processing transactions: Handling PKR deposits, withdrawal requests and bonus credits accurately and in a timely manner.
• Customer support: Responding to queries, resolving disputes and providing assistance via live chat or email.
• Responsible gaming: Monitoring activity patterns to identify signs of problem gaming behaviour and applying requested tools such as deposit limits or self-exclusion.
• Platform improvement: Analysing usage patterns — in aggregated, anonymised form — to improve navigation, game selection and overall player experience.
• Security and fraud prevention: Detecting unusual login patterns, preventing duplicate accounts and protecting both you and the platform from fraudulent activity.
• Promotional communications: Sending you information about relevant bonuses, PSL match-day offers and VIP tier updates — but only where you have opted in to receive such communications. You can opt out at any time through your account settings.
• Legal and compliance obligations: Retaining records as required to fulfil our internal compliance obligations and respond to legitimate information requests.

5. Payment Data & PKR Transactions

Financial data receives a higher level of protection within the Tojay APK platform. When you deposit or withdraw PKR using JazzCash, Easypaisa, Raast, a bank transfer or any other supported method, the following data handling rules apply:

• Full payment account numbers and wallet credentials are never stored on Tojay APK servers. Only masked references (e.g., the last four digits of an account number) are retained for transaction records.
• All payment data in transit between your device and our servers is encrypted using industry-standard TLS protocols.
• Transaction records — including amounts, timestamps and payment method references — are retained for internal audit and compliance purposes for a minimum of three years.
• Payment data is shared only with the specific payment processor required to complete your requested transaction. It is not shared across processors or retained by them beyond what their own policies permit.
• Your deposit history and withdrawal records are visible within your account dashboard at any time so you can verify your own transaction activity.

If you believe a transaction on your account was not initiated by you, please contact support immediately. We will temporarily restrict transaction activity on your account while the matter is investigated.

6. Sharing & Disclosure

We do not share your personal data with third parties except in the following limited and specific circumstances:

• Payment processors: JazzCash, Easypaisa, Raast and banking partners receive only the transaction data necessary to process your PKR deposit or withdrawal. They are contractually bound to use this data for no other purpose.
• Identity verification providers: Where you are asked to verify your CNIC or proof of payment method, a specialist verification partner may process your submitted documents. These providers act as data processors under our instruction and are bound by strict confidentiality obligations.
• Fraud prevention and security services: Technical data such as IP addresses and device fingerprints may be shared with security providers to identify and block fraudulent activity. This sharing is automated and purpose-limited.
• Game providers: Game session data (stakes, outcomes, session timing) is shared with our game software providers to the extent necessary to operate the games correctly and resolve any disputes about individual rounds.
• Legal obligations: We may disclose personal data if required to do so by a valid legal process, court order or other binding obligation. We will notify you of any such disclosure where we are legally permitted to do so.

None of the third parties listed above are permitted to use your personal data for their own marketing, profiling or commercial purposes. All sharing is governed by data processing agreements that restrict third parties to the specific tasks they are engaged to perform.

7. Data Retention

We keep your personal data only for as long as it is genuinely necessary. The retention periods we apply reflect the different types of data and the purposes for which they are held:

• Active account data (identity, contact, gaming activity) is retained for as long as your account remains active plus a period of 12 months following account closure, to allow for any post-closure queries or disputes to be resolved.
• Financial transaction records are retained for a minimum of three years to support internal audit requirements and respond to any financial queries raised within that window.
• Support communications (chat logs, email correspondence) are retained for 24 months from the date of the interaction, after which they are deleted or permanently anonymised.
• Technical and usage data (IP logs, device data) is retained for 12 months for security and fraud detection purposes, then purged from active systems.
• Marketing consent records are retained indefinitely as evidence that you provided consent, even after you have opted out of communications — the communications themselves stop immediately upon opt-out.

When retention periods expire, data is deleted from active databases and any backups are overwritten on their next scheduled rotation cycle. Data deletion requests submitted by players are processed within 30 days, subject to our obligation to retain financial records as described above.

8. Security Measures

Tojay APK applies multiple layers of technical and operational security to protect your personal data from unauthorised access, loss or misuse. Our key security measures include:

• TLS encryption on all data transmitted between your device and our servers. Look for the padlock icon in your browser's address bar when using the platform.
• Password hashing: Your login password is never stored in plain text. It is processed through a one-way cryptographic hash before storage, meaning even our own team cannot read your password.
• Two-factor authentication (2FA) is available and recommended for all player accounts. Enabling 2FA adds a second layer of protection beyond your password alone.
• Access controls: Internal access to player data is restricted on a strict need-to-know basis. Support agents can see what is necessary to assist you — no more.
• Regular security reviews: Our platform infrastructure undergoes periodic security assessments to identify and address potential vulnerabilities.
• Anomaly detection: Automated systems monitor for unusual login locations, rapid successive failed login attempts and other patterns that may indicate account compromise.

9. Cookies & Tracking

Tojay APK uses cookies and similar local storage technologies to make the platform function correctly and to improve your experience. Cookies are small text files stored on your device when you visit the platform.

• Essential cookies: Required for the platform to function — login session management, security tokens and game state preservation. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, notification choices and deposit method selections. These improve your experience but are not strictly required.
• Analytics cookies: Help us understand how players navigate the platform — which pages are most visited, where players encounter difficulty and how session flows can be improved. Data collected via analytics cookies is aggregated and anonymised.
• Security cookies: Used by our fraud prevention systems to recognise trusted devices and flag unusual access patterns.

We do not use advertising cookies, behavioural profiling cookies or any cookies that track your activity across other websites. All cookies set by the Tojay APK platform are first-party cookies or are set by named service providers acting under our instruction.

You can manage cookie preferences through your browser settings. Blocking essential cookies may affect your ability to log in and play games on the platform. For functional and analytics cookies, browser-level control is the primary management mechanism available.

10. Your Data Rights

As a player on the Tojay APK platform, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team using the details in Section 13.

All rights requests are processed free of charge. We aim to respond within 30 days. For complex requests, we may require up to 60 days and will notify you if an extension is necessary. We may ask you to verify your identity before processing a rights request to ensure we are responding to the account holder.

11. Minors & Under-Age Access

Tojay APK is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. If we discover that a user under 18 has registered an account, that account will be closed immediately and any data collected will be deleted from our active systems as quickly as technically possible.

If you are a parent or guardian and believe that a person under your care has registered on the platform, please contact our support team immediately. We will take prompt action to close the account and remove the associated data.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the platform, the services we offer or our data practices. When we make changes, we will update the "Last updated" date shown at the top of this page.

For significant changes — particularly those that affect how we use your personal data or your rights in relation to it — we will provide advance notice via an on-platform notification or an email to your registered contact address. Minor clarifications and editorial updates may be made without advance notice.

Your continued use of the Tojay APK platform after any update to this policy constitutes your acceptance of the revised version. If you have concerns about any changes, you are always welcome to contact us before the changes take effect.

13. Contact & Data Requests

If you have any questions about this Privacy Policy, want to exercise any of your data rights or need to report a privacy concern, please get in touch with our support team. We treat all privacy-related contacts as a priority.

• Email: [email protected] (plain text only — do not attach copies of identity documents to unsolicited emails)
• Live Chat: Available 24/7 through the platform interface after you log in
• Response time for data rights requests: Within 30 days of receipt
• Response time for general privacy queries: Within 2 business days

When submitting a data access, correction or deletion request, please include your registered username and the email address associated with your account so we can locate your records promptly and verify your identity before processing the request.