Overview & Scope
Welcome to Lanka FinTechverse (accessible via verse.fintechfestival.lk), the official interactive digital game developed for the Sri Lanka FinTech Festival 2026 (“Festival”, “we”, “us”, or “our”), taking place in Colombo, Sri Lanka.
This Privacy Policy explains how the Sri Lanka FinTech Festival Committee collects, processes, stores, and safeguards personal data when you access our web application, authenticate via Google, play the Snakes & Ladders or LinkedIn-style Puzzles arena, and participate in our festival leaderboard. We are deeply committed to safeguarding your digital privacy in accordance with the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022 and international data protection principles.
Non-Commercial Educational Purpose: Lanka FinTechverse is an educational, non-gambling festival game created to build capacity, spark financial technology awareness, and celebrate Sri Lanka’s digital finance ecosystem. We never sell, monetize, or market personal information.
Information We Collect & Receive
We believe in strict data minimization. We only collect the minimal information necessary to securely authenticate you, prevent duplicate festival game entries, compute your score, and optionally display your ranking.
When you sign in using Google Identity Services / OAuth, we receive:
- Your verified email address
- Your full name (as registered with Google)
- Your public profile photo / avatar URL
- A unique Google OAuth identifier (Subject ID)
Your Google email is kept strictly private and is never shown on public screens.
Upon onboarding, you choose a customizable public display name (e.g., Satoshi_LK):
- Between 2 and 30 characters in length
- Can be a pseudonym, handle, or professional alias
- Stored separately from your Google email
- Can be updated at any time in your player profile
To compute game logic server-authoritatively and prevent manipulation:
- Dice roll outcomes and timestamped move sequences
- Board position, hearts remaining, and shields collected
- FinTech quiz answers (correct/incorrect tally)
- Match duration and completion timestamp
- Daily puzzle completion times and streaks
Standard web server logs collected automatically for system defense:
- IP address (for rate-limiting and DDoS mitigation)
- Browser user-agent and operating system
- Session authentication tokens managed by Supabase Auth
- Cryptographic challenge link tokens
Google API Services User Data Policy Compliance
Lanka FinTechverse’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How We Use Your Data
Your data is processed strictly for the execution and fair administration of the festival digital experience:
- 1Tournament Fairness & One-Run Enforcement: To ensure competitive integrity for festival prizes and recognition, each authenticated player is granted exactly one official game run. Your Google account ID ensures no duplicate runs are submitted under multiple aliases.
- 2Authoritative Score Computation: All dice rolls, ladder climbs, snake hazards, and quiz point deltas are calculated on the server to prevent client-side game tampering or manipulation.
- 3Voluntary Leaderboard Presentation: If and only if you choose to opt in, your public display handle, score, win/loss status, and duration are published on the live festival leaderboard displayed at venue screens and online.
- 4Dynamic Challenge Links & Share Cards: When you share your game result, our system generates cryptographic tokens that allow colleagues to challenge your run without exposing your personal email or Google account ID.
Legal Grounds & Sri Lanka PDPA Compliance
Under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, we process your personal data on the following statutory legal bases:
Leaderboard & Privacy By Design
We designed Lanka FinTechverse with strict privacy boundaries:
Data Storage, Security & Retention
We deploy robust technological and operational safeguards to protect your data against unauthorized access, accidental loss, or unlawful processing:
- End-to-End Encryption: All web traffic is encrypted in transit via TLS 1.3 / HTTPS. All backend database storage is encrypted at rest using industry-standard AES-256.
- PostgreSQL Row Level Security (RLS): Strict database access policies ensure players can only read and write their own active game state. Cross-account data querying is blocked at the database engine level.
- Retention Schedule: Official match data and leaderboard statistics are retained during the Sri Lanka FinTech Festival 2026 and for an audit archive period not exceeding 12 months following festival conclusion. After this period, personal identifiers are purged or permanently anonymized.
Your Rights Under Sri Lanka Law
Under the Sri Lanka Personal Data Protection Act (PDPA), you are entitled to several rights as a data subject:
Children’s Privacy
Lanka FinTechverse is designed for festival attendees, university students, industry professionals, and the general public interested in financial innovation. We do not knowingly collect personal information from individuals under the age of 13. If you believe a minor has provided personal data through Google sign-in without parental authorization, please contact us promptly and we will remove the record.
Contact Information & Data Controller
The data controller responsible for the processing of your personal data under this policy is the Sri Lanka FinTech Festival 2026 Committee.
Connecting financial institutions, technology builders, policymakers, and innovators.
Colombo, Sri Lanka
Festival Dates: 2–3 November 2026