Age requirements and PayPal verification policy

Internal policy. Gamebreakers LLC. Effective October 17, 2026. Daily rules version 2026-10-26.

1. Summary

Anyone 13+ can play the Daily and win. Only players 18+ with their own connected PayPal account can cash out. A player under 18 who wins keeps the winnings in their GMBK balance until they turn 18 and connect their own PayPal account.

2. Why PayPal is the age check for cashing out

1. GMBK pays money out only by PayPal.
2. PayPal's User Agreement only lets people open an account if they are 18 or older (or the age of majority where they live).
3. To withdraw, a player must therefore connect their own PayPal account, and confirm in writing: "I confirm I am 18 or older, the PayPal account I connect is my own, and I agree to the Daily Official Rules."
4. Until then, their winnings stay in their GMBK balance. The balance can still be spent inside GMBK, on Premium, extra attempts and gifts.

3. Winnings held for players under 18

• Prizes a player wins are credited to their wallet after admin review, whatever their age.
• A player who hasn't connected PayPal sees, in the wallet: "Your winnings are safe here. To withdraw them you must be 18+ and connect your own PayPal account."
• When they turn 18, they connect their own PayPal (Wallet → Cash out (18+)) and can withdraw the full balance.
• They must not connect a parent's or anyone else's PayPal. The written confirmation says the account is their own. A withdrawal later found to have gone to someone else's account for a minor may be reversed, and the player's account closed.
• Open questions for counsel:
  • Unclaimed property. A 13-year-old's balance could wait 5 years, and states require unclaimed balances to be reported and turned over after a dormancy period (often 3–5 years). Decide whether balances expire, or whether GMBK reports them.
  • Prizes to minors. Some states require a minor's prize to be awarded to a parent or guardian, or forbid minors from entering cash contests at all.
  • Paid entries by minors. Under-18 players can buy Premium and extra attempts with their balance. Consider making extra attempts free (streak-only) for everyone, or blocking purchases without PayPal.
  • Store approval. Google Play's real-money contests policy and Apple 5.3 expect contest entrants to meet the legal age. Expect to be asked to explain this model, or to restrict cash rounds to 18+.

4. How the PayPal check works (technical)

1. In the app, the player opens Wallet → Cash out (18+) (ConnectPayPalScreen.tsx). Connect PayPal stays disabled until they tick the 18+ confirmation.
2. The app calls the paypal-connect function, which checks that:
   • the player is signed in,
   • adult is true,
   • the rules version matches the current DAILY_RULES_VERSION.

It then stores a one-time, 10-minute sign-in state tied to the player and returns PayPal's sign-in page.

1. The player signs in on PayPal's own page. GMBK never sees the PayPal password.
2. PayPal redirects to paypal-callback. That function consumes the one-time state, exchanges the code on the server, and reads the PayPal user id, email and verified status.
3. It refuses the connection if:
   • the PayPal account isn't verified (configurable with PAYPAL_REQUIRE_VERIFIED), or
   • the PayPal account is already connected to another GMBK account.
4. Otherwise it saves a payout_accounts record. The record holds:
   • the PayPal user id and email, and whether PayPal shows the account as verified
   • when the player confirmed they are 18+
   • which rules version they accepted
5. The database enforces it. request_withdrawal() refuses players without a payout_accounts record, and always pays the connected PayPal email. Players can't enter a destination, even with a modified app.
6. Players can disconnect PayPal in Settings, except while a withdrawal is pending.

5. Limits of this check

Connecting PayPal is a strong, low-cost signal, but it is not identity verification.

• A minor could connect a parent's PayPal.
• PayPal doesn't share a date of birth through standard Log in with PayPal.

6. Store and partner obligations

• Google Play: declare the Daily under "Real-money gambling, games and contests", and explain the held-balance model (under-18 winners can't withdraw). Target audience 13+, not Designed for Families.
• Apple (5.3): the official rules linked in the app, a statement that Apple is not a sponsor, and geo-restriction.
• PayPal: prior approval for skill games with prizes and paid entries. Payouts need a PayPal Business account.

7. The 13+ minimum at sign-up

Sign-up, in the app and on the portal, asks for a birth month and year without saying what age is required, and refuses anyone who could be under 13. Within the birthday month it assumes the birthday hasn't happened yet. The database repeats the check, so the auth API can't be used to skip it. The birth month and year are stored with the account, so admins can see which winners are minors and the app could later tell players when they can cash out.

Accounts created before this check, or by an admin in the Supabase dashboard, have no birth date stored.