DRAFT · 20 OCTOBER 2026

Privacy policy

Sportstack helps residential societies, schools and communities run sports tournaments. This policy explains what we collect, why, who can see it, and the choices you have. It is written for India’s Digital Personal Data Protection Act, 2023.

What we collect

Your account: your mobile number, which Google Firebase verifies with a one-time code, and the name you choose. If you add Google sign-in, Google shares your Google account’s email address and name with Firebase so it can sign you in; Sportstack uses them only for signing in and to suggest a name when you create your account. You can remove Google sign-in at any time in Account details. If you start with Google and cancel before adding a mobile number, that Google sign-in is deleted.
Account security: when your number was last verified by SMS, the identifier of the Google account you added (not its email), when you last chose “Sign out of all devices”, and your answers if we ask whether an account is yours after its number went unverified for months. Phone companies give unused numbers to new people, so we use these to keep your account from opening for someone else. If the new holder of your old number says it was given to them, we keep your account without that number.
Player profiles: name, date of birth (to check age categories) and gender category, and optionally city, club, a contact phone, a photo link and sports you’re interested in. Profiles can be created by you, by a parent or guardian, or by a tournament organizer or school when they add players to a roster.
Tournament activity: registrations and the answers an organizer asks for, teams, schedules, results, live scores, and requests or flags you send to organizers.
Casual games: games you record and the people you played with. People named in a game can see it and confirm or dispute it. Your private notes on a game are visible only to your account.
Tournament areas and your location for nearby search: organizers can add the PIN or postal code where a tournament is played; we turn it into an approximate area point, never an address. If you tap “Use my location” on Tournaments near you, your browser asks your permission and shares a position, which we round to about 1 km and use only for that search. We don’t save it with your account; like every request, it appears in our server logs, which are kept for 30 days. You can type a PIN code instead.
Technical data: our servers log each request, including your IP address, browser type, the page address, the time and any errors, to keep the service working and secure. Sign-in is protected by Google reCAPTCHA, which assesses your device and browser.

Why we use it

To sign you in, run the tournaments you take part in, show your match history, protect the service from abuse, and meet legal obligations. We do not sell your data, show advertising or use third-party analytics.

Who can see it

Organizers of a tournament, and the staff they appoint, such as sport and event leads and scorers, see the registrations, answers and results for that tournament.
The public, if the organizer chooses: when an organizer makes a tournament’s results public, anyone, including people who aren’t signed in, can see its schedules, results and standings with participants’ names, including children’s names.
Other participants see names in draws, teams and results.
The public player directory, if you opt in: adults can list their profile publicly, showing name, city, club, photo, sports and statistics from public tournaments. It is off unless you turn it on.
People you share a profile with see what you allow.
Our service providers process data for us: Google Cloud (app hosting and logs), Google Firebase (sign-in), Google reCAPTCHA (abuse protection), Neon (database) and the OpenStreetMap Foundation’s Nominatim service, which receives only PIN codes (a tournament’s, or one you type to search, the first time anyone uses it) and never your device location or personal details. Our app and database run in Singapore; Google’s sign-in and reCAPTCHA services and Nominatim may process data in other countries.

Children

Children can take part in tournaments. Their profiles are added by a parent or guardian, or by an organizer or school from a roster. Organizers and schools must have a parent’s or guardian’s permission before adding a child, and anyone under 18 should use Sportstack only with a parent’s or guardian’s permission. Children’s names can appear in results an organizer makes public. We don’t show children advertising or use their data for profiling. A parent or guardian can ask us to correct or remove a child’s data.

Storage in your browser

We use only what the app needs to work: Firebase keeps you signed in, and your browser stores a few preferences and demo data. There are no advertising or analytics cookies.

How long we keep it

We keep your data while your account is active, and server logs for a limited period. Tournament results stay part of each tournament’s history so other players’ records remain accurate. When you ask us to delete your account, we remove or de-identify your personal details where we can.

Your rights

You can ask to see, correct or delete your personal data, nominate someone to act for you, and raise a grievance with us. If we don’t resolve it, you can complain to the Data Protection Board of India.

Contact

We will publish a contact address for privacy requests and grievances here before Sportstack opens to the public.

Sign-in uses reCAPTCHA; Google’s Privacy Policy and Terms of Service apply.