Privacy Policy

1. Information We Collect

When you use BookMyScrims we collect only what is necessary to operate the platform:

• Account data: phone number (used for login and as your unique identifier), hashed password.
• Profile data: team name, in-game name (if you provide it to an organizer).
• Activity data: scrim registrations, match results uploaded by organizers, XP ledger entries, ratings you leave for organizers, requests for XP, chat messages exchanged during a match window.
• Safety data: if you report content, we store what you reported - including a copy of the message or post as it was at the time - along with the reason you gave and who posted it. If you block someone, we store that you did. This is kept so our moderation team can act on reports even after the original content is edited or deleted.
• Technical data: standard server logs (IP address, request paths, timestamps) used only for operating, securing, and debugging the platform.
• Advertising data (mobile apps only): when an ad is shown inside the Android or iOS app, your device advertising identifier (IDFA on iOS, Advertising ID on Android) and ad-interaction data are processed by Google AdMob to serve and measure that ad. See section 9. The website is ad-free.

We do not collect: payment information, bank or UPI details, government identification numbers, precise or GPS location, contacts, or any biometric data. There is no payment gateway integrated into the platform.

2. How We Use Your Information

We use your information only to provide and improve the service: authenticate your account, route scrim registrations, broadcast match room credentials, compute leaderboards, maintain per-organizer XP ledgers, send OTPs and IDP notifications over WhatsApp, prevent abuse via rate limiting, review reported content and enforce blocks, and respond to support requests. Inside the mobile apps we also use your device advertising identifier to show ads, as described in section 9. We do not sell your information, and we do not build advertising or behavioural profiles of you ourselves.

3. Who Sees Your Information

Your information is visible to:

• Other users in scopes you opt into — your team name on leaderboards, in registered-team lists for scrims you joined, and in ratings you publicly leave.
• Organizers whose communities you join — they see your phone number, team name, registration history, and XP balance with them.
• Platform administrators — for moderation, abuse prevention, and dispute resolution.
• Operational service providers — Supabase (managed Postgres + realtime), Upstash QStash and Redis (job scheduling, OTP storage), WhatsApp Cloud API (OTP and IDP messages). These providers process data only on our behalf under their respective contracts.
• Google AdMob — only in the mobile apps, and only to serve and measure the ads described in section 9. It never receives your phone number, team name, chat messages, or XP history.

We do not sell, rent, or trade personal information to data brokers or any other third party. Sharing your advertising identifier with Google AdMob to display an ad, described in section 9, is the only advertising-related disclosure we make — and because some privacy laws treat that as "sharing" for targeted advertising, it is spelled out in full there.

4. Data Retention

We retain your information for as long as your account exists. If you delete your account, we remove personal identifiers but may retain aggregate or anonymized records (such as leaderboard placements or XP ledger entries) to maintain the integrity of historical scrim records for the relevant organizer's community. Records relating to reports and blocks are kept while they are needed for safety and abuse prevention, so that deleting an account cannot erase a pending report against it.

5. Security

Passwords are stored using bcrypt hashing. Sessions are managed via signed HTTP-only JWT cookies. Data is encrypted in transit (HTTPS) and at rest on our managed cloud infrastructure. No system is perfectly secure; we encourage you to use a strong, unique password and to log out of shared devices.

6. Cookies

We use a single essential cookie (auth-token) to keep you logged in. It is HTTP-only, secure, and SameSite=Lax. We do not use tracking cookies, marketing pixels, or third-party analytics on user pages. Ads run only inside the mobile apps, so the website sets no advertising cookies; the identifiers used in the apps are covered in section 9.

7. Your Rights

You have the right to access, correct, or delete your personal information. You can update your team name and profile at any time from the profile page.

You can delete your account from inside the app at any time— open your profile, scroll to Account Safety, and choose "Delete my account". No request or approval is needed, and the same screen lists everyone you have blocked so you can unblock them. If you would prefer a copy of your data, or need help with deletion, contact us at bookmyscrimsindia@gmail.com.

8. Third-Party Services

Games are operated by their respective publishers — we do not host or distribute any game, and any data you provide directly to a game operator is governed by their respective privacy policies. WhatsApp messages sent through our platform travel via the WhatsApp Business Cloud API and are also subject to Meta's privacy policy. Ads inside the mobile apps are served by Google AdMob and are also subject to Google's privacy policy — see section 9.

9. Advertising

The BookMyScrims Android and iOS apps show ads supplied by Google AdMob. An organizer can require a short rewarded video before registering for their scrim or tournament, and opening a leaderboard may show a skippable ad. Watching an ad grants no XP Coins and buys nothing — it is only a gate an organizer can choose to turn on. The website and the mobile browser version are entirely ad-free.

To serve, measure, and cap the frequency of those ads, Google receives your device advertising identifier (IDFA on iOS, Advertising ID on Android), your IP address — from which an approximate region can be inferred — and standard device and ad-interaction information. Google processes that data under its own privacy policy, at policies.google.com/technologies/partner-sites. We receive only aggregate impression and revenue reports, which we use to attribute earnings to the organizer who ran the event; those reports do not identify individual players.

Your choices.On iOS the app asks for permission through Apple's App Tracking Transparency prompt before the first ad loads, and where consent is legally required a Google consent form is shown first. Declining either is fine — ads still work, they are simply non-personalized. You can change your mind at any time: iOS Settings → Privacy & Security → Tracking, or Android Settings → Privacy → Ads, where you can also reset or delete your advertising ID.

10. Children's Privacy

BookMyScrims is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 18, you may use the platform only with the knowledge and permission of a parent or legal guardian.

We do not build advertising profiles of our players, and we do not use your information for anything beyond operating the platform and serving the ads described in section 9. If you are a parent or guardian and believe a child in your care has created an account, contact us at bookmyscrimsindia@gmail.com and we will delete the account and its personal data. Where the law of your jurisdiction sets a higher age of consent or requires verifiable parental consent, that requirement applies instead.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform with a revised "Last Updated" date. Continued use after an update constitutes acceptance.