Privacy Policy

1. Information We Collect

When you use BookMyScrims we collect only what is necessary to operate the platform:

• Account data: phone number (used for login and as your unique identifier), hashed password.
• Profile data: team name, in-game name (if you provide it to an organizer).
• Activity data: scrim registrations, match results uploaded by organizers, XP ledger entries, ratings you leave for organizers, requests for XP, chat messages exchanged during a match window.
• Technical data: standard server logs (IP address, request paths, timestamps) used only for operating, securing, and debugging the platform.

We do not collect: payment information, bank or UPI details, government identification numbers, location, contacts, or any biometric data. There is no payment gateway integrated into the platform.

2. How We Use Your Information

We use your information only to provide and improve the service: authenticate your account, route scrim registrations, broadcast match room credentials, compute leaderboards, maintain per-organizer XP ledgers, send OTPs and IDP notifications over WhatsApp, prevent abuse via rate limiting, and respond to support requests. We do not use your information for advertising, profiling, behavioural targeting, or for sale to third parties.

3. Who Sees Your Information

Your information is visible to:

• Other users in scopes you opt into — your team name on leaderboards, in registered-team lists for scrims you joined, and in ratings you publicly leave.
• Organizers whose communities you join — they see your phone number, team name, registration history, and XP balance with them.
• Platform administrators — for moderation, abuse prevention, and dispute resolution.
• Operational service providers — Supabase (managed Postgres + realtime), Upstash QStash and Redis (job scheduling, OTP storage), WhatsApp Cloud API (OTP and IDP messages). These providers process data only on our behalf under their respective contracts.

We do not sell, rent, or trade personal information to advertisers, data brokers, or any other third party.

4. Data Retention

We retain your information for as long as your account exists. If you request account deletion, we remove personal identifiers but may retain aggregate or anonymized records (such as leaderboard placements or XP ledger entries) to maintain the integrity of historical scrim records for the relevant organizer's community.

5. Security

Passwords are stored using bcrypt hashing. Sessions are managed via signed HTTP-only JWT cookies. Data is encrypted in transit (HTTPS) and at rest on our managed cloud infrastructure. No system is perfectly secure; we encourage you to use a strong, unique password and to log out of shared devices.

6. Cookies

We use a single essential cookie (auth-token) to keep you logged in. It is HTTP-only, secure, and SameSite=Lax. We do not use tracking cookies, marketing pixels, or third-party analytics on user pages.

7. Your Rights

You have the right to access, correct, or delete your personal information. You can update your team name and profile at any time from the profile page. To delete your account or request a copy of your data, contact us at support@bookmyscrims.com.

8. Third-Party Services

BGMI is operated by Krafton — we do not host or distribute the game, and any data you provide directly to Krafton or other game operators is governed by their respective privacy policies. WhatsApp messages sent through our platform travel via the WhatsApp Business Cloud API and are also subject to Meta's privacy policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform with a revised "Last Updated" date. Continued use after an update constitutes acceptance.