InPlayCricket - Privacy Policy

1. Introduction

Welcome to InPlayCricket. This Privacy Policy explains how Gametech Solutions Limited ("we", "us", or "our") collects, uses, shares, and protects your personal information when you use the InPlayCricket mobile application ("the App") on iOS and Android devices.

InPlayCricket is a free-to-play social cricket gaming application that allows users to make predictions on live cricket matches using virtual coins. The App does not involve real-money gambling. In-app purchases of virtual coins are processed through Apple App Store and Google Play billing systems and, for users in India only, through Payrock using the Unified Payments Interface (UPI).

We are committed to protecting your privacy and handling your data transparently. This policy is designed to comply with the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), India's Digital Personal Data Protection Act 2023 (DPDPA), and applicable data protection laws in Australia, New Zealand, Pakistan, Bangladesh, and Sri Lanka.

By downloading, installing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the App.

2. Information We Collect

We collect the following categories of information to provide, improve, and secure the App:

2.1 Information You Provide Directly

When you register for an account or use the App, you may provide us with:

• Account information: email address, phone number, username, and password.
• Social login data: if you register or sign in using Google, Facebook, or X (Twitter), we receive your account ID and basic profile information from that provider via OAuth 2.0. We do not receive or store your social media password.
• Referral codes: if you use an invitation or referral code during registration (optional).
• Preferences: your country and language preferences.
• UPI payment details (India only): if you are based in India and choose to purchase virtual coins via UPI through our payment partner Payrock, you will be asked to provide your first name, last name, date of birth, and mobile phone number. These details are required by the UPI scheme and our payment partner to process the transaction. We do not collect or store your UPI ID, bank account number, or any payment credentials.

2.2 Information Generated Through Your Use of the App

As you interact with the App, we automatically collect:

• Gameplay data: predictions placed, prediction amounts, picks, results, prediction history, and accuracy statistics.
• Virtual economy data: virtual coin balance, coin transaction history (purchases, earnings, and debits), and in-app purchase records.
• Session data: login timestamps, login frequency, and session duration.

2.3 Information Collected Automatically

When you access the App, our servers automatically log:

• Device information: device type and model, operating system version, and app version (derived from user agent headers and API request headers).
• Network information: IP address, logged with API requests.
• Diagnostic data: crash reports, error logs, stack traces, recent user actions leading to a crash (breadcrumbs), and device context, collected via our crash reporting service (Sentry).
• API request logs: records of requests made to our servers, used for security monitoring and debugging.

2.4 Information We Do Not Collect

We want to be clear about the data we do not collect:

• We do not collect precise geolocation data (GPS coordinates).
• We do not collect health or biometric data.
• We do not collect advertising identifiers (IDFA, IDFV, or Google Advertising ID).
• We do not access your camera, microphone, contacts, photo library, or notification systems.
• We do not handle or store payment card details, UPI IDs, or bank account numbers. Real-money transactions are processed by Apple, Google, or (for users in India only) by our payment partner Payrock.
• We do not use any external analytics SDKs (such as Firebase Analytics or Mixpanel). Our analytics are handled internally on our own servers.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide and operate the App

• Create and manage your account.
• Process your in-game predictions and maintain your prediction history.
• Manage your virtual coin balance and transaction records.
• Deliver leaderboards, achievements, and social features.

To process transactions

• Validate in-app purchase receipts received from Apple App Store and Google Play.
• For users in India only, transmit the personal details required for UPI payments (first name, last name, date of birth, mobile phone number, email) to our payment partner Payrock to initiate and verify the transaction, and process the resulting status callback.
• Credit virtual coins to your account following successful purchases.

To improve and develop the App

• Analyse gameplay patterns and engagement to improve game mechanics.
• Identify and fix bugs, crashes, and performance issues using diagnostic data.
• Develop new features based on aggregated usage trends.

To ensure security and prevent fraud

• Detect and prevent fraudulent activity, cheating, multi-account abuse, and exploitation of game systems.
• Monitor API request patterns for security anomalies.
• Enforce our Terms of Service.

To communicate with you

• Send essential service communications (account verification, password resets, important updates to our Terms of Service or this Privacy Policy).
• Respond to support requests and enquiries.

3.1 Legal Bases for Processing (GDPR / UK GDPR)

For users in the European Economic Area (EEA) and the United Kingdom, we process your personal data on the following legal bases:

Legal Basis	Description	Applies To
Contract Performance	Processing necessary to provide the App and its features as described in our Terms of Service.	Account creation, gameplay processing, virtual coin management, purchase validation.
Legitimate Interests	Processing necessary for our legitimate business interests, balanced against your rights.	Analytics and product improvement, fraud prevention and security monitoring, bug fixing via crash reports.
Legal Obligation	Processing necessary to comply with applicable laws.	Tax and financial record-keeping, responding to lawful requests from authorities.
Consent	Where required, we will obtain your explicit consent before processing.	Optional marketing communications (if introduced in future); processing of any new data categories not covered by other legal bases.

4. Sharing of Information

We do not sell your personal data. We do not share your data with advertisers. We share information only in the following limited circumstances:

Service providers

We engage a limited number of third-party service providers who process data on our behalf, strictly for the purposes described in this policy. These providers are contractually obligated to protect your data and may not use it for their own purposes. Our current service providers are listed in Section 5.

Platform providers

When you make an in-app purchase via Apple App Store or Google Play, the transaction is processed by Apple or Google. These providers receive and process your payment information directly under their own privacy policies. We receive only a purchase receipt confirming the transaction.

Payment partner (India / UPI only)

For users in India who choose to purchase virtual coins via UPI, the transaction is processed by our payment partner Payrock. We share with Payrock the personal details required to initiate the payment (first name, last name, date of birth, mobile phone number, email), the transaction amount and currency, and a transaction reference. Payrock processes your UPI authentication and the underlying bank transfer directly and returns a status callback to us. We do not receive or store your UPI ID or bank credentials.

Social login providers

If you choose to sign in using Google, Facebook, or X (Twitter), we exchange authentication tokens with those providers to verify your identity. We do not share your InPlayCricket activity data back to these providers.

Legal requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

Business transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via the App or email before your data becomes subject to a different privacy policy.

5. Third-Party Services

The App uses the following third-party services that may receive limited user data:

Service	Provider	Data Shared	Purpose
Crash Reporting	Sentry (Functional Software, Inc.)	Crash logs, stack traces, device info, breadcrumbs, user ID.	Identify and resolve app crashes and errors.
In-App Purchases	Apple App Store / Google Play Billing	Purchase receipts (Card details handled by platform).	Process real-money purchases of virtual coins.
UPI Payments (India only)	Payrock	First name, last name, date of birth, mobile phone number, email, transaction amount, currency, country, and a transaction reference. UPI ID and bank credentials are handled by Payrock and the UPI scheme, not by us.	Process UPI-based real-money purchases of virtual coins for users located in India.
Social Login	Google, Facebook, X (Twitter)	OAuth tokens and basic account identifiers.	Account creation and authentication.
Sports Data	External feed providers	No user data is shared.	Provide live match data and commentary.

We do not integrate any advertising SDKs. All gameplay analytics are processed internally.

6. Data Retention

We retain your data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:

Data Category	Retention Period	Notes
Account data (email, username, phone)	While account is active. Soft-deleted on request; permanently purged after 1 year.	1-year soft-delete window allows account recovery if you change your mind.
Prediction history	Archived after processing; retained while account is active.	Deleted when account is permanently purged.
Virtual coin transaction logs	Retained indefinitely while the service operates.	Required for audit, integrity, and fraud prevention purposes.
API request logs	90 days.	Used for security monitoring and debugging.
UPI payment transaction records (India only)	Retained for the period required by applicable financial and tax regulations.	Includes the personal details submitted for the UPI payment (first name, last name, date of birth, mobile phone number, email), transaction status, and reference. Retained for audit, fraud prevention, and regulatory compliance.
Authentication tokens (on device)	Cleared on logout or account deletion.	Stored locally in iOS Keychain / Android Keystore. Never retained on our servers beyond session validity.
Local preferences (language)	Stored on device only; cleared on uninstall.	Not transmitted to our servers.
Crash reports (Sentry)	Events: 90 days. Attachments: 30 days.	Managed by Sentry's data retention policies.

7. Your Rights and Choices

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal data:

7.1 Rights Under GDPR and UK GDPR

If you are located in the EEA or the United Kingdom, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may request that we delete your personal data, subject to any legal obligations requiring us to retain it.
• Right to restriction: You may ask us to restrict processing of your data in certain circumstances.
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority (for example, the Information Commissioner's Office in the UK, or the relevant supervisory authority in your EEA member state).

7.2 Rights Under India's Digital Personal Data Protection Act 2023

If you are located in India, you have the right to access, correct, and erase your personal data, and to nominate another person to exercise these rights on your behalf. You also have the right to an effective grievance redressal mechanism.

7.3 Rights for Users in Other Regions

Users in Australia, New Zealand, Pakistan, Bangladesh, Sri Lanka, and other jurisdictions may have additional rights under their respective data protection laws. We will honour reasonable requests to access, correct, or delete your personal data regardless of your location.

7.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at sior@gametechiom.com. We will respond to your request within 30 days (or sooner if required by applicable law). We may ask you to verify your identity before processing your request.

7.5 Account Choices

• Delete your account: You can request account deletion at any time by contacting us. Your account will be soft-deleted immediately and permanently purged after 1 year.
• Update your information: You can update your username, email, or preferences directly within the App's settings.
• Disconnect social logins: You can unlink Google, Facebook, or X (Twitter) from your account in the App's settings, provided you have set up an alternative login method (email and password).

8. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it:

• Encryption in transit: All data transmitted between the App and our servers is encrypted using HTTPS/TLS.
• Password security: Passwords are hashed using Bcrypt before storage. We never store passwords in plain text.
• Authentication: API requests are authenticated using JSON Web Tokens (JWT). Social login flows use OAuth 2.0 with PKCE (Proof Key for Code Exchange) for enhanced security.
• Secure token storage: Authentication tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore), not in plain storage.
• Transaction integrity: Wallet and payment API calls are signed using HMAC-SHA256 to prevent tampering.
• Database security: Database-level constraints and validations protect data integrity.
• Crash reporting security: Diagnostic data sent to Sentry is transmitted over HTTPS with DSN-based authentication.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to implementing and maintaining industry-standard protections.

9. Children's Privacy

InPlayCricket is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age.

If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete that data from our servers. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at sior@gametechiom.com so that we can take appropriate action.

10. International Data Transfers

InPlayCricket operates globally, serving users in India, the United Kingdom, Australia, New Zealand, Pakistan, Bangladesh, Sri Lanka, and other countries. Your personal data may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection laws.

Where we transfer personal data from the EEA or the United Kingdom to countries that have not been deemed to provide an adequate level of data protection, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.
• Any other lawful transfer mechanism recognised under applicable data protection law.

Our crash reporting provider, Sentry, may process data in the United States. Sentry maintains appropriate data protection safeguards as described in their privacy documentation.

For users in India who use UPI to purchase virtual coins, the personal details required for the payment are transmitted to our payment partner Payrock. Payrock processes this data in accordance with its own privacy policy and applicable Indian data protection law, including India's Digital Personal Data Protection Act 2023.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make changes, we will:

• Update the "Last Updated" date at the top of this policy.
• Notify you of material changes through an in-app notification or by email (if we have your email address).
• Where required by law (for example, under GDPR), obtain your consent before applying changes that affect how we process your data.

We encourage you to review this policy periodically. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy, to the extent permitted by applicable law.

12. Contact Us

Gametech Solutions Limited
Email: sior@gametechiom.com