Privacy Policy

Effective date: November 13, 2026

cricscore is run by BookMyOpponent, B-406, Central Park, Kannamwar Nagar, Vikhroli E, Mumbai 400083, India (“we”, “our” or “us”). We decide how and why your personal data is used, so under India’s Digital Personal Data Protection Act, 2023 we are its data fiduciary. cricscore is our Android and iOS apps, our web app at app.cricscore.app and our website at cricscore.app (together, the “Service”). You use it to score cricket matches, run squads and tournaments, share live scores and, if you choose, stream matches to your own YouTube channel.

This policy explains what we collect, why, who we share it with, how long we keep it and what you can do about it. When you create an account, you agree to our Terms, confirm you’ve read this policy, and consent to how we use your details, as three separate steps. Some uses, like sharing usage data, are optional, and you choose them separately.

Your data at a glance

Data	Why we use it	Required or optional	How long we keep it
Mobile number	To create your account, sign you in and text you codes and account alerts	Required	Until you delete your account
Password, email address or Google sign-in	To sign you in another way and protect your account	Optional	Until you delete your account
Username and name	To show who you are on scorecards, squads and your player page	Required	Until you delete your account. Your name on past scorecards becomes “Deleted player”
Date of birth	To check you’re 18 or over	Required	Until you delete your account
Profile details: photo, playing role, batting and bowling style, wicket-keeping, jersey number, bio, social links	To show on your player page	Optional	Until you delete your account
Gender, city and your city’s map location	To complete your profile. Never shown publicly	Optional	Until you delete your account
Consent records	To show which versions of our Terms and this policy you accepted, and what you consented to	Required	3 years after you delete your account
Match, squad and tournament records	To score matches and keep the record of each game	Required to score or play	Kept as the record of the game (section 5.3)
Sign-in sessions	To keep you signed in and show your signed-in devices	Required	30 days after a session ends
Push notification token	To send you notifications	Optional	Until you delete your account, or until the token stops working
Device location	To find the address of a venue	Optional	Up to 24 hours in our servers’ memory. Only the venue you choose is saved
Usage data	To find crashes and improve the app	Optional. Off until you choose	12 months
Feedback you send in the app	To answer you	Optional	2 years
Messages from our website’s support form	To reply to you	Optional	2 years after we reply
YouTube connection: encrypted token, channel ID, name and picture	To stream matches to your channel	Optional	Until you disconnect (section 4)
YouTube broadcast IDs on a match	To show and manage the broadcast	Optional	Checked with YouTube at least every 30 days (section 4)
YouTube stream key	So your camera or streaming app can send video to YouTube	Optional	In our servers’ memory only, while the broadcast runs
Privacy requests	To act on them and show how we handled them	Optional	3 years after we close them
Server logs	To run and secure the Service	Required	Up to 14 days
Records of texts we sent (scrambled number, never the code)	To deliver codes, alerts and invitations, and keep to the invitation limits	Required	180 days; invitation records 1 year
Details about you that someone else entered (section 1.4)	To put you on a roster and scorecards	Not your choice. You can remove yourself	Until you remove yourself, or 30 days after you’re on no roster

---

1. Information We Collect

We collect information in four ways: what you give us, what the app collects as you use it, what other services send us, and what other people enter about you.

1.1 Information You Provide Directly

• Account: your mobile number, a username, and a password if you set one. You can also add an email address. If you sign in with Google, Google gives us your name, verified email address and profile picture.
• Date of birth (required): we use it to check you’re 18 or over.
• Profile: your name and, if you choose, a photo, your playing role, batting and bowling style, whether you keep wicket, jersey number, a bio, and links to your X and Instagram profiles.
• Gender and the map location of your city (both optional): a city’s location is kept only to about 1 kilometre.
• Consent records: when you accept our Terms, confirm you’ve read this policy, consent to how we use your details, give your date of birth, or connect YouTube, we record which version, when, and on which platform.
• Uploaded images: your photo and any squad logos, tournament banners or other images you upload.
• Cricket and match data: squads, fixtures, playing elevens, ball-by-ball scoring (runs, extras, wickets, shot positions), awards and tournament auctions you create or take part in.
• Feedback: when you use Send feedback in the app, we collect the category, your message and your account.
• Reports: if you report a user, squad or tournament, we collect your report and any notes you add.
• Privacy requests: if you make one, we collect your email address or, in the app, your account, the type of request and any details you give. If you remove a number someone added, we collect that number to check the code we text it.
• Website messages: if you use the support form on cricscore.app, we collect your name, email, topic and message to reply to you.

1.2 Information Collected Automatically

• Sign-in sessions: for each device you sign in on, we keep the device name and model, operating system, app version or browser, and when it was last used. You can see them in Settings, under Signed-in devices.
• Codes and texts: when we text you a code, we keep a scrambled copy of the code for 5 minutes, and we keep a record that a text was sent: when, which kind, and whether it was delivered. The record holds a scrambled form of your number and never the code. To stop misuse, we also count codes requested from each device and each internet address, using a scrambled form of the address.
• Location: when you tap “Use current location” to set a match venue, we ask for your device’s location once. You can allow precise or approximate location; precise works better, because the venue is where you’re standing. We round the point to about 10 metres, send it through our servers to Google to find the address, and save only the venue you choose, which is shown publicly with the match so players can find the ground. We never store your device’s position as such, and a city is never read from your device.
• Push notification tokens: if you allow notifications, we keep the token your device’s push service gives the app, so we can send match updates, tournament notices and squad invitations.
• Usage data (optional): if you choose to share it, the app sends data about which screens you open and any crashes, with a random ID for your device. It’s never linked to your account and never includes your name, email or anything you type. It’s off until you choose. Change it any time in Settings, under Privacy.
• Server logs: our servers and hosting providers keep technical logs, including IP addresses, to run and secure the service. Our own logs never contain your email address, your full mobile number or any code we send.

1.3 Information from Third Parties

• Google sign-in: if you sign in with or link a Google account, Google shares your name, email address and profile picture.
• Google Maps and Places: when you look up a ground or address, we send your search or map point to Google, which returns addresses and map positions.
• YouTube: if you connect your YouTube channel, YouTube gives us your channel’s ID, name and picture, the status of broadcasts cricscore creates, and the stream address and stream key for each broadcast. Section 4 has the details.

1.4 Information Other People Give Us About You

A squad admin, match organiser or tournament organiser can add you to a roster with your name and mobile number before you have an account. They must confirm you’re 18 or over, that you agreed to be added, and that the number is yours. Nobody under 18 can be added. When they do:

• We create one entry for your number, with that name and any playing details they enter, and show your name and those details on that roster, on the scorecards of matches you’re picked for, and on a player page anyone can open. You don’t appear in player search. If someone else adds the same number later, they add the same entry.
• We send you one text message to say you’ve been added to a team, with a link to cricscore. It comes from BOOKMYOPPONENT PVT LTD, the company that runs cricscore, as a promotional message, so it is only delivered between 10 am and 9 pm and not at all if your number is registered on the national Do Not Disturb list for promotional messages. Nobody can make us text you more than three times in total, or more than once a week.
• To remove yourself, go to cricscore.app/remove-me, enter your number and the code we text you. We delete your entry, replace your name with “Deleted player” on matches already played, and keep a scrambled copy of your number so nobody can add you again or text you an invitation. You can still create an account yourself at any time.
• If you sign up with the same number, your account takes over the entry and its match history. If you already have an account and verify this number on it, we move the entry’s history to your account.

People added by email address before November 13, 2026 keep their entry. They were sent one email with a removal link, which works for 90 days; after that, use our privacy request form.

---

2. How We Use Your Information

2.1 To Run the Service (With Your Consent)

1. Your account: sign you in and verify your mobile number, and your email address if you add one, with one-time codes.
2. Age check: check from your date of birth that you’re 18 or over.
3. Scoring and records: keep your profile, manage rosters, score matches, work out standings and run auctions.
4. Public records: show scorecards, player stats, tournament brackets and live scores to players and the public (section 3.1).
5. Share cards: when you share a match or tournament link, use its data to make the preview card and banner.
6. Notifications: send account texts and emails such as sign-in codes and alerts when your account signs in on a new device or your password changes, and one invitation text to people added by mobile number (section 1.4).
7. Safety and moderation: check squad names, tournament titles, player names and bios against a profanity filter, review reports, and enforce our Terms.
8. Support: answer your messages and fix problems you report.
9. Consent records: keep a record of what you agreed to and consented to, so we can show it.
10. Removal requests: keep a scrambled copy of the mobile number or email address of anyone who removed themselves, so nobody can add them again.
11. Preventing misuse: limit how many codes can be requested for a number, from a device or from an internet address, and how many invitations one person can trigger in a day, so cricscore can’t be used to flood someone with texts.

2.2 Optional, With a Separate Choice

1. Usage data: find crashes and see which features people use, only if you choose to share usage data.
2. Device location for a venue: find a venue’s address when you tap “Use current location”.
3. Push notifications: send match updates, tournament notices and squad invitations to your device, if you allow them.
4. YouTube streaming: create and manage broadcasts on your channel, if you connect it (section 4).

We don’t sell your personal data or rent it to data brokers or advertisers.

2.3 Text Messages

We send three kinds of text message, all under the BOOKMYOPPONENT PVT LTD registration with Indian telecom operators:

• Codes to sign in, create an account, add or change your number, reset your password, or remove a number. Sender name BKMYOP.
• Account alerts when your account signs in on a new device or your password changes. Sender name BKMYOP.
• One invitation to a person someone added by mobile number (section 1.4). Sender number 684864, as a promotional message.

Operators may show the sender with a suffix such as -S or -P. We never send advertising for other companies. Codes and alerts protect your account, so they can’t be turned off while you have one. To stop invitations to a number, remove it at cricscore.app/remove-me.

---

3. How We Share Your Information

We share your information only in the situations below.

3.1 Public Cricket Community

Cricket is played in public, so some information is visible to other users and to anyone with a link. What is public: your username, name, photo, playing role, batting and bowling style, wicket-keeper flag, jersey number, bio, social links, career stats, squads, match records, and the venues of matches and squad home grounds.

Anyone can find you by name in player search. You can turn that off in Settings, under Privacy; your profile still opens from scorecards and squads. Your mobile number, email, date of birth, gender and city are never shown publicly. A signed-in player who types your full 10-digit mobile number into search can find your profile, with only the first two and last two digits of the number shown, unless you turned off player search. Nobody can search by part of a number, and searches by number are limited to stop anyone collecting profiles this way. A match marked private is left out of discovery lists and out of other people’s views of a player’s or squad’s matches, but anyone with its link can still open it.

3.2 Service Providers

These providers process data for us to run the Service:

Provider	What it does for us	Where
Railway	Runs our servers	Southeast Asia (Singapore)
Neon	Hosts our database and its backups	AWS Asia Pacific 1 (Singapore)
Cloudflare	Stores and delivers images, runs our websites	Asia-Pacific (APAC); delivery through Cloudflare’s global network
Google	Google sign-in; place search and addresses	Google’s data centres
Google (YouTube)	Live broadcasts on your channel, if you connect it	Google’s data centres
Expo, with Apple and Google push services	Delivers push notifications	United States
Zoho ZeptoMail	Sends account emails, codes and invitations	India
MSG91 (Walkover Web Solutions Private Limited)	Sends our text messages: sign-in codes, account alerts and invitations	India
PostHog	Usage data and crash reports, only if you choose	United States
Zoho Mail	Hosts our support inbox, including messages sent through our website’s support form	India

When you use Google sign-in, Maps or YouTube, Google also handles your data under the Google Privacy Policy.

3.3 Legal Requirements and Safety

We may disclose your information if the law, a court order or a government authority requires it, or if we believe it’s needed to:

• Comply with legal obligations or valid legal processes.
• Protect the rights, property or safety of cricscore, our users or the public.
• Prevent fraud, abuse or security problems.

3.4 Business Transfers

If cricscore is merged, acquired, restructured or sold, your personal information may be transferred as part of that deal. We will tell you before your personal data becomes subject to a different privacy policy.

---

4. YouTube Live Streaming

Using YouTube with cricscore. cricscore uses YouTube API Services. If you connect your YouTube channel, you can stream matches you score live to that channel. Connecting is optional, and you can disconnect at any time.

What we access. When you connect, you allow cricscore to manage live broadcasts on your channel (Google calls this permission youtube.force-ssl). We use it only to:

• check that your channel can stream when you connect, by creating a private test broadcast called “cricscore check” and deleting it straight away,
• create a live broadcast and its stream on your channel, with the title, description, privacy setting (public, unlisted or private) and “made for kids” setting you choose. We add a link to the match’s page to the description,
• check the broadcast’s status, so the app can show when you’re live,
• get the stream address and stream key your camera or streaming app needs,
• end the broadcast when you stop it, about an hour after the match ends, when you disconnect, or when you delete your account. If a broadcast never went live, we delete it instead,
• add the match result to the description of a broadcast cricscore created, once the match ends,
• read your channel’s ID, name and picture, so you can see which channel is connected.

Apart from the broadcasts cricscore creates, we don’t upload, edit or delete your videos, and we don’t read your comments, messages, subscribers or analytics.

What we store.

• A refresh token from Google, encrypted, so cricscore can manage broadcasts without asking you to sign in to Google each time. We never see your Google password.
• Your channel’s ID, name and picture. We refresh them from YouTube at least once a week.
• For each match you stream: the YouTube broadcast and stream IDs, the title, the privacy and “made for kids” settings, when the broadcast was created, started and ended, and why it ended. We check with YouTube at least every 30 days that the broadcast still exists, and remove the YouTube IDs when it doesn’t.
• The stream key stays in our servers’ memory only while the broadcast runs. It is never saved to our database or written to our logs.
• Your video goes straight from your camera or streaming app to YouTube. It doesn’t pass through our servers.

How we use and share it. We use your YouTube data only to run the streaming feature you see in the app. Apart from the watch link described below, we share it only with Google, which runs YouTube. We don’t sell it, use it for advertising, or use it to train AI models. Nobody at cricscore reads it, except to fix a problem you report to us or when the law requires it.

cricscore’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who can see your broadcast. If your broadcast is public or unlisted, the match’s page in cricscore shows a link to watch it on YouTube, while it’s live and after it ends. Anyone who can open the match sees the link, including people who aren’t signed in. If your broadcast is private, cricscore doesn’t show the link. On YouTube, your broadcast follows the privacy setting you chose and YouTube’s own rules.

Disconnecting and deletion.

• In cricscore: go to Settings, then YouTube, then Disconnect. We end any broadcast that’s running, remove our access at Google, and delete the token and channel details straight away. We also remove the YouTube IDs from your past matches.
• At Google: you can also remove cricscore’s access on Google’s security settings page. We check every day whether our access still works. Once we see it doesn’t, we delete the token and channel details within 7 days. That’s at most about 8 days after you remove access.
• Deleting your cricscore account does both of the above.
• Your broadcasts stay on your YouTube channel. Delete them in YouTube Studio if you want them gone.

Google’s terms. YouTube’s own terms apply to your use of YouTube: YouTube Terms of Service. Google handles your data under the Google Privacy Policy.

Questions or complaints about how we handle your YouTube data: contact our Grievance Officer.

---

5. Data Retention and Account Deletion

5.1 Data Retention

Data	How long we keep it
Your account and profile	Until you delete your account
An account whose date of birth shows an age under 18	7 days, hidden, then deleted
Sign-ups that never confirmed their email address	Deleted after 30 days, unless the account is on a roster, team sheet or tournament role
One-time codes	24 hours after they expire
Records of texts we sent (scrambled number, never the code)	180 days; invitation records 1 year, so we can keep to the invitation limits
Scrambled numbers and email addresses of people who removed themselves	Until that number or address is used to create an account
Sign-in sessions	30 days after they end
In-app notifications	180 days
Consent records	3 years after the account is deleted
YouTube token and channel details	Until you disconnect (deleted at once) or remove our access at Google (deleted within 8 days); channel details refreshed at least weekly
YouTube broadcast IDs on matches	Checked with YouTube at least every 30 days; cleared when the video is gone or you disconnect
Stream keys	In our server’s memory only while the broadcast runs; never saved
Feedback you send in the app	2 years
Messages sent through our website’s support form, and emails to our support address	2 years after we reply
Reports and moderation records	1 year after the report, once it’s closed
Privacy requests	3 years after we close them
Admin activity records	3 years; after an account is deleted they keep only its internal ID
Server and hosting logs	Up to 14 days
Usage data	12 months
Location: lookups on our servers	Up to 24 hours, in memory
Location: recent venues on your device	90 days, and removed when you sign out
Location: venues and cities you save	As long as the match, squad, profile or tournament exists
Entries created when someone added you, if you’re no longer on any roster	Deleted after 30 days
Match records	Kept as the record of the game; your name is replaced with “Deleted player” if you delete your account
Email delivery records at our email provider	60 days
Database backups	One snapshot a day, each kept for 30 days and then deleted

5.2 How to Delete Your Account

You can delete your account at any time in the app:

1. Open the cricscore app.
2. Go to the Profile tab and tap Settings.
3. Tap Sign-in & security.
4. Scroll to the Danger zone section.
5. Tap Delete account and confirm.

If you can’t use the app, use our privacy request form and choose Delete my data. We delete it as soon as you confirm the email we send, even if your account is suspended. If your account has no email address, make the request in the app: Profile, Settings, Privacy, Make a privacy request. Our account deletion page has the same steps.

5.3 What Happens When You Delete Your Account

• Your mobile number, email address, password, username, name, date of birth, gender, city, bio, social links, jersey number and playing details are permanently deleted.
• Your profile photo is deleted from our storage and cleared from our delivery network.
• Your sessions, push notification tokens, notification settings, one-time codes, follows, blocks, squad memberships and roles are deleted, and notifications that mention you are removed from other people’s inboxes.
• Your profile, stats and match list pages stop working.
• Past scorecards stay, because they are records of games other people played too. Your name on them is replaced with “Deleted player”. The scorecards keep an internal reference to the same deleted entry, so they are de-identified, not anonymous: someone who played in a match may still remember who you are.
• If you connected YouTube, we end any live broadcast, revoke our access at Google, and delete the token and channel details. Your videos stay on your channel.
• We keep, for the periods in section 5.1 and linked only to that internal reference: reports you made or that were made about you; our record of which versions of our Terms and this policy the account accepted; and admin activity records, with your name and details removed.
• If you ever made a privacy request other than a deletion, we keep it, with your email address, for 3 years after we closed it, so we can show how we handled it.
• If someone had added you and you removed yourself, we keep a scrambled copy of your mobile number or email address so nobody can add you again.
• If you signed in with Google, remove cricscore from your Google account’s connected apps too. We delete our link to it, but only you can remove it on Google’s side.

Deleted data leaves our backups within 30 days, when the last snapshot taken before the deletion expires.

---

6. Your Privacy Rights and Choices

• See your data: download a copy any time in the app, in Settings, under Privacy, then Download my data. To ask what data we hold and who we share it with, make a privacy request.
• Correct your data: edit most details in Edit profile. Your date of birth can only be corrected through a privacy request.
• Delete your data: delete your account in the app, or make a privacy request if you can’t use the app. If someone else added you, remove yourself at cricscore.app/remove-me.
• Withdraw consent: turn off Share usage data in Settings at any time, and disconnect YouTube in Settings at any time. You consented to us using your details to run your account; withdrawing that consent means deleting your account, because we can’t run it without your details.
• Nominate someone: name a person who can use these rights for you if you die or can’t act yourself.
• Hide from search: turn on Hide me from player search in Settings, under Privacy.
• Complain: raise a privacy complaint with our Grievance Officer (section 12).

Make any of these requests in the app (Settings, then Privacy) or at cricscore.app/privacy-request. We confirm a request made on the website by email, and reply within 30 days.

You can also control:

• Location: turn off location for cricscore in your device’s settings.
• Push notifications: change them in Settings, under Notification preferences, or turn them off in your device’s settings.

Regional Disclosures

• California Users (CCPA and CPRA): We do not sell personal information or share personal information for cross-context behavioral advertising. You have the right to request disclosure of categories of personal information collected, request deletion, and not be discriminated against for exercising your privacy rights.
• Indian users (Digital Personal Data Protection Act, 2023): you can access, correct and erase your data, withdraw consent, nominate someone and raise a grievance, as described above. If our Grievance Officer’s response doesn’t resolve your complaint, you can complain to the Data Protection Board of India.

---

7. Children

cricscore is for people aged 18 and over. We don’t knowingly collect personal data from anyone under 18, because Indian law needs a parent’s verified consent for that, and we don’t collect it.

• You must be 18 or over to create an account. We ask for your date of birth when you sign up.
• Nobody can add a player to a roster unless they confirm the player is 18 or over and agreed to be added.
• If the date of birth on an account shows its owner is under 18, we hide the profile at once, email the account, and delete it after 7 days. Past scorecards show the name until then, and “Deleted player” after. If the date is wrong, make a privacy request before then.
• If you believe a child’s data is on cricscore, make a privacy request and we’ll delete it.

---

8. Security of Your Information

We protect your data with these measures:

• HTTPS encryption for every connection between the app, the website and our servers.
• Connections between our servers and our database are encrypted and the database’s certificate is checked.
• Passwords stored only as bcrypt hashes, never in plain text.
• One-time codes, sign-in tokens and the links we email are stored only as scrambled values. Codes, sign-in tokens and request links expire; removal links work for 90 days.
• The token that lets us manage your YouTube broadcasts is encrypted, with a key kept apart from the database.
• Passwords and internal Google identifiers left out of the data our servers send to the app.

No way of sending or storing data over the internet is completely secure, so we can’t guarantee absolute security.

If a breach affects your personal data, we tell you and the Data Protection Board of India without delay, with what happened, what it means for you and what you can do.

---

9. Where Your Data Is Processed

We and our providers process data in the countries listed in section 3.2: India, the United States, Singapore. Delivery networks may serve images from locations near you.

---

10. Changes to This Privacy Policy

Each version of this policy has a date. When we change it in a way that affects what we collect or how we use it, the app asks you to review and accept the new version the next time you open it, and you can’t keep using cricscore without doing so. For other changes we update the date and summarise what changed at the top. Earlier versions are available on request. When a change affects you, the app asks you to accept the new version before you continue, and we record which version you accepted and when.

---

11. Contact Us

If you have questions about this policy or how we handle your data, contact us:

• Email: support@cricscore.app
• Privacy requests: cricscore.app/privacy-request
• Organisation: BookMyOpponent, B-406, Central Park, Kannamwar Nagar, Vikhroli E, Mumbai 400083, India
• Website: https://cricscore.app

---

12. Grievance Officer

• Name: Vishal Kamble
• Email: support@cricscore.app
• Address: BookMyOpponent, B-406, Central Park, Kannamwar Nagar, Vikhroli E, Mumbai 400083, India
• How to reach us: email the address above, make a privacy request and choose Raise a privacy complaint, or use Raise a privacy complaint in the app’s Settings.
• What happens next: we acknowledge your complaint within 5 working days and reply within 30 days.
• If you’re not satisfied: you can complain to the Data Protection Board of India.

---

13. Cookies and Local Storage

We use one cookie and some browser storage to make the Service work and to remember your choices.

13.1 Sign-in Cookie (Web App)

When you use the web app at app.cricscore.app, our servers set one cookie:

• Name: refresh_token
• Why: it keeps you signed in; the web app can’t work without it, so there’s no option to turn it off.
• Settings: HttpOnly (scripts on the page can’t read it), Secure (sent only over HTTPS), SameSite=None, and sent only to our sign-in addresses (/auth).
• How long: 30 days. It’s cleared when you sign out, or when you delete it in your browser.

Connecting YouTube sets no cookie of ours. Google’s sign-in page uses Google’s own cookies.

13.2 Local Storage

We keep these in your browser’s local storage:

• privacy-storage (the app, on iOS, Android and the web): stores your usage data choice in the app, on iOS, Android and the web, so we respect it every time you open cricscore.
• theme (this website): remembers your light, dark or system appearance choice.

13.3 Analytics

• PostHog (the app, on every platform): usage data and crash reports, only after you choose to share usage data, never linked to your account, and never for players under 18.
• This website doesn’t run any analytics.