Privacy

Account information: your email and login details, name, phone number if you add one, avatar or profile photo, and the profile information you provide. Your area, preferred venues, playing preferences and onboarding answers help set up your profile and starting rating. Passwords are handled by our login provider and stored only in encrypted (hashed) form.

Sporting records: event rosters, guest names and estimated levels, teams, scores, confirmations, disputes, ratings, reliability, statistics and tournament standings. Organisers can record attendance and payment status, and show payment details such as a UPI ID.

Guests: people who join a game by link give their name, an optional phone number, and their partner's name for team events. The organiser sees these. Only enter someone else's name or number if they have agreed.

Social information: follows, followers, club-profile visibility, friendships, posts, uploaded images, comments, likes and player feedback. We also store notifications and, if you turn on push alerts, a device subscription used to deliver them.

Usage information: the app records the screens a signed-in player visits and time spent with the app open, linked to their account, for administrator usage insights. For visitors who are not signed in, it records the pages opened, sign-up steps, the referring website or campaign tag, and the device type (phone, tablet or computer) against a random identifier stored on the device. It does not record IP addresses or names for this. If that device later signs in, the identifier is linked to the account. Hosting and login services also process technical connection and error information to run and protect the service.

We do not ask for sensitive information such as health, financial account, caste, religion or biometric data. Please don't put it in posts or messages.

We use this information to sign you in, maintain your profile, arrange games, record results, calculate ratings, show statistics, run social features and notifications, resolve disputes, prevent abuse, keep the service secure and understand how the app is used. Support messages are used to investigate and answer your request.

We process your data with your consent, which you give when you create an account, join a game as a guest or accept updated terms, and for other uses the law allows, such as meeting legal obligations, responding to lawful requests and handling emergencies. We don't sell your personal data, don't show ads and don't use your data to target advertising.

Other players can see what appears in profiles, teams, match history, standings and social posts. Leaderboard privacy settings hide your identity from non-friends on club and tournament leaderboards; they don't make every mention of you elsewhere private.

Organisers and authorised administrators manage event rosters and payment records. Administrators can access information needed to support accounts, moderate activity and maintain results. Share cards and links you send outside the app may be saved or forwarded by the people who receive them.

We use Supabase for login and database services and Lovable for app hosting. Email and push alerts are delivered through their service providers. Google Fonts and DiceBear avatars receive basic connection information when your device loads them. These providers process data for us under their own security and privacy terms. Some of them may store or process data on servers outside India; we only transfer data where Indian law allows it.

We may disclose information when required by law, a court order or a lawful request from a government agency, or to protect the safety of players or the public.

Our sharing team posts games from WhatsApp group messages, with the organiser's agreement. We keep the message, the game details, and the organiser's name and WhatsApp number. The game page shows the organiser's name and the game details, not their number. The sharing team sees the number so they can help fill the game, and players who ask to join message the organiser on WhatsApp, so they see it too.

When you ask to join one of these games, the organiser sees your name, level and WhatsApp number on their private page, and you message them on WhatsApp. To read pasted messages we may send their text to Anthropic, our AI provider, which processes it for us and does not use it to train its models.

The app stores session information to keep you signed in, your appearance preference, notification state and a random visit identifier used for the usage insights above. Its service worker stores a public offline page and push-alert state. The offline feature does not store match pages for offline scoring. You can sign out, clear site data or remove notification permission in your browser or device settings.

We use reasonable security safeguards, including encrypted connections (HTTPS), hashed passwords, database rules that limit what each player can read or change, and restricted administrator access. No system is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

We keep personal data only as long as we need it for the purposes above or as the law requires. Account information is kept while your account is active. Security and access logs are kept for at least one year, as the law requires. Visit records from people who never sign up are not linked to a name or account, and are deleted or anonymised once no longer needed for usage insights.

You can delete your account in Profile → Delete account, or contact us if you can't sign in. The in-app flow asks for your current password and confirmation. Deletion removes your login and personal profile details, and removes your social content, friendships, subscriptions and usage records, and unlinks device visit records from you. Shared match and tournament records remain under “Deleted player” so other players keep their history and ratings; scores and rating history are kept, and people who played with you may still recognise a past result.

Deletion can't recall screenshots or exports others have already saved. Provider backups and security records follow their own retention schedules.

You can edit your profile, switch your club profile between Public and Friends, follow or unfollow players, change leaderboard visibility, control notifications and delete your account at any time. Ratings are calculated from results and can't be edited by hand; report an incorrect result to the organiser or to us.

Under the Digital Personal Data Protection Act you can ask for a summary of the personal data we hold and who we have shared it with, have it corrected, completed, updated or erased, withdraw your consent, nominate someone to act for you if you die or can't act, and raise a grievance. Withdrawing consent is as easy as giving it: delete your account or email us. It doesn't affect what we did before, and we may not be able to keep running features that need that data.

Email varenmehta@40x40.club from your registered address where possible. We may need to confirm the account is yours; never send your password or a one-time code. We acknowledge requests within 24 hours and respond within 15 days.

Varen Mehta is our grievance officer for privacy requests and complaints. If you aren't satisfied with our response, you can complain to the Data Protection Board of India.

40X40 Club is for adults. You must be 18 or older to create an account or join a game, and organisers must not add anyone under 18. We don't knowingly collect personal data from children. If you believe a child's details have been added, contact us and we will remove them.

We will update this page when the service or how we use data changes, and show the date above. For important changes we will ask you to accept the update in the app. Questions about this notice: varenmehta@40x40.club.