Privacy Policy

Welcome to CricFlow. We are committed to protecting your personal information and your right to privacy. This Privacy Policy applies to all information collected through our website, our Android mobile application, and any related services, sales, marketing, or events.

When you visit our website or use our application, you trust us with your personal information. We take your privacy very seriously. In this Privacy Policy, we describe in the clearest way possible what information we collect, why we collect it, how we use it, how we protect it, and what rights you have in relation to it.

This Privacy Policy applies to both the CricFlow website (cricflow.in) and the CricFlow Android application. Wherever this document refers to "CricFlow", "we", "our services", or "the platform", it refers collectively to the website and the mobile application, unless a specific section states otherwise.

Users of the Android application are subject to the same privacy protections described in this Privacy Policy as users of the website. Should CricFlow release applications for additional platforms in the future (for example, iOS), this Privacy Policy will extend to those applications as well, and any material differences will be clearly documented at that time.

CricFlow offers several ways to register and sign in, each handled by a trusted authentication provider:

• Email & Password — passwords are never stored in plain text; they are cryptographically hashed. Registration and password reset use one-time passcodes (OTP) sent to your email.
• Phone Number Sign-In — verified using Firebase Authentication's phone verification, which sends an OTP by SMS.
• Google Sign-In — uses Google's OAuth service so you can sign in with your Google account without sharing your Google password with us.

Once signed in, your session is authenticated using a secure token rather than a browser cookie. All authentication traffic is encrypted in transit using HTTPS/TLS.

CricFlow's core purpose is cricket tournament, team, and player management. As part of delivering these features, we process:

• Tournament & Team Management — tournament formats, schedules, venues, and team rosters created by organisers and captains.
• Player Management & Statistics — player profiles, career statistics, and match history, compiled from live scoring data.
• Live Scoring & Match Statistics — ball-by-ball scoring data entered during a match, used to generate scorecards, statistics, and match summaries.
• Auctions — player auction data, including base prices, bids, and sold/unsold status, for tournaments that use CricFlow's auction feature.
• Streaming Overlays — broadcast overlay configuration (team names, scores, sponsor logos) used to generate on-screen graphics for organisers who livestream matches.
• Uploaded Images & Files — profile photos, team logos, and other files you choose to upload are stored securely with our cloud storage provider (see Section 8).

We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations. We do not sell your personal information.

CricFlow relies on the following third-party services to operate. Each provider only receives the data necessary to perform its function.

The Android app can send you push notifications about your matches, teams, and tournaments — for example, when a match you follow goes live, or when you are added to a team. You can disable push notifications at any time from your device's notification settings.

We may also send transactional email communications, such as OTP codes, password resets, and account-related notices. We do not send marketing email without your consent.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process, including encryption of data in transit (HTTPS/TLS), hashed password storage, and access-controlled cloud storage for uploaded files. However, please also remember that we cannot guarantee that the internet itself is 100% secure.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. Match, tournament, and statistical records may be retained for longer periods where they form part of the historical record of a completed tournament shared with other participants.

When you delete your account, your personal identifiers are purged immediately; cached data, log records, or backup snapshots are rotated out and purged within our standard backup rotation window. See Section 15, "Delete Your Account and Data".

Our infrastructure and service providers (including our database, application hosting, and cloud storage) may process and store data in data centers located outside your country of residence, including in regions operated by our hosting and cloud storage providers. Where this occurs, we rely on the standard data-protection safeguards offered by those providers.

Under applicable data protection laws — including India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) where applicable — you have certain rights in relation to your personal information. These may include the right to:

• Request access and obtain a copy of your info.
• Request rectification or erasure.
• Restrict the processing of your data.
• If applicable, receive your data in a portable format.
• Object to the processing of your data.
• Withdraw consent to processing at any time.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.

You can exercise most of these rights directly within the app (Profile → Privacy & Security), or by contacting us using the details in Section 16 below.

You can permanently delete your CricFlow account and associated personal data at any time, either directly within the Android app or by submitting a request via email. Full step-by-step instructions are available on our dedicated Account Deletion page.

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of the Grievance Officer / Data Protection contact for CricFlow are provided below. Any complaints or concerns regarding this Policy, content on the platform, or your personal data may be addressed to:

CricFlow is currently operated by an individual developer/sole proprietor. This section will be updated with registered company details if and when CricFlow is incorporated as a formal legal entity.

CricFlow is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children below this age. If you believe a child has provided us with personal information, please contact us using the details in Section 16 so we can take appropriate action, including deletion of that information.

If you have questions or comments about this Privacy Policy, your data, or wish to submit a support request via our contact form, you may reach us at cricflowapp1@gmail.com, or through the Contact page on our website.