Privacy Policy
How we collect, use, protect and share your personal data — aligned with India's Digital Personal Data Protection Act, 2023 (DPDP).
Last updated 13 June 2026 (draft) · Pre-launch template
Complete before publishing
A ready-to-adapt draft, not legal advice. Fill the bracketed placeholders — [Operator legal name], [contact email], [website URL], [Grievance Officer name], [support/grievance email] — and have it reviewed by an Indian data-protection lawyer before go-live.
The short version
- We collect very little: your phone number, a display name, your state, your Google account basics if you sign in with Google, and — only if you choose — your birth year and gender.
- Why: to create your account, keep it secure, run leaderboards and clans, send match reminders, prevent cheating, and show ads that keep the game free.
- No money game: a free, no-stake game of skill — no deposits, no cash prizes, so we don't collect financial/bank data.
- Your control: access, correct or delete your data, withdraw consent, and raise a grievance (§11, §15).
- 18+ only. We do not knowingly process data of anyone under 18.
1 · Who we are (the Data Fiduciary)
PlayYourCup (“we”, “us”, “our”) is a free, no-stake sports-prediction game operated by [Operator legal name], based in India, who acts as the Data Fiduciary for the personal data described here. Reach us at [contact email]. This policy governs the PlayYourCup website and PWA at [website URL] (the “Service”).
2 · Scope
This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and your rights as a Data Principal under the Digital Personal Data Protection Act, 2023 and its Rules. By creating an account you confirm you are 18 or older and consent to the processing described here.
3 · Information we collect
| Data | Source | Why we need it |
|---|---|---|
| Mobile phone number | You, at registration | One-time WhatsApp OTP, one-account-per-phone integrity, match notifications |
| Display name | You | Shown on leaderboards and in clans |
| State / region | You | State-wise leaderboards and rankings |
| Birth year & gender (optional) | You — may be skipped | Aggregate demographics + to corroborate 18+; never required to play |
| Google account basics | Google Sign-In (if chosen) | Email, name, Google ID to create a password-free login |
| Gameplay data | As you play | Predictions, points, streaks, clan membership, history |
| Device & technical data | Automatically | IP, device/browser, app version, advertising identifier |
What we do NOT collect
No bank, card or UPI details (no money is wagered; any future clan-fee payments are handled entirely by our payment processor). No government IDs, precise GPS, contacts, photos, or sensitive financial data.
4 · How we use your data
- Run your account — registration, secure login, one-account-per-person.
- Deliver the game — accept predictions, calculate points, power leaderboards.
- Communicate — match-lock reminders, results, service notices (opt out of non-essential).
- Keep it fair & safe — detect multi-accounting, fraud, OTP misuse.
- Show advertising — ads (Google AdSense/AdMob) that keep PlayYourCup free (§9).
- Improve & comply — privacy-respecting analytics; legal/tax obligations.
5 · Legal basis
Under the DPDP Act we rely on your consent, given freely and specifically at sign-up, and on certain legitimate uses permitted by the Act (security, legal compliance). You may withdraw consent at any time (§6).
6 · Consent & withdrawal
We ask for consent through a clear notice at registration. You can withdraw consent any time from in-app settings or by emailing [support/grievance email] — as easy as giving it. Withdrawing consent for essential processing may mean we can no longer provide the account.
7 · Who we share data with
We do not sell your data. We share the minimum necessary with processors who act only on our instructions: Google (Sign-In), the WhatsApp/OTP provider, Google AdSense/AdMob, Google Cloud (Mumbai, asia-south1), analytics/error monitoring, and a future payment processor (only if clan fees launch). We may disclose data where required by law.
8 · Where your data is stored
Account data is hosted in India (Google Cloud, Mumbai / asia-south1). Some processors may process limited technical data outside India, only as permitted by the DPDP Act and subject to appropriate safeguards.
9 · Cookies, advertising & tracking
We use essential cookies/local storage to keep you signed in. To keep the game free we show ads via Google AdSense/AdMob, which may use an advertising identifier and cookies. You can choose non-personalised ads where offered and reset your device advertising ID. Analytics and ads load only after you accept the consent banner.
10 · Retention
We keep personal data only while your account is active or as needed for the purposes above and legal obligations. On account deletion we delete or irreversibly anonymise your data within a reasonable period, except where law requires retention.
11 · Your rights as a Data Principal
- Access — a summary of the data we hold and how it's processed.
- Correction — fix inaccurate or incomplete data.
- Erasure — delete your data / account (subject to legal retention).
- Withdraw consent — at any time (§6).
- Grievance redressal — a readily available way to complain (§15).
- Nominate — nominate another individual to exercise your rights.
12 · Children
PlayYourCup is intended only for users aged 18+. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
13 · How we protect your data
- Encryption in transit (TLS) and at rest; phone numbers stored hashed.
- Rate-limiting and abuse detection on login/OTP.
- Least-privilege access, secrets in a managed vault, audit logging.
- Breach notification to the Data Protection Board and affected users as required.
14 · Changes to this policy
We may update this policy as the Service or law evolves; we'll post the new version with an updated date and give prominent in-app notice for material changes.
15 · Grievance redressal & contact
[Grievance Officer name] · PlayYourCup
Email: [support/grievance email]
We acknowledge complaints promptly and aim to resolve them within the period required under the DPDP Act.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
Disclaimer
This template is for drafting purposes and is not legal advice. Have it reviewed and finalised by a qualified Indian lawyer before publishing.