Privacy Policy — Krickit
Last updated: 19 October 2026
Krickit (“we”, “us”) runs the Krickit mobile app and the services at krickit.in. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. It is written to meet India’s Digital Personal Data Protection Act 2023 (DPDP) and Google Play’s User Data policy.
Data Fiduciary: Krickit
Contact and Grievance Officer: support@krickit.in
1. What we collect
1.1 What you give us
| Data | When | Why |
|---|---|---|
| Email address | Sign-up or Google sign-in | Identify your account, sign-in, account recovery |
| Name and profile photo from Google | Google sign-in | Set up your profile (you can change both) |
| Display name and username | Sign-up | Show you to other players |
| Password | Email sign-up | Sign-in (stored only as a secure hash) |
| Profile photo, bio, playing role | Optional | Show you to other players |
| Phone number | Optional | Account recovery, team contact |
| City | Optional | Suggest nearby grounds, matches and players |
| Photos and videos you upload | When you post, add a story or send media | Publish them where you choose |
| Messages you send | Chat | Deliver them to the people you message |
1.2 What you create by using Krickit
Match scorecards and ball-by-ball records, batting, bowling and fielding statistics, teams, clubs and grounds you belong to, tournaments you run or enter, auction registrations and bids, follows, likes, comments, reposts, tags, achievements, your coin balance and transaction history.
Match data is public by design. Scores, statistics and results can be seen by other users, because that is what the app is for. Do not put anything in a scorecard that you would not want seen.
1.3 Collected automatically
- Device model, operating system and app version
- IP address and approximate region
- Crash and error diagnostics
- A push-notification token (Firebase Cloud Messaging), so we can send the notifications you allow
- Your device’s advertising ID, unless you have reset or deleted it (see §8)
1.4 Permissions the app asks for
| Permission | Used for |
|---|---|
| Camera | Taking a photo or video to post, or a profile picture, when you choose to |
| Photos and videos | Picking media you choose to upload. We do not scan or upload your library |
| Approximate location | Asked once after you sign in, to fill in your town so we can suggest nearby players, teams, grounds and tournaments. The phone’s approximate (not precise) position is used only to look up the nearest town; we save the town to your profile, not the coordinates. You can refuse, and change your town any time in Edit Profile |
| Notifications | Match, message and activity alerts. You can turn them off at any time |
| Background upload | Finishing a large video upload if you leave the app |
Every permission is optional. Refusing one only turns off the feature that needs it.
1.5 What we do not collect
We do not collect precise GPS location, contacts, SMS, call logs, biometric data, government ID numbers or health data. We never see your Google password: Google only returns a signed token confirming who you are. We never see or store your card or UPI details, because payments are handled entirely by Google Play.
2. Why we use it, and our legal basis
Under DPDP we process personal data with your consent, given when you create an account and when you grant a permission, and for the legitimate uses the Act allows.
| Purpose | Basis |
|---|---|
| Create and run your account | Consent, and performing our Terms |
| Show your matches, teams and statistics | Consent |
| Deliver chat, notifications and account emails | Consent |
| Coin purchases and memberships | Performing our Terms |
| Verify rewarded-ad coins | Performing our Terms |
| Show advertising | Consent, which you can withdraw (see §8) |
| Prevent fraud, abuse and cheating | Legitimate use |
| Comply with the law | Legal obligation |
We do not sell your personal data, and we do not use it to train AI models.
3. Who can see what
- Your profile, match participation, statistics and public posts are visible to other Krickit users.
- Private account: turn it on in Settings → Privacy and only followers you approve see your posts and follower lists. Match records stay public.
- Blocking: someone you block cannot message you, follow you or see your posts.
- Messages are visible only to the people in the conversation.
4. Who we share it with
Service providers, only as far as needed to run Krickit:
- Google Cloud Platform (Mumbai, India): hosting, databases, file storage
- MongoDB Atlas: chat message storage
- Google Firebase Cloud Messaging: delivering push notifications
- Google Play Billing: purchases (Google receives the payment details, we do not)
- Google AdMob: advertising and rewarded-ad verification (see §8)
- Google Sign-In: authentication
- Our email provider: sending account emails from support@krickit.in
Legal: where valid legal process requires it, or to protect the safety and rights of our users. We will tell you unless the law forbids it.
Business transfer: if Krickit is acquired, your data may pass to the new owner, and this policy keeps applying until you are told otherwise.
5. Krickit Assistant (ChatGPT and Claude)
You can connect Krickit to an AI assistant such as ChatGPT or Claude, then ask it about your cricket.
- You choose to connect it. Nothing is shared until you add the connector and sign in on our page with your Google account.
- It can only read. The assistant sees the same data you can see in the app. It cannot post, message anyone, change a match or see a private account you do not follow.
- Your questions go to that assistant’s provider (OpenAI or Anthropic), and their privacy policy applies to what you type there.
- You can disconnect it at any time from the assistant’s connector settings. We keep a record of the assistant’s requests to prevent abuse.
6. Where your data is stored
Primary storage is Google Cloud asia-south1 (Mumbai), India. Chat data is stored with MongoDB Atlas, which may process it outside India. Advertising, notifications and sign-in use Google’s global infrastructure. We transfer data outside India only to countries the Government of India has not restricted under DPDP section 16, and under contractual safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account is active |
| Match and statistics data | Kept after you delete your account. Your name stays on the scorecards of matches you played, because a match is a shared record and removing one player would break it for everyone else in it. It is no longer linked to an account anyone can sign in to |
| Posts, stories, comments, reactions | Deleted with your account |
| Chat messages | While your account is active; deleted with it |
| Uploaded media | Deleted within 30 days of account deletion |
| Coin and purchase records | 8 years (Indian tax and accounting law) |
| Backups | Up to 35 days after deletion |
8. Advertising and rewarded ads
Krickit shows ads through Google AdMob, which may use your advertising ID to show more relevant ads. You can reset or delete that ID, or turn off personalised ads, in your phone’s Settings → Privacy → Ads. AdMob’s policy: https://policies.google.com/technologies/ads
When you choose to watch a rewarded ad for coins or XP, we pass your Krickit account ID to Google so the reward can be verified and credited to you.
We deliberately show no ads during live scoring or auction bidding. An ad-free membership removes the ads we place in the app.
9. Emails
We send account emails from support@krickit.in: welcome, password reset, security codes and account-deletion confirmation. We do not send marketing email unless you ask for it.
10. Your rights
Under DPDP 2023 you can:
- Access a summary of your data and how we process it
- Correct inaccurate or incomplete data (most of it in the app, in Settings)
- Erase your data: Settings → Account → Delete account, or email us
- Nominate someone to exercise your rights if you die or cannot act
- Withdraw consent at any time, and we stop that processing
- Complain to us, and then to the Data Protection Board of India
Email support@krickit.in from the address on your account. We reply within 30 days.
Deleting your account removes your account and profile (photo, bio, contact and sign-in details), your posts, stories, comments, tags, reactions and chats. Your name stays on the scorecards of matches you played, as described in §7.
11. Children
Krickit is not meant for children under 18, and we do not knowingly collect their data without consent. Under DPDP, processing a child’s data needs verifiable parental consent, and behavioural advertising to children is not allowed.
Plenty of cricketers are under 18. If a parent or guardian wants a child to use Krickit, that adult must create and manage the account and is responsible for it. If we learn we hold a child’s data without proper consent, we delete it promptly. Email us to report such an account.
12. Security
Data is encrypted in transit (TLS 1.2 or later) and at rest. Passwords are stored as bcrypt hashes and can never be read back. Our databases are not reachable from the public internet, credentials are kept in Google Secret Manager, and administrative access needs an authenticated tunnel.
No system is perfectly secure. If a breach is likely to affect you, we will tell you and the Data Protection Board, as DPDP requires.
13. The website
krickit.in is a static website. It does not use advertising or tracking cookies. Fonts are loaded from Google Fonts, which receives your IP address to serve them.
14. Changes to this policy
We post changes here. If a change is significant, we tell you in the app before it takes effect. The “Last updated” date always shows the current version.
15. Contact
support@krickit.in for privacy questions, rights requests and complaints. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.