Privacy Policy

Last updated: July 26, 2026

1. Overview

Khelam ("Khelam", "we", "us", "our") operates khelam.space, a platform that helps players discover and book sports venues, record match scores, and run tournaments, and helps venue owners list and manage their facilities.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights available to you. It applies to all users of khelam.space and the Khelam app — players, venue owners, and visitors — regardless of where you access it from.

2. Information we collect

Information you give us directly

• Account information: name, email address, phone number, date of birth, gender, and city — collected during signup or profile editing.
• Authentication data: if you sign in with Google, we receive your name, email, and profile photo from Google as permitted by your Google account settings.
• Venue listing information: if you register a venue, we collect venue name, address, contact details, pricing, amenities, and photos.
• Match and tournament data: scores, team names, player rosters, ball-by-ball records, and results you enter while using the scoring features.
• Venue photographs: images uploaded by venue owners to illustrate their listings.
• Reviews: star ratings and written comments you submit about a venue after a completed booking.
• Open games: if you host or join an open game, the sport, location text, date, time and the fact that you have joined are recorded and shown to other users.
• Support communications: any information you provide when contacting us for help or reporting a bug.

Information collected automatically

• Basic usage data such as pages visited and features used, for the purpose of fixing bugs and improving the product.
• Device and browser type, for compatibility and security purposes.

We do not currently use third-party advertising trackers or sell browsing data to advertisers.

3. How we use your information

• To create and manage your account.
• To operate core features: venue discovery, slot booking records, live scoring, team management, and tournaments.
• To send essential account emails (sign-up confirmation, password reset, and a welcome email when you first join).
• To respond to support requests and bug reports.
• To maintain the security and integrity of the platform, including detecting fraud or abuse.

4. Information that is publicly visible

The following is public:

• Player profiles: your display name, city (if you provide one), aggregate statistics (matches, runs, wickets, win record), the names of teams you belong to, and your recent match results and scorecards.
• Venue listings: venue name, address, contact number, pricing, amenities, policies and photographs provided by the venue owner.
• Reviews: your star rating, written comment and display name, shown on the venue's public page.
• Tournament and match records: points tables, scorecards and results, including player names appearing in them.

The following is never made public: your email address, phone number, date of birth, gender, password, booking history, and payment or account details.

If you do not want a public profile, contact us at the address in Section 13 and we will remove your profile from public search and profile pages. Note that your name may still appear in scorecards of matches recorded by other users, in the same way a name appears in a paper scorebook.

5. When we share information

We do not sell your personal information. We share information only in these limited circumstances:

• With venue owners: if you book a slot, the venue you're booking with can see your name and contact details so they can confirm and manage your booking.
• With other players: your name, team affiliations, and match/tournament results may be visible to other users as part of the platform's core functionality (e.g. points tables, scorecards).
• Service providers: we use Supabase (database and authentication, hosted in the Mumbai, India region) and Brevo (transactional email delivery) to operate the platform. These providers process data only on our instructions and under their own data protection commitments.
• Legal requirements: if required to comply with a valid legal request, such as a court order or government request, under applicable Indian or U.S. law.

6. Data storage & security

Your data, including uploaded venue photographs, is stored on Supabase infrastructure in the Mumbai (ap-south-1) region. We use industry-standard measures including encrypted connections (HTTPS/TLS), database-level access policies (Row Level Security), and encrypted secrets storage for any sensitive credentials our systems use internally.

No method of electronic storage or transmission is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

7. Your rights — India (Digital Personal Data Protection Act, 2023)

If you are located in India, under the DPDP Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed.
• Request correction or updating of inaccurate or incomplete personal data.
• Request erasure of your personal data, where it is no longer necessary for the purpose it was collected.
• Withdraw consent at any time for processing that relies on consent (e.g. by deleting your account).
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Lodge a grievance with us, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact us using the details in Section 13.

8. Your rights — United States (CCPA/CPRA and similar state laws)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to:

• Know what categories of personal information we have collected about you and why.
• Request deletion of personal information we have collected from you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or "sharing" of personal information — Khelam does not sell or share personal information for cross-context behavioral advertising.
• Not be discriminated against for exercising any of these rights.

To submit a request, contact us using the details in Section 13. We will verify your identity before fulfilling requests where required by law.

9. Cookies & tracking

Khelam uses essential cookies and browser local storage only to keep you signed in and to remember your session activity for security purposes (such as automatically signing you out after a period of inactivity). We do not use third-party advertising or cross-site tracking cookies.

10. Children's privacy

Khelam is not directed at children under the age of 13 (or under 18 where required by local law for processing personal data without parental consent). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Data retention

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records for legal, accounting, or security purposes.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

13. Contact us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at:

Email: support@khelam.space