DRAFT. This text has not been reviewed by a lawyer. Replace the [bracketed] items and have it reviewed before clubs sign up.

Privacy Policy

Last updated: [DATE]. Operated by [OPERATOR NAME / COMPANY], [COUNTRY] ("we", "us"). Contact: [CONTACT EMAIL].

What we collect

• Account details: name, username, email (when email is used), role, and a securely hashed password. If you turn on two-step login, we store the secret needed for it.
• Cricket data entered by clubs: teams, player names, squad numbers, roles, fixtures, ball-by-ball scores, venues, umpire and commentator names, logos and sponsor images.
• Technical data: your IP address and basic request logs (to run the service, limit abuse and find faults), and the name of the machine you sign in from.

The public website shows only what the organiser has set to public: scores, team and player names, results and logos. It does not show account details.

Why we use it

• To run the Service: sign you in, store and sync matches, show live scores.
• To keep it secure: sign-in limits, abuse prevention, backups.
• To contact you about your account or the Service.

We do not sell personal data and do not run advertising or third-party trackers on the public site.

Who sees it

• People in your organisation, according to their role. Data never crosses between separate organisations, except where a competition organiser has linked clubs in to read that competition.
• Anyone on the internet, for items set to public. Link-only items are visible to anyone with the link.
• Our hosting provider ([HOSTING PROVIDER]) stores the data on servers in [LOCATION]. [Add email, payment or backup-storage providers here once used.]

Children

Junior players may appear in a club's data. The club or organiser decides what is published and is responsible for any parent or guardian consent required. Organisers can hide any match or competition, or remove a player, at any time. Contact us to have a child's details removed.

How long we keep it

Account and cricket data are kept while the account is active. When you ask us to delete it, it is removed from live systems promptly and from encrypted backups within [30] days. Request logs are kept for [90] days.

Security

Connections use https. Passwords are hashed, sign-in attempts are rate-limited, two-step login is available, and backups are encrypted. No system is perfectly secure; we will tell affected users if a breach puts their data at risk.

Your rights

You can ask to see, correct, export or delete the personal data we hold about you, and to object to how it is used. Email [CONTACT EMAIL]. [Add the regulator or regional rights wording for your country, e.g. GDPR / local law.]

Changes

We will update this page when practice changes and note the date at the top.