Privacy Policy
Summary
SquadSphere is a sports app for creating teams, scoring matches ball by ball, settling match fees, and live streaming a match to YouTube. We collect only what those features need. We do not sell personal information, we do not use it for advertising, and we do not use Google user data to train AI or machine learning models.
Information We Collect
- Account: name, email address, and optionally mobile number, city, and preferred sport. Passwords are stored only as one-way hashes. Email addresses are verified with a one-time code.
- Sport: teams, squads, players, matches, ball-by-ball scorecards, results, and the career statistics derived from them.
- Match fees: the amount a captain records for their own side, who is paying, and who has paid. SquadSphere does not process payments and never handles card, bank, or UPI details.
- Streaming: connected channel identity, broadcast and stream identifiers, privacy setting, status, and watch link.
- Device: a push subscription identifier if you allow notifications.
- Uploads: images uploaded by authorised users, such as store logos and covers.
How We Use Information
- To create your account, verify your email, and keep your session secure.
- To run teams, squads, matches, live scoring, and career statistics.
- To let a captain record and track match fees for their own side.
- To create and manage the YouTube live broadcast you ask us to start.
- To send match and fee notifications you opted in to, and to keep the service reliable and secure.
We do not use your information for advertising, profiling, credit decisions, or to train AI or machine learning models.
Google User Data: What We Access
SquadSphere accesses Google user data in two places, both optional and both started by you.
1. Google Sign-In. If you sign in with Google we receive your name, email address, whether that email is verified, and your Google account identifier. We never receive your Google password.
2. YouTube Live Streaming. If you connect a YouTube channel we request a single scope, https://www.googleapis.com/auth/youtube.force-ssl. With it we read the identity of the channel you connected (channel ID and title, via channels.list with mine=true) and we create and manage only the live broadcasts you start in SquadSphere, using liveBroadcasts.insert, liveStreams.insert, liveBroadcasts.bind, liveBroadcasts.transition, and the corresponding list operations.
This is the narrowest scope that permits live broadcast management. Read-only and upload-only YouTube scopes cannot create a broadcast, bind an ingestion stream, or transition a broadcast to live, which are exactly the operations this feature performs.
We do not read your videos, playlists, comments, subscriptions, or analytics, and we never act on your channel outside a stream you started in the app.
Google User Data: How We Use It
Google Sign-In data is used only to create and authenticate your account and to show your name to your own teammates. YouTube data is used only to deliver the streaming feature you requested: confirming which channel will host the stream, creating the broadcast and its RTMP ingestion stream, binding them, taking the broadcast live once your device sends video, and ending it when you stop or the match completes. The broadcast and stream identifiers and the watch link are stored against that match so viewers can watch and you can resume the same broadcast after a dropped connection.
Google user data is never used for advertising, marketing, resale, credit decisions, or to develop, improve, or train any AI or machine learning model.
Google User Data: How We Share It
We do not sell Google user data and we do not transfer it to advertisers, data brokers, or any third party for their own purposes. It is transferred only to infrastructure providers processing it on our instructions: Amazon Web Services (hosting, encrypted storage, secret management), MongoDB (database), and Google / YouTube (the APIs that run your broadcast).
OneSignal (push delivery) and our email provider receive SquadSphere data but no Google user data: OneSignal receives only a device subscription identifier and the notification text.
Inside the app, other people see only your display name and your participation in shared teams and matches. Your email address and mobile number are never shown to other players. Match fees are visible only to the captain of that side, or to the match creator when that side has no captain.
We may disclose information where required by law or to protect the safety and integrity of the service.
Google User Data: How We Protect It
- All traffic is encrypted in transit with HTTPS/TLS.
- Your YouTube refresh token is encrypted at rest with AES-256-GCM, with the key held in AWS Secrets Manager separately from the database.
- That token is never sent to the app, the admin portal, or any browser, and is never written to logs.
- Passwords are stored only as bcrypt hashes and are never recoverable.
- Sessions use short-lived signed tokens. Administrators are held in a separate store with separate credentials and shorter sessions.
- Requests are rate limited against brute force, and every response is filtered so private records cannot leak between accounts.
- Production access is limited to the personnel who need it.
Google User Data: Retention and Deletion
Your YouTube connection is kept only while your channel is connected. It is deleted immediately and in full when you disconnect the channel, delete your SquadSphere account, or revoke access from your Google account. Google Sign-In details are kept only while your account exists. You can revoke SquadSphere's access at any time at myaccount.google.com/permissions.
Limited Use Commitment
SquadSphere's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve, or train generalised AI or machine learning models, and is not transferred to any third-party service that would use it for that purpose.
YouTube API Services
The streaming feature uses YouTube API Services. By using it you also agree to the YouTube Terms of Service, and your use of Google's services is governed by the Google Privacy Policy.
Device Permissions
SquadSphere asks for the camera and microphone only when you start a live stream, because that video and audio is what is broadcast. The stream goes directly from your device to YouTube's ingestion servers; SquadSphere does not record, copy, or store it. Notification permission is optional. Storage access is used only for images you choose to upload. SquadSphere does not request access to your contacts or your location.
Deleting Your Account
You can delete your account at any time from Profile → Account → Delete account in the app, or by emailing support.squadsphere@gmail.com from your registered address. Deletion is permanent, immediate, and not reversible.
Deleted straight away: your profile (name, email, mobile, city, password hash), your YouTube connection and its encrypted refresh token, your career statistics, your notifications, your push subscription, and any team where you were the only member.
Kept, with you removed from it: teams other players still belong to, and matches other people played in, are kept for those people. Your account is unlinked and your name is replaced with "Removed player". Your email address and mobile number are erased from those records. The ball-by-ball scorecard remains, because it is the other players' record of their own match.
We may retain minimal records where the law requires it.
Your Rights Under India's DPDP Act
SquadSphere is the Data Fiduciary for the personal data described here, and you are the Data Principal. Under the Digital Personal Data Protection Act, 2023 you may:
- Access a summary of the personal data we hold about you, what we do with it, and the identities of anyone we have shared it with.
- Correct, complete or update anything inaccurate. Your name, city and mobile number are editable in the app; write to us for anything else.
- Erase your personal data. Deleting your account from Profile does this immediately, and we also erase data ourselves once the purpose it was collected for is served, unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. Disconnecting your YouTube channel or turning notifications off withdraws consent for those, and deleting your account withdraws it for everything. Withdrawing does not undo processing that already, lawfully, happened.
- Nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Tell us who, in writing, and we will record it against your account.
- Complain. Raise a grievance with us first, using the contact below. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
We answer a rights request within 30 days. We may ask you to verify your identity first, so that nobody else can obtain or erase your data.
Consent, and What We Rely On
We process your personal data on the basis of the consent you give when you create an account and when you turn a feature on, and for the limited legitimate uses the DPDP Act allows, such as acting on data you voluntarily give us for a purpose you asked for. We ask for consent separately for the things that are optional: connecting a YouTube channel, receiving notifications, and using the camera and microphone to stream.
If There Is a Data Breach
If personal data we hold is exposed, lost or accessed without authorisation, we will notify the Data Protection Board of India and every affected person, in the manner and within the time the law requires. We will tell you what happened, what data was involved and what you can do about it.
Where Your Data Is Held
Your data is stored on servers in India, operated by Amazon Web Services and MongoDB. YouTube processes a broadcast you start on your own channel, which may involve Google's servers outside India. We do not transfer personal data to any country that the Government of India has restricted for this purpose.
How Long We Keep It
We keep your account data while your account exists. We erase personal data once the purpose it was collected for is served or you withdraw consent, whichever is earlier, unless a law requires us to keep it longer. A one-time signup code expires within minutes. Match records other players took part in are kept for those players, with your account unlinked and your name replaced, as described above.
Your Choices
Update your details in the app, choose whether to use Google sign-in, connect or disconnect a YouTube channel at any time, revoke Google access at myaccount.google.com/permissions, turn notifications off in device settings, delete your account from the Profile screen, or contact support to request a copy of your data.
Children
Under India's Digital Personal Data Protection Act, 2023, a child is anyone under the age of 18. SquadSphere accounts are therefore for people aged 18 and over, and you confirm your age when you create one. We do not knowingly create an account for anyone under 18, and we do not use any child's data for behavioural monitoring, profiling or targeted advertising.
A team organiser may add an under-18 player to a squad so the player appears on a scorecard. In that case we hold only the player's name and their match statistics, they hold no account and cannot sign in, and the adult who added them is responsible for having their parent's or guardian's permission to do so.
If you believe someone under 18 holds an account, or that a child's details are on SquadSphere without a guardian's permission, write to support.squadsphere@gmail.com and we will remove them.
Changes to This Policy
If we change how we handle your information we will update this page and the date at the top. A material change to how Google user data is used will appear here before that change takes effect.
Contact and Grievances
For any privacy question, or to exercise a right described above, contact the person who answers questions about our processing of personal data:
Grievance Officer, SquadSphere
support.squadsphere@gmail.com
We acknowledge a grievance promptly and answer within 30 days. If our answer does not satisfy you, you may complain to the Data Protection Board of India.