SquadSphere Privacy Policy

Summary

SquadSphere is a sports app for creating teams, scoring matches ball by ball, settling match fees, and live streaming a match to YouTube. We collect only what those features need. We do not sell personal information, we do not use it for advertising, and we do not use Google user data to train AI or machine learning models.

Information we collect

Account information. Your name, email address, and optionally your mobile number, city, and preferred sport. If you sign up with a password we store a one-way hash of it, never the password itself. Email addresses are verified with a one-time code.

Sport information. Teams you own or belong to, squads, players you add, matches you create or play in, ball-by-ball scorecards, results, and career statistics derived from those matches.

Match fees. If a captain records a match fee, we store the amount for that side, which players are paying, and who has been marked as paid. SquadSphere does not process payments and never handles card, bank, or UPI details.

Streaming information. If you stream a match, we store the connected channel identity, broadcast and stream identifiers, privacy setting, status, and the resulting watch link.

Device and notification data. A push subscription identifier if you allow notifications, and the notifications we have sent you.

Uploaded media. Images uploaded by authorised users, such as store logos and cover images.

How we use information

Create your account, verify your email, and keep your session secure

Run teams, squads, matches, live scoring, and career statistics

Let a captain record and track match fees for their own side

Create and manage the YouTube live broadcast you ask us to start

Send match and fee notifications you have opted in to

Keep the service reliable and secure, and respond to support requests

We do not use your information for advertising, profiling, credit or lending decisions, or to train artificial intelligence or machine learning models.

Google user data: what we access

SquadSphere accesses Google user data in two places, both optional and both started by you.

1. Google Sign-In. If you choose to sign in with Google, we receive your name, email address, whether that email is verified, and your Google account identifier. We do not receive your Google password.

2. YouTube Live Streaming. If you choose to connect a YouTube channel, we request a single scope, https://www.googleapis.com/auth/youtube.force-ssl. Using it we read the identity of the channel you connected (its channel ID and title, through channels.list with mine=true) and we create and manage only the live broadcasts you start in SquadSphere, using liveBroadcasts.insert, liveStreams.insert, liveBroadcasts.bind, liveBroadcasts.transition, and the corresponding list operations.

This scope is the narrowest one that permits live broadcast management. Read-only and upload-only YouTube scopes cannot create a broadcast, bind an ingestion stream, or transition a broadcast to live, which are the exact operations the streaming feature performs.

We do not read your videos, playlists, comments, subscriptions, analytics, or any part of your channel unrelated to a match you are streaming, and we never take any action on your channel that you have not started in the app.

Google user data: how we use it

Google Sign-In data is used only to create and authenticate your SquadSphere account and to show your name to your own teammates.

YouTube data is used only to deliver the live streaming feature you requested: to confirm which channel will host the stream, to create the broadcast and its RTMP ingestion stream, to bind them together, to take the broadcast live once your device starts sending video, and to end it when you stop streaming or the match is completed. We store the broadcast and stream identifiers and the resulting watch link against that match so viewers can watch it and so you can resume the same broadcast after a dropped connection.

Google user data is never used for advertising, marketing, resale, credit decisions, or to develop, improve, or train any artificial intelligence or machine learning model.

Google user data: how we share it

We do not sell Google user data, and we do not transfer it to advertisers, data brokers, or any third party for their own purposes.

Google user data is transferred only to infrastructure providers that process it on our instructions so the app can function:

Amazon Web Services — application hosting, encrypted media storage, and secret management, in India

MongoDB — the database that stores your account and match records

Google / YouTube — the APIs that create and run your live broadcast

Two further providers process SquadSphere data but receive no Google user data: OneSignal, which delivers push notifications and receives only a device subscription identifier and the notification text, and our email provider, which delivers one-time verification codes.

Inside the app, other people see only what team coordination requires: your display name and your participation in shared teams and matches. Your email address and mobile number are never shown to other players. A match fee and its payment status are visible only to the captain of that side, or to the match creator when that side has no captain.

We may disclose information if required by law, or to protect the rights, safety, and integrity of SquadSphere and its users.

Google user data: how we protect it

All traffic between the app and our servers is encrypted in transit using HTTPS/TLS

Your YouTube refresh token is encrypted at rest with AES-256-GCM. The encryption key is held in AWS Secrets Manager, separately from the database

The refresh token is never sent to the mobile app, the admin portal, or any browser, and is never written to logs

Passwords are stored only as bcrypt hashes and are never recoverable

Sessions use short-lived signed tokens. Administrator accounts are held in a separate store with separate credentials and shorter sessions

Requests are rate limited to resist brute force and abuse, and every response is filtered so private records cannot leak between accounts

Access to production systems is limited to the personnel who need it to operate the service

No online service can promise perfect security, but we review these controls as the product changes.

Google user data: retention and deletion

Your YouTube connection is kept only while your channel is connected. It is deleted immediately, in full, when you disconnect the channel in the app, when you delete your SquadSphere account, or when you revoke SquadSphere's access from your Google account. Google Sign-In details are kept only while your account exists.

You can revoke SquadSphere's access at any time at myaccount.google.com/permissions, independently of your SquadSphere account.

We keep other account and match data while your account exists, because a match belongs to everyone who played in it. See Deleting your account below for exactly what is removed and what remains.

Limited Use commitment

SquadSphere's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve, or train generalised artificial intelligence or machine learning models, and is not transferred to any third-party service that would use it for that purpose.

YouTube API Services

The streaming feature uses YouTube API Services. By using it you also agree to the YouTube Terms of Service at https://www.youtube.com/t/terms, and your use of Google's services is governed by the Google Privacy Policy at https://policies.google.com/privacy.

Device permissions

SquadSphere asks for the camera and microphone only when you start a live stream, because that video and audio is what is broadcast. The stream is sent directly from your device to YouTube's ingestion servers. SquadSphere does not record, copy, or store your video or audio.

Notification permission is optional and used only to deliver match and fee alerts. Storage access is used only for images you choose to upload. SquadSphere does not request access to your contacts or your location.

Deleting your account

You can delete your account at any time from Profile → Account → Delete account in the app, or by emailing support.squadsphere@gmail.com from your registered address. Deletion is permanent and takes effect immediately. It is not reversible.

Deleted straight away:

Your profile: name, email, mobile number, city, and password hash

Your YouTube connection and its encrypted refresh token

Your career statistics and your notifications

Your push notification subscription

Any team where you were the only member

Kept, with you removed from it:

Teams that other players still belong to, and matches other people played in, are kept for those people. Your account is unlinked from them and your name is replaced with “Removed player”. Your email address and mobile number are erased from those records. The ball-by-ball scorecard remains, because it is the other players' record of their own match.

We may retain minimal records where the law requires it, for example to resolve a dispute or meet an audit obligation.

Your rights under India’s DPDP Act

SquadSphere is the Data Fiduciary for the personal data described here, and you are the Data Principal. Under the Digital Personal Data Protection Act, 2023 you may:

Access a summary of the personal data we hold about you, what we do with it, and who we have shared it with

Correct, complete or update anything inaccurate — name, city and mobile number are editable in the app

Erase your personal data, immediately, by deleting your account from Profile

Withdraw consent as easily as you gave it — disconnect YouTube, turn notifications off, or delete the account

Nominate someone to exercise these rights for you if you die or become unable to exercise them yourself

Complain to us, and then to the Data Protection Board of India if our answer does not satisfy you

We answer a rights request within 30 days. We may ask you to verify your identity first, so that nobody else can obtain or erase your data.

Consent, and what we rely on

We process your personal data on the basis of the consent you give when you create an account and when you turn a feature on, and for the limited legitimate uses the DPDP Act allows. We ask separately for the things that are optional: connecting a YouTube channel, receiving notifications, and using the camera and microphone to stream.

If there is a data breach

If personal data we hold is exposed, lost or accessed without authorisation, we will notify the Data Protection Board of India and every affected person, in the manner and within the time the law requires. We will tell you what happened, what data was involved and what you can do about it.

Where your data is held

Your data is stored on servers in India, operated by Amazon Web Services and MongoDB. YouTube processes a broadcast you start on your own channel, which may involve Google’s servers outside India. We do not transfer personal data to any country the Government of India has restricted for this purpose.

How long we keep it

We keep your account data while your account exists. We erase personal data once the purpose it was collected for is served or you withdraw consent, whichever is earlier, unless a law requires us to keep it longer. A one-time signup code expires within minutes. Match records other players took part in are kept for those players, with your account unlinked and your name replaced.

Your choices

View and update your name, city, and mobile number in the app at any time

Choose whether to sign in with Google or with an email and password

Choose whether to connect a YouTube channel at all, and disconnect it whenever you want

Revoke SquadSphere's Google access at myaccount.google.com/permissions

Turn notifications off in your device settings

Delete your account permanently from the Profile screen

Request a copy of your data, or ask us to correct it, by emailing support

Children

Under India’s Digital Personal Data Protection Act, 2023, a child is anyone under the age of 18. SquadSphere accounts are therefore for people aged 18 and over, and you confirm your age when you create one. We do not knowingly create an account for anyone under 18, and we do not use any child’s data for behavioural monitoring, profiling or targeted advertising.

A team organiser may add an under-18 player to a squad so the player appears on a scorecard. In that case we hold only the player’s name and their match statistics, they hold no account and cannot sign in, and the adult who added them is responsible for having their parent’s or guardian’s permission to do so.

If you believe someone under 18 holds an account, or that a child’s details are on SquadSphere without a guardian’s permission, write to support.squadsphere@gmail.com and we will remove them.

Changes to this policy

If we change how we handle your information we will update this page and the date at the top. Material changes to how Google user data is used will be reflected here before the change takes effect.

Contact and grievances

For any privacy question, or to exercise a right described above, contact the person who answers questions about our processing of personal data:

Grievance Officer, SquadSphere
support.squadsphere@gmail.com

We acknowledge a grievance promptly and answer within 30 days. If our answer does not satisfy you, you may complain to the Data Protection Board of India.