🔒 Privacy Policy

1 Information We Collect

Account Information: When you register, we collect your name, email address, phone number (optional), and a hashed password.

Profile Data: Optionally, a profile photo, team affiliation, and cricket role (player, scorer, team owner, etc.).

Match & Scoring Data: Ball-by-ball deliveries entered by scorers, match results, player statistics, and scorecards you submit through the platform.

Billing Information: If you purchase a licence, we collect your billing name, address, and payment confirmation reference. We do not store full card numbers — payments are processed by our third-party payment partners.

Usage Data: IP address, browser type, device type, pages visited, time spent, and feature interactions — collected automatically for security and analytics.

Communications: Any messages you send us via email or support requests.

2 How We Use Your Information

• Provide, operate, and maintain the WicketNexus platform and all its features.
• Authenticate your identity and secure your account.
• Process licence purchases and send transaction receipts.
• Display your cricket statistics, scorecards, and profile publicly within your league.
• Send transactional emails (account confirmation, password reset, licence renewal reminders).
• Detect and prevent fraud, abuse, and security incidents.
• Analyse usage trends to improve the platform (aggregated, anonymised data).
• Comply with applicable laws and legal obligations.

We do not sell your personal data to any third party, ever.

3 Cookies & Tracking

We use a minimal set of cookies:

• Session cookie — keeps you logged in during your visit. Expires when you close your browser or after 30 days of inactivity.
• Theme preference — stores your dark/light theme choice in localStorage.
• CSRF token — a secure, per-session token to protect against cross-site request forgery.

We do not use advertising trackers, third-party analytics cookies, or persistent fingerprinting identifiers. If we integrate optional analytics in the future, we will update this policy and provide an opt-out.

4 Third-Party Services

Some features rely on third-party services that have their own privacy policies:

• Google OAuth / Firebase — if you choose to sign in with Google, Google's privacy policy applies to that authentication step. We only receive your name, email, and profile picture from Google.
• Payment Gateways (Razorpay / Cashfree / CCAvenue) — payment processing is handled entirely by the selected gateway. We receive a payment confirmation token only; your card data never touches our servers.
• Firebase Cloud Messaging — used for optional push notifications. You can revoke browser notification permission at any time.
• Hostinger Hosting — our infrastructure provider, subject to their data processing agreement.

5 Data Sharing & Disclosure

We do not share, rent, or sell your personal information to third parties except in these limited cases:

• Service providers — hosting and infrastructure partners who process data solely to provide services to us, under confidentiality obligations.
• Legal requirement — if required by law, court order, or governmental authority, we may disclose information as necessary.
• Business transfer — in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction, with prior notice to users.
• With your consent — in any other case, only with your explicit permission.

6 Data Retention

We retain your data for as long as your account is active. Specifically:

• Active account data is retained indefinitely to preserve match history and statistics.
• If you request account deletion, personal identifiers (name, email, phone) are removed within 30 days. Match and scoring data may be retained in anonymised form to preserve league records.
• Licence and billing records are retained for 7 years for tax and legal compliance.
• Access logs are purged after 90 days.

7 Security

We implement industry-standard safeguards to protect your data:

• All data transmission is encrypted over HTTPS/TLS.
• Passwords are stored using bcrypt hashing — we cannot read your password.
• CSRF tokens protect all state-changing form submissions.
• Role-based access control restricts access to admin and scoring functions.
• Rate limiting is applied to API endpoints to prevent brute-force attacks.

While we work hard to protect your information, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and enable secure sign-in options.

8 Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information via your account settings.
• Deletion — request deletion of your account and associated personal data.
• Data portability — request an export of your data in a structured format.
• Objection — object to certain processing activities, such as marketing communications.

To exercise any of these rights, email us at info@crickstack.com. We will respond within 30 days.

9 Children's Privacy

WicketNexus is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately and we will delete that information.

10 Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For significant changes, we will notify registered users via email. Continued use of the platform after any change constitutes acceptance of the updated policy.

11 Contact Us