Legal
Privacy Policy
Playtomic Sportsaathi Private Limited · operating as Sportsaathi
- Effective
- Version
- 2.3
- Last reviewed
Our commitment to you
We prioritise your privacy and collect only the minimum data required to operate the Platform effectively. You remain in control of your data and can modify or delete your information at any time. We do not use your data for advertising. We do not sell your data — including location data — to third parties for any commercial purpose.
This Privacy Policy ("Policy") is issued by Playtomic Sportsaathi Private Limited, a company incorporated under the Companies Act, 2013, with its registered office at 25/68, Street No. 15, Vishwas Nagar, Shahdara, Delhi – 110032, Corporate Identification Number U93110DL2025PTC448183 (hereinafter referred to as "Sportsaathi", "Company", "we", "our", or "us").
This Policy governs the collection, use, processing, storage, disclosure, and protection of Personal Data provided by or collected from any individual ("User", "you", or "your") who accesses or uses our mobile application, website located at https://sportsaathi.com, and any related digital services, features, or products offered by Sportsaathi (collectively, the "Platform").
Preamble
This Policy has been drafted in compliance with the following applicable laws and regulations:
- The Digital Personal Data Protection Act, 2023 (“DPDPA”) and rules thereunder;
- The Information Technology Act, 2000 (“IT Act”);
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
- Any other applicable regulations, guidelines, or orders issued by competent authorities from time to time.
By accessing, registering on, or using the Platform in any manner, you acknowledge that you have read, understood, and expressly agree to be bound by this Policy and our Terms of Use. If you do not agree to any part of this Policy, you must immediately discontinue use of the Platform.
Important Notice on the Nature of Our Platform: Sportsaathi does not sell digital goods, subscriptions, or in-app features. All payments, if any, relate exclusively to participation in real-world sports activities facilitated through the Platform, such as match or tournament participation fees. Sportsaathi does not sell, rent, monetise, or otherwise transfer Personal Data — including location data — to third parties for advertising or independent commercial purposes.
1. Definitions
For the purposes of this Policy, the following terms shall have the meanings assigned to them below:
- Personal Data
- Any data about an individual who is identifiable by or in relation to such data, as defined under the DPDPA, including name, contact details, digital identifiers, behavioural data, and any information that can directly or indirectly identify a natural person.
- Sensitive Personal Data or Information (SPDI)
- Passwords, financial information (bank account, credit/debit card details), health or biometric data, and any other category designated as sensitive under the SPDI Rules.
- Data Principal
- The individual to whom Personal Data relates — i.e., the User.
- Data Fiduciary
- Sportsaathi, being the entity that determines the purpose and means of processing Personal Data.
- Data Protection Officer (DPO)
- A designated individual responsible for overseeing data protection strategy and compliance. Where Sportsaathi is classified as a Significant Data Fiduciary under the DPDPA, a formally designated DPO will be appointed in addition to the Grievance Officer. The Grievance Officer and DPO are distinct roles with distinct functions.
- Processing
- Any operation performed on Personal Data, whether automated or manual, including collection, recording, organisation, storage, adaptation, retrieval, use, sharing, disclosure, or deletion.
- Consent
- A free, specific, informed, unconditional, and unambiguous indication of the Data Principal's agreement to the processing of their Personal Data, given through a clear affirmative act.
- Platform
- The Sportsaathi mobile application, the website at https://sportsaathi.com, and all related digital services, collectively.
- Services
- The features and functionalities offered on the Platform, including but not limited to match scoring, performance tracking, leaderboards, rankings, tournament management, community features, and processing of match or tournament participation fees for real-world sports activities facilitated through the Platform.
- Third-Party Service Provider
- Any external entity engaged by Sportsaathi to provide specific services integral to the Platform's operation, such as cloud hosting, payment processing, or analytics.
- Data Protection Board
- The Data Protection Board of India established under the DPDPA.
2. Information we collect
We collect only such Personal Data as is necessary for the specific, lawful purposes described in this Policy. We do not collect Personal Data beyond what is required for the delivery of our Services. Users may choose not to provide certain optional Personal Data; however, some features of the Platform may not function as intended in such cases.
2.1 Account and identity information
We collect the following information directly from you when you create and use an account:
- Mobile phone number — used for OTP-based authentication via MSG91;
- Name, email address (optional), age, gender, city, and state — collected during profile setup;
- Profile photograph (optional).
Note on Profile Photographs: Profile photos may contain facial images. These are collected solely for identification and display purposes on the Platform. Sportsaathi does not perform facial recognition, biometric analysis, or any form of automated identification using profile photographs. Photos are stored on secure servers and are not shared with any third parties for commercial purposes.
2.2 Gameplay and performance data
As a core function of the Platform, we collect the following data entered by Users or generated through Platform activity:
- Match scores and statistics (entered by Users or match officials);
- Player performance metrics;
- Tournament participation records;
- Team details and affiliation;
- Rankings and leaderboard positions;
- Match history and win/loss records.
This data constitutes the foundation of Sportsaathi's recognition and ranking system. It may be publicly visible to other Users on the Platform. Please refer to Section 4.2 and Section 5.2 for details on what is publicly displayed.
2.3 Location data
- Type
- City-level or precise location (only where required)
- Purpose
- To validate participation in real-world matches and maintain the integrity of rankings and leaderboards
- Collection
- Only during active use of match-related features
- Background tracking
- Not performed
- User control
- Users may choose to deny precise location access. Certain validation-dependent features may not function in such cases.
Sportsaathi does not sell, share, or disclose location data to any third party for commercial, advertising, or marketing purposes.
2.4 Transaction and payment data
Match and tournament entry fees are handled peer-to-peer: a team captain uploads proof of a direct bank/UPI transfer made to the organiser, and the organiser reviews and approves or rejects that proof within the app. No card, banking, or payment-instrument data is collected or transmitted by Sportsaathi in this flow.
In connection with that flow we hold the payment-proof screenshot you upload, the approval status recorded by the organiser, and the match or tournament to which it relates. Retention of payment-proof screenshots is set out in Section 6.
2.5 Device and technical data
- IP address — read from incoming request headers for two purposes: an anti-fraud check comparing your IP's approximate city against a match's declared city, and rate-limiting to prevent abusive request volume. Your IP address is not written to a persistent log or database table.
- App version, device platform, and crash/error diagnostics — collected only through Sentry, our error-monitoring service, and only when an error or crash occurs.
2.6 User-generated content
- Match data and scores entered by Users;
- Team names and team creation details;
- Community posts, comments, or messages (if applicable).
2.7 Data collected via third-party integration
We use the following third-party service providers, each for a specific, limited purpose:
- MSG91: Delivers the OTP SMS to your phone number.
- Sentry: Receives crash reports, error details, and limited technical context (app version, platform, a scrubbed snapshot of the request that triggered the error) only when an error occurs. Sensitive fields (passwords, tokens, OTPs, phone numbers, emails) are stripped before sending, and session-replay content is masked.
- Neon: Hosts our PostgreSQL database. All application data is stored on Neon's infrastructure on our behalf and under our instructions.
- Railway: Hosts our back-end application server.
- Cloudinary: Stores and serves uploaded images — profile photos, payment-proof screenshots, tournament organiser identity-verification documents, and team/venue logos.
- Vercel: Hosts the sportsaathi.com website.
- Resend: Delivers the email generated when you join the waitlist on the website.
2.8 The sportsaathi.com website and the waitlist
The Sportsaathi app has not been released yet. Until it is, sportsaathi.com is an information page with a waitlist form, and it collects far less than the app described above. To be specific about what happens when you use the website:
- If you join the waitlist, we collect the email address you type in, the date and time you submitted it, and which button on the page you used. Nothing else is requested.
- Your IP address and browser user agent are read from the request to prevent automated and abusive submissions. They are held in memory only, for the duration of the anti-abuse check, and are not written to a log, a database, or the notification we receive.
- The website sets no cookies. It stores a single preference on your own device, in your browser's local storage, recording your answer to the cookie notice so we do not ask again. It is never transmitted to us, and you can change or withdraw it at any time from the footer.
- No analytics, advertising, or tracking scripts run on the website.
Your waitlist email address is used only to tell you when access opens and to send occasional, material updates about the product. You can ask to be removed at any time by replying to any email we send, or by writing to the address in Section 17. See Section 6 for how long it is kept.
3. Legal basis for processing
Under the DPDPA 2023 and applicable Indian law, every instance of Personal Data processing must be grounded on a lawful basis. Sportsaathi processes Personal Data under the following legal bases, which are the recognised bases under the DPDPA 2023:
- Consent (Section 6, DPDPA 2023): Where the User has given free, specific, informed, unconditional, and unambiguous consent. This is the primary basis for processing account data, location data, and non-essential communications. Consent is obtained through a clear, affirmative action (e.g., ticking a consent box) at the time of registration or at the point the feature requiring consent is first accessed.
- Performance of Contract: Processing necessary to fulfil the Services the User has requested, including match scoring, leaderboard generation, tournament participation, and processing of participation fees.
- Legal Obligation: Processing required to comply with applicable law, regulatory directives, court orders, or government authority requests.
- Certain Uses Without Consent (Section 7, DPDPA 2023): Processing that is necessary for compliance with law or a court order, prevention or detection of unlawful activity, or for other purposes specified under Section 7 of the DPDPA and applicable rules, where Sportsaathi does not rely on consent as the processing basis. This applies to, for example, fraud prevention, platform security, and internal service improvement activities where processing is necessary and proportionate to a legitimate statutory purpose recognised under the DPDPA.
Where processing is based on consent, the User has the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. See Section 9 for details on exercising your rights.
4. How we use your information
We use the Personal Data we collect strictly for the following specified purposes. We do not use your data for any purpose not listed herein without obtaining prior consent.
4.1 Account management and authentication
- Creating, verifying, and maintaining your account;
- Authenticating your identity through OTP-based login;
- Enabling account recovery and access management.
4.2 Delivery of core services
- Enabling match scoring, statistics recording, and result tracking;
- Generating player rankings and leaderboard standings;
- Facilitating tournament registration and management;
- Supporting team creation and player interaction.
Leaderboards and rankings are generated through algorithmic processing of User-provided gameplay data and do not constitute automated decision-making producing legal or similarly significant effects on the User.
4.3 Payments and transactions
- Processing match or tournament participation fees for real-world sports activities facilitated through the Platform;
- Generating transaction records and receipts;
- Handling refunds or disputes where applicable, in accordance with our Terms of Use and Refund and Cancellation Policy.
4.4 Platform integrity and safety
- Detecting, investigating, and preventing fraudulent activity, cheating, or misuse of the Platform;
- Enforcing our Terms of Use and Community Guidelines;
- Ensuring the accuracy and fairness of rankings and leaderboards.
4.5 Communications and notifications
- Sending transactional notifications (e.g., match results, payment confirmations, account alerts);
- Sending promotional communications, offers, and updates — only with your explicit opt-in consent;
- Responding to User queries, complaints, and support requests.
4.6 Analytics and platform improvement
- Analysing aggregated and pseudonymised usage patterns to improve features and user experience;
- Measuring the performance and effectiveness of Platform features;
- Conducting internal product research limited to aggregated and pseudonymised data.
4.7 Legal and regulatory compliance
- Complying with applicable laws, court orders, government directives, and regulatory requirements;
- Maintaining records as required by applicable statute;
- Cooperating with law enforcement agencies when legally required to do so.
6. Data retention
We retain Personal Data only for as long as necessary to fulfil the specific purposes for which it was collected, or as required by applicable law. The following retention schedule applies:
| Data category | Retention period | Basis for retention |
|---|---|---|
| Identifying account data (name, email, profile photograph, age, gender, city, state) | Deleted immediately on account-deletion request | Right to erasure |
| Mobile number and login access | Retained up to 90 days after deletion request in a restricted, inactive state, solely so you can restore your account if you log in again within that window; permanently removed after the 90-day window closes | Account-recovery grace period |
| Gameplay and rating data (matches, scores, ratings) | Retained indefinitely, displayed as belonging to a “Deleted User” after account deletion; not linked back to your name, phone, or profile once deleted | Leaderboard and match-history integrity for other players |
| Tournament payment-proof screenshots and organiser identity-verification documents | Deleted automatically 90 days after the related tournament is marked completed | Fraud/dispute review window, minimised afterward |
| OTP codes | Deleted immediately on successful verification, or on expiry (a few minutes) | Authentication only |
| Consent records (permission grants/denials for notifications, contacts, camera, media, location) | Deleted when your account's 90-day grace period ends | DPDPA consent audit trail |
| Crash/error diagnostics | Governed by our Sentry account's configured retention settings | Error monitoring |
| Waitlist email address (website) | Kept until you ask to be removed, or until the waitlist is closed after launch — whichever comes first | Telling you when access opens |
What happens when you delete your account
- Your name, email, profile photograph, age, gender, city, and state are deleted immediately.
- Your mobile number is kept, inactive, for up to 90 days solely to let you restore your account if you log in again. After 90 days, it is permanently removed.
- Your match history and ratings remain visible to other players, but are no longer connected to your name or phone number — they appear as belonging to a “Deleted User”. This keeps other players' match records and leaderboard standings accurate, and cannot be reversed or linked back to you.
- An unresolved tournament dispute or similar record requiring investigation may be kept for as long as reasonably needed to resolve it, in a restricted-access form.
7. Data security
Sportsaathi implements commercially reasonable and industry-standard technical, administrative, and physical security measures to protect your Personal Data from unauthorised access, disclosure, alteration, misuse, or destruction.
7.1 Technical measures
- Encryption in transit: all communication between your device and our servers uses HTTPS/TLS.
- Role-based access control: our backend enforces distinct authority levels for players, team captains, tournament organisers, and administrators, checked at the point of each action.
- Credential hashing: OTP codes are hashed before storage and deleted immediately after use.
- Security-relevant HTTP headers (anti-clickjacking, MIME-sniffing protection, content-security-policy) are applied to all responses in production.
- Abuse-rate limiting: repeated requests from the same user or network address are throttled.
7.2 Administrative measures
- Data access policies and confidentiality agreements binding all employees and contractors who handle Personal Data;
- Regular staff training on data protection obligations and security best practices;
- Appointment of a designated Grievance Officer (see Section 14) and, where required under the DPDPA, a Data Protection Officer.
7.3 Limitation of liability for security incidents
Notwithstanding the measures described above, no system or transmission of data over the internet can be guaranteed to be completely secure. Sportsaathi shall not be liable for any unauthorised access to or disclosure of your Personal Data that occurs despite our reasonable security measures, to the extent permitted by applicable law.
7.4 Data breach notification
In the event of a Personal Data breach that is likely to result in risk or harm to affected Users, Sportsaathi will:
- Report the breach to the Data Protection Board of India within the timeframe prescribed under the DPDPA and applicable rules;
- Notify affected Users as soon as reasonably practicable, describing the nature of the breach, the data affected, and the steps being taken to address it;
- Maintain a record of all breaches, including those not requiring notification, for internal audit and regulatory inspection purposes;
- Take immediate remedial action to contain and mitigate the breach.
8. Children's privacy
The Platform is intended primarily for individuals aged eighteen (18) years or above. Sportsaathi does not knowingly collect, process, or store Personal Data from any individual below the age of thirteen (13) under any circumstance.
For users aged thirteen (13) to seventeen (17): Sportsaathi may, at its sole discretion, permit access to users in this age range only where verifiable parental or legal guardian consent has been obtained through the prescribed minor onboarding process described in Section 5.3 of the Terms of Use. That process requires: (i) the parent or guardian to register a separate Account using their own verified mobile number; (ii) submission of a government-issued photo ID of the parent or guardian; and (iii) the parent or guardian's affirmative acceptance of the Terms of Use on behalf of the minor through a dedicated consent flow. Where such access is granted:
- The parent or legal guardian will be required to affirmatively accept the Terms of Use and this Privacy Policy on behalf of the minor;
- The minor's personal data will be processed in accordance with this Policy with appropriate additional safeguards, including restricted public profile visibility and limitations on participation in paid tournaments and community features;
- Sportsaathi will not serve behavioural advertising or conduct profiling of any User identified as a minor.
If Sportsaathi becomes aware that Personal Data of an individual below the age of thirteen (13) has been collected, such data will be permanently deleted without undue delay. Parents or guardians who become aware that a minor has registered on the Platform are requested to contact us immediately at support@sportsaathi.com so that the account and associated data may be removed.
9. Your rights as a Data Principal
Under the DPDPA 2023 and other applicable Indian laws, you have the following rights with respect to your Personal Data. These rights may be exercised by submitting a written request to our Grievance Officer (see Section 14). Sportsaathi will acknowledge receipt of all rights requests within seventy-two (72) hours and will respond substantively within thirty (30) days of the request.
For complex requests that require additional time, we will notify you within the initial thirty (30) day period and provide a revised timeline, not exceeding a total of sixty (60) days from the date of the original request.
9.1 Right of access
You have the right to request a summary of the Personal Data held by Sportsaathi about you, the purposes for which it is being processed, and the identities of any Third-Party Service Providers with whom it has been shared.
9.2 Right to correction and completion
You have the right to request correction of any inaccurate Personal Data, and completion of any Personal Data that is incomplete or outdated.
9.3 Right to erasure
You have the right to request the deletion of your Personal Data where: (a) the data is no longer necessary for the purpose it was collected; (b) you have withdrawn consent and there is no other legal basis for processing; or (c) the data has been processed unlawfully. Account deletion can be initiated directly in the app, from the Account section of your profile (profile menu → Edit Profile → Account → Delete Account). If you no longer have the app installed, you may request deletion at sportsaathi.com/delete-account or by emailing the Grievance Officer named in Section 14. Please refer to Section 6 for details on what data is deleted immediately and what is retained for legal compliance purposes.
9.4 Right to withdraw consent
Where processing is based on your consent, you have the right to withdraw that consent at any time with effect from the date of withdrawal. Withdrawal of consent does not affect the lawfulness of processing undertaken prior to such withdrawal. You may withdraw consent through Platform settings or by contacting us directly.
9.5 Right to data portability
You have the right to request that your Personal Data be provided to you in a structured, commonly used, and machine-readable format, to the extent technically feasible. This right applies to data processed on the basis of consent or contract.
9.6 Right to grievance redressal
You have the right to have any grievance related to this Policy or our data processing practices addressed in a timely manner. Please refer to Section 14 for the procedure and contact details. Grievances must be submitted within thirty (30) calendar days of the event giving rise to the grievance.
9.7 Right to nominate a representative
In accordance with the DPDPA, you have the right to nominate another individual who shall, in the event of your incapacity or death, exercise your data protection rights on your behalf. Nomination requests must be submitted in writing to our Grievance Officer.
9.8 Right to complain to the Data Protection Board
If you are not satisfied with the resolution of your grievance by Sportsaathi's Grievance Officer, you have the right to file a complaint with the Data Protection Board of India in accordance with applicable law.
9.9 Opt-out of non-essential communications
You may opt out of receiving promotional or marketing communications at any time by: adjusting your notification preferences in the app settings; clicking the unsubscribe link in any marketing email; or sending a written request to support@sportsaathi.com. Opting out of promotional communications will not affect essential transactional notifications such as payment confirmations, account security alerts, or match result updates.
11. International data transfer
Sportsaathi's services are primarily intended for users located in India. Because we use third-party service providers whose infrastructure may be located outside India — MSG91, Sentry, Neon, Railway, Cloudinary, Vercel, and Resend — your personal data may be processed on servers located outside India.
In such cases, Sportsaathi ensures the following safeguards are in place:
- Transfers are carried out only to jurisdictions not prohibited by the Central Government under Section 16 of the DPDPA and any rules or orders issued thereunder;
- Data is transferred subject to appropriate contractual and security safeguards, including standard contractual clauses or data processing agreements where required;
- Sportsaathi will update this Policy if the Central Government issues rules affecting the permissibility or conditions of any transfer described herein.
12. Marketing and communications
Sportsaathi may send you the following types of communications:
- Transactional Communications: Notifications directly related to the Services you use, such as payment receipts, match updates, tournament reminders, and account security alerts. These are sent without requiring additional consent as they form part of the Service delivery.
- Promotional Communications: Marketing messages, offers, new feature announcements, and promotional content. These will only be sent where you have provided explicit opt-in consent. You may withdraw this consent at any time.
Communications may be delivered via in-app notifications, SMS, and email. Your communication preferences can be managed at any time through the Platform's notification settings or by contacting us at support@sportsaathi.com.
13. Scope of platform role and liability
Sportsaathi operates as a technology platform that facilitates match organisation, performance tracking, and community engagement among sports participants. In this capacity:
- Sportsaathi is not a party to any match, tournament, or physical sporting event organised through the Platform.
- Sportsaathi is not responsible for the conduct, actions, or behaviour of any User on or off the Platform.
- Sportsaathi does not verify the accuracy of match data, statistics, or scores entered by Users, and accepts no liability for any errors or disputes arising therefrom.
- Sportsaathi is not liable for any disputes between Users arising out of tournament results, match outcomes, or any matter relating to the physical conduct of sports events.
Users are responsible for the accuracy and completeness of any data they enter on the Platform. Deliberately entering false, misleading, or fraudulent data is a violation of our Terms of Use and may result in account suspension or termination.
14. Grievance Officer and redressal mechanism
In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, Sportsaathi has designated a Grievance Officer to address data protection concerns and complaints.
The Grievance Officer handles complaints and grievances from Users regarding this Policy and data processing practices. Where Sportsaathi is classified as a Significant Data Fiduciary under the DPDPA, a separate Data Protection Officer (DPO) will be designated with responsibility for overseeing data protection compliance. Users will be informed if and when a DPO is appointed.
- Name
- Rohit Sharma
- Phone
- +91 8384079027
- Hours of availability
- Monday to Friday, 10:00 AM to 6:00 PM IST (excluding public holidays)
Procedure for submitting a grievance
- Submit your complaint in writing to the Grievance Officer via email, clearly describing the nature of your concern and the relief sought.
- Grievances must be submitted within thirty (30) calendar days of the event giving rise to the grievance.
- The Grievance Officer will acknowledge receipt within seventy-two (72) hours of receiving the complaint.
- A substantive response or resolution will be provided within thirty (30) calendar days of receipt of the complaint.
- For complex requests, we may take up to sixty (60) days in total — but we will notify you within the first thirty (30) days if we need more time.
- If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate the complaint to the Data Protection Board of India in accordance with applicable law.
15. Changes to this Policy
Sportsaathi reserves the right to amend, update, or revise this Policy at any time. The following process will apply to all material changes:
- Changes will be posted on the Platform with an updated “Last Reviewed” date at the top of this Policy.
- For material changes — defined as changes that substantially affect your rights or Sportsaathi's data processing practices — we will provide advance notice of no fewer than fourteen (14) days via in-app notification, email, or SMS before the changes take effect.
- Where a material change requires fresh consent, we will present a consent prompt to existing Users before the new processing activity commences.
- Continued use of the Platform after the effective date of any change constitutes acceptance of the revised Policy.
- Users who do not agree to material changes may request deletion of their account and data prior to the effective date of the change.
16. Governing law and jurisdiction
This Policy and all matters relating to the collection, use, processing, and protection of Personal Data by Sportsaathi shall be governed by and construed in accordance with the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and all rules and regulations made thereunder.
Any disputes arising out of or in connection with this Policy, or the processing of Personal Data by Sportsaathi, that cannot be resolved through the grievance mechanism set out in Section 14, shall be subject to the exclusive jurisdiction of the courts located at Delhi, India.
17. Contact us
For any queries, concerns, or requests relating to this Policy or your Personal Data, please contact us through any of the following channels:
- Registered company name
- Playtomic Sportsaathi Private Limited
- CIN
- U93110DL2025PTC448183
- Registered office
- 25/68, Street No. 15, Vishwas Nagar, Shahdara, Delhi – 110032
- Support and privacy email
- support@sportsaathi.com
- Website
- https://sportsaathi.com/
- Customer support phone
- +91 8384079027
This Privacy Policy was prepared on 1 June 2026 and is effective from 1 June 2026. It supersedes all prior versions of Sportsaathi's Privacy Policy. Users are encouraged to retain a copy of this Policy for their records.