PRIVACY POLICY

Khelchhu ("we," "us," "our," or "Company") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have regarding your information.

This policy applies to the Khelchhu mobile application, website, and all related services (the "Service").

1. INFORMATION WE COLLECT

We collect information in several ways:

1.1 Information You Provide Directly

Account Registration Data:

Full name
Email address
Phone number (optional; used for password recovery and notifications)
Date of birth (for in-app social features)
Gender (optional; for diversity and inclusion features)
Profile photo (optional)
Password (if registering via email/password) or third-party OAuth token (if using Google Sign-In)

Profile Information:

Sports you're interested in (futsal, cricket, etc.)
Geographic preferences (areas you want to play in)
Skill level or experience (self-selected: beginner, intermediate, advanced, competitive)
Availability preferences (preferred days/times)
Optional bio or about section
Emergency contact (optional)

Event-Related Data:

Games you create, join, or organize
Venue selections and preferences
Event descriptions and details
Messages in event chats
Join requests and responses
RSVP status and attendance records
Cancellation reasons (if provided)
Ratings and reviews you submit for players or venues

Communications:

Messages sent to other users within the app
Feedback or support inquiries
Complaints or reports of violations
Appeals or disputes

1.2 Information Collected Automatically

Device & Technical Information:

Device type and model (iPhone, Android, etc.)
Operating system version
App version
Unique device identifier (IDFA for iOS, AAID for Android)
IP address
Browser type and version (if accessing via web)
Device language and timezone settings
Push notification tokens (used to send you notifications)

Location Data:

Approximate geographic location when you grant permission
You can grant, deny, or revoke location permission at any time via device settings
Location is used to show nearby games and venues on the map
We do NOT track your precise, real-time movement throughout the day

Usage & Behavioral Data:

App features you use (map, search, filters, profile sections)
Games you view but don't join
How long you spend in the app or on specific screens
Buttons you click and interactions you perform
Search queries and filters you apply
Reports or complaints you submit
Content you upload or create
Time and frequency of app usage

Crash & Performance Data:

App crashes or errors you experience
Performance metrics (app load time, responsiveness)
Bugs encountered
Device memory and storage info (only to diagnose crashes)

Analytics & Inferred Data:

Your reliability score (calculated from your attendance history)
Skill level inferred from your game participation patterns
Preferred sport(s) based on games you join
Preferred game times based on attendance
Geographic play patterns

1.3 Information from Third Parties

Google Sign-In (via Clerk):

If you register using Google, we receive your name, email address, and profile picture (optional) through our authentication provider, Clerk
Clerk's privacy policy governs their data handling: https://clerk.com/legal/privacy
Google's privacy policy: https://policies.google.com/privacy

Venue Information:

Venue owners provide address, photos, pricing, and availability
This becomes part of game listings and may be visible to all users

Reports from Other Users:

If another user reports you for violations, we collect information about the alleged incident
This may include screenshots, messages, or witness statements

1.4 What We DON'T Collect

Credit card numbers or full banking details
National ID numbers
Biometric data (fingerprint, facial recognition)
Health information (except if you voluntarily disclose a condition that affects play)
Criminal history or background check results
Political beliefs, union membership, or other sensitive data
Sexual orientation or other protected characteristics (except if voluntarily provided)

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

Core Service Functions:

Create and manage your account
Verify your identity and prevent fraud
Authenticate your login (via Google or email/password)
Display nearby games on the map
Send you game notifications and invitations
Track your attendance and calculate your reliability score
Facilitate communication between players and organizers

Communication:

Send in-app notifications about games, approvals, cancellations
Send push notifications if you've opted in
Email updates about important account or service changes
SMS reminders if you've opted in
Respond to your support inquiries or appeals

Safety & Community Enforcement:

Detect and prevent fraud (duplicate accounts)
Enforce our Community Guidelines
Investigate violations and process disputes
Track patterns of abuse (harassment, no-shows, discrimination)
Maintain the reliability scoring system
Identify and ban users who violate guidelines

Platform Improvement:

Analyze app usage patterns to improve features
Identify bugs and performance issues
A/B test new features with subsets of users (you can opt out)
Generate aggregate statistics (e.g., "futsal is more popular than cricket")
Train machine learning models to predict no-shows, recommend games, detect unsafe activity, and suggest optimal game times

Personalization:

Customize your game feed based on sports interest and skill level
Recommend games and organizers based on your preferences
Tailor in-app content to your location and interests

Legal & Compliance:

Respond to legal requests (court orders, government subpoenas)
Comply with applicable laws and regulations
Enforce our Terms of Service and other agreements
Protect against fraud, abuse, and security threats
Maintain records for legal disputes or investigations

Marketing (Only if You Opt In):

Send newsletters about app updates, new features, and community highlights
Email about special events, tournaments, or challenges
Social media campaigns or user testimonials (with your permission)
You can opt out of marketing emails at any time (see Section 4)

3. INFORMATION SHARING

We share your information in limited circumstances:

3.1 Information Visible to Other Users

Your public profile includes:

Display name
Profile photo (if you uploaded one)
Reliability score (0–100)
Sport interests
Number of games attended
Ratings and feedback from organizers
Any bio or "about me" section you wrote

Visible to players in events you join:

Your attendance status (joined, attended, no-show)
Your rating from that specific organizer
Your reliability score
Your general location (approximate, not precise)

NOT visible to other players:

Your email address or phone number
Your date of birth or exact age
Your messages or private communications
Your device information
Your precise location (only approximate location for game discovery)

3.2 Sharing with Service Providers

We share data with third-party companies that help operate Khelchhu:

Clerk (Authentication):

Purpose: User authentication (email/password and Google Sign-In)
Data shared: Your name, email, profile picture, and authentication tokens
Clerk's privacy policy: https://clerk.com/legal/privacy

Cloudinary (Media Storage):

Purpose: Image and media file storage
Data shared: Profile photos and other images you upload
Cloudinary's privacy policy: https://cloudinary.com/privacy

Hosting & Infrastructure Providers:

Purpose: Hosting app servers and database
Data shared: All user data (encrypted)
Data location: May be outside Nepal (specific locations available upon request)

Data Processing Agreements: We require all third-party processors to sign a Data Processing Agreement (DPA) committing to protect your data, use data only for contracted services, not sell or use your data for their own purposes, notify us of any data breaches, delete data when no longer needed, and allow us to audit their security practices.

3.3 Sharing for Legal Reasons

We may disclose your information when:

Required by law (court order, government subpoena, regulatory request)
Necessary to protect safety (credible threats of violence)
Needed to prevent fraud or security breaches
Required to protect Khelchhu's legal rights
Necessary to enforce our Terms of Service or Community Guidelines

When possible, we will notify you before disclosing (unless legally prohibited), disclose only the minimum information required, request confidentiality from the requesting authority, and challenge overbroad requests.

3.4 Information We Do NOT Share

We do NOT sell your personal data to third parties for profit
We do NOT share data with marketing companies or data brokers
We do NOT use your data for purposes unrelated to Khelchhu without consent
We do NOT share email lists or contact information with external parties

4. YOUR PRIVACY RIGHTS & CHOICES

4.1 Right to Access

You have the right to request all personal data we hold about you. Email khelconnect988@gmail.com with subject line "Data Subject Access Request" including your account email and full name. We will respond within 30 days and provide data in a machine-readable format (e.g., CSV or JSON).

4.2 Right to Correction

If any information in your account is inaccurate, you can update your profile directly in the app (name, sports interests, location, bio). For information you cannot edit (email, phone), email khelconnect988@gmail.com. We'll correct the information within 5 business days.

4.3 Right to Delete

You can request deletion of your account and associated data.

What happens when you delete your account:

Your profile becomes invisible to other users
Your name and public profile are removed
Your participation history is anonymized (games show "Anonymous Player" instead of your name)
Your reliability score is deleted from public view

Data retained after deletion: We retain your account data for 12 months after deletion for fraud prevention, legal holds, and ongoing investigations. After 12 months, all data is permanently deleted (except where legally required to retain).

How to request:Delete your account in-app (Settings > Account > Delete Account), or email khelconnect988@gmail.com with "Account Deletion Request."

4.4 Right to Data Portability

You can request your data in a portable format. We'll provide a download of your profile data, game history, and messages in machine-readable format (JSON, CSV) within 30 days. Email khelconnect988@gmail.com with subject "Data Portability Request."

4.5 Right to Restrict Processing

You can restrict how we use your data, including:

"Do not send me marketing emails" (still receive essential service emails)
"Do not use my data for personalized recommendations"
"Do not track my app usage for analytics"
"Do not include me in A/B tests"

Email khelconnect988@gmail.comor manage in-app in Settings > Privacy > Data Usage Preferences.

4.6 Right to Withdraw Consent

You can withdraw consent for optional data collection at any time, including location tracking, push notifications, analytics tracking, marketing emails, and use of profile photo. Adjust settings in the app or your device, or email khelconnect988@gmail.com.

4.7 Right to Complain

If you believe we've violated your privacy rights, you can:

Contact us at khelconnect988@gmail.com
File a complaint with Nepal's Data Protection Authority (if applicable)
Contact your country's privacy regulator (if outside Nepal)
Take legal action in the courts

5. DATA RETENTION

5.1 Retention While Account is Active

As long as your account is active, we retain: account information, profile data, game history and attendance records, reliability score and strike history, messages and communications, ratings and reviews, device information, and login history.

5.2 Retention After Account Deletion

Deleted immediately (removed from public view): profile name and photo, public game history, ratings and reviews you submitted.

Retained for 12 months(for fraud prevention & legal holds): account email and phone, anonymized game history, violation records, device identifiers, and IP addresses.

Permanently deleted after 12 months: all personal data (unless legal hold requires retention).

Retained indefinitely (for legal/compliance reasons): data required by court order or subpoena, active investigations or disputes, pending proceedings, and data necessary to comply with tax or financial regulations.

5.3 Retention of Specific Data Types

Login/authentication records: 12 months after account deletion
Crash reports: 90 days
Analytics data (aggregated): Indefinitely
Support/chat messages: 1 year
Profile photos: 12 months after deletion
Device information: 12 months
Game ratings by organizers: 12 months after deletion

5.4 Right to Early Deletion

You can request deletion of specific data types before retention periods expire.

Can be deleted early: personal photos, messages and communications, optional profile information (bio, interests).

Cannot be deleted early: game history (required for reliability score), strike/violation records (required to prevent ban evasion), anonymized attendance data (required for platform integrity).

Email khelconnect988@gmail.com specifying what data to delete. Deleted within 5 business days (except data required for active disputes).

6. DATA SECURITY

6.1 Security Measures We Implement

Encryption: All data is encrypted in transit using TLS 1.2 or higher. Sensitive data (passwords, tokens) are encrypted at rest using AES-256. Encryption keys are stored securely in a key management system.

Authentication & Access Control: User authentication is managed by Clerk, which handles password hashing using industry-standard algorithms. Access to databases is restricted to authorized personnel only with role-based access control. All employee access is logged and audited.

Network Security: Firewalls and intrusion detection systems protect our servers. Regular penetration testing, DDoS protection, and VPN required for remote employee access.

Application Security: Regular security code reviews, automated vulnerability scanning, security testing before each release, and secure API design (rate limiting, input validation).

Monitoring & Incident Response: 24/7 security monitoring, automated alerts for anomalies, incident response plan for data breaches, and regular security training for employees.

6.2 Security Limitations

No system is 100% secure. Risks include sophisticated cyberattacks, employee error, third-party provider compromise, device vulnerabilities, and phishing.

6.3 Your Responsibility

You are responsible for:

Choosing a strong, unique password
Keeping your password confidential
Logging out on shared devices
Updating your device's operating system and security patches
Reporting suspicious activity immediately

7. DATA BREACH NOTIFICATION

7.1 If Your Data is Compromised

If we discover unauthorized access to or disclosure of your personal data, we will within 30 days: investigate the extent of the breach, determine what data was accessed, assess the risk, and notify you via email and in-app notification with details including what data was compromised, when we discovered it, what we're doing to address it, and steps you should take.

7.2 What We'll Do After a Breach

Secure the vulnerability or close the unauthorized access point
Audit logs to determine the extent of unauthorized access
Restore data from backups if needed
Notify affected users and relevant authorities
Review our security practices to prevent future breaches

7.3 Your Rights After a Breach

Request confirmation of what data was compromised
Request a copy of our breach investigation report
Take legal action against Khelchhu if negligence is proven
Request additional security measures

8. COOKIES & TRACKING

8.1 Cookies We Use

Essential Cookies: Keep you logged in, maintain session. Required; deleted when you close the app.
Functional Cookies: Remember your preferences (language, location, notification settings). Persistent, up to 2 years. Optional but recommended.
Analytics Cookies:Track which features are used, how long you use the app, crash reports. Persistent, 90 days. Opt-out available in Settings > Privacy > Analytics.
Marketing Cookies:Track ad views, measure ad effectiveness. Persistent, up to 1 year. Opt-out available in Settings > Privacy > Marketing.

8.2 How to Control Cookies

In the app: go to Settings > Privacy > Cookie Preferences and toggle individual cookie types on/off. On your device: iOS (Settings > Limit Ad Tracking), Android (Settings > Google > Data & Privacy).

8.3 Third-Party Cookies

Third-party services (Clerk, Cloudinary) may set their own cookies. Control these via their privacy settings, your browser privacy settings, or opt-out tools provided by each third party.

9. ANALYTICS & PROFILING

9.1 What We Analyze

We use analytics to understand which sports are most popular, peak playing times, popular venues and neighborhoods, user demographics, feature usage, and app performance.

9.2 How Profiling Works

Based on your activity, we create a profile including:

Sport preferences (inferred from games you join)
Skill level (inferred from organizers' ratings and game types)
Reliability score (calculated from attendance history)
Geographic preferences (inferred from games you join)
Playing style (inferred from feedback and game patterns)
Availability (inferred from join patterns)

9.3 How Profiling is Used

Your profile is used to:

Show you games similar to ones you've played
Recommend organizers with positive ratings
Notify you about games matching your interests
Suggest optimal game times based on your history
Help us improve the app based on usage patterns

9.4 Opting Out of Profiling

You can opt out of personalized recommendations by emailing khelconnect988@gmail.com requesting "Opt-Out of Profiling." You'll still receive notifications but not personalized recommendations.

10. INTERNATIONAL DATA TRANSFERS

10.1 Data Location

Khelchhu is based in Nepal, but data may be stored outside Nepal via our app servers, Google services, Cloudinary, and other infrastructure providers.

10.2 Data Protection Outside Nepal

When data is transferred outside Nepal, we:

Use Standard Contractual Clauses (SCCs) or similar mechanisms to ensure protection
Require service providers to comply with data protection laws
Verify that recipient countries have adequate privacy protections
Encrypt data in transit and at rest

10.3 Nepal-Specific Considerations

We comply with Nepal's:

Constitution (Article 29: Right to privacy)
Personal Data Protection Act (if enacted)
Information Technology Law

If Nepal enacts specific data protection regulations, we will update this policy and comply.

11. CHANGES TO THIS POLICY

11.1 How We Notify You

Minor changes(typos, clarifications, no impact on privacy): effective immediately, noted as "last updated" date.

Material changes(new data collection, new sharing, new processing): 30-day advance notice via email and in-app notification with a clear summary of what changed. Your continued use after 30 days constitutes acceptance. You have the right to delete your account if you don't accept changes.

11.2 Material Changes Requiring Explicit Consent

Some changes require affirmative opt-in: new processing purposes, sharing data with non-service providers, changes affecting special categories of data, and opting in to marketing communications. We'll email you with a link to accept the new policy.

12. CONTACT US

Phone: +977 981-7627843, +977 981-5085740

Privacy questions: khelconnect988@gmail.com — response time: within 5 business days.

Data Subject Access Requests (DSAR): Email khelconnect988@gmail.com with subject "DSAR." Include account email, full name, and request details. Response time: within 30 days.

Data Deletion Requests: Email khelconnect988@gmail.com with subject "Deletion Request," or delete in-app via Settings > Account > Delete Account.

Report a Privacy Breach: Email khelconnect988@gmail.com with subject "URGENT: Privacy Breach." Include what data may be affected and how you discovered it. Response: immediate investigation.

Complaints: Email khelconnect988@gmail.com. Escalate to khelconnect988@gmail.com, Nepal's Data Protection Authority (if applicable), or your country's privacy regulator.

13. ADDITIONAL PROVISIONS

13.1 Third-Party Links

Khelchhu may contain links to external websites (venue websites, partner apps). We're not responsible for their privacy practices. Review their privacy policies before sharing information.

13.2 User-Generated Content & Reviews

Reviews and ratings you post are public and may include your name, photo, reliability score, written review, and date of review. You can delete reviews from your profile, but they may remain in search results temporarily.

13.3 Marketing Communications

By default:You'll receive emails about games, approvals, and cancellations (essential), and app notifications about activity (essential).

Opt-in (not sent by default): Weekly digest of recommended games, monthly community highlights, new feature announcements, and special events or tournaments.

Opt-out:Click "Unsubscribe" in any email, go to Settings > Notifications > Email & Marketing, or email khelconnect988@gmail.com with "Unsubscribe from Marketing."

13.4 Aggregate & Anonymized Data

We may use anonymized, aggregate data (e.g., "30% of players are in the 25–35 age range") without restriction. This data doesn't identify you, can't be reversed to identify you, and may be shared with partners, published, or used for research.