Privacy Policy

Table of Contents

1. Introduction and Definitions

Welcome to PlayMate ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

In this policy, the following terms have specific meanings:

• "Service" refers to the PlayMate mobile application (iOS and Android), the website at playmate.now, and all related features and services.
• "User" or "you" refers to any person who accesses or uses the Service.
• "Personal Data" refers to any information that identifies or can be used to identify you, directly or indirectly.

By using PlayMate, you agree to the collection and use of information in accordance with this policy. This policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area and United Kingdom, and the California Consumer Privacy Act (CCPA) for California residents. If you do not agree with the terms of this policy, please do not use the Service.

2. Information We Collect

2.1 Account Information (Provided by You)

When you register for an account, we collect the following information:

• Name and display name
• Email address
• Phone number (optional)
• Biography or about text
• Birth year (for age verification — we do not collect your full date of birth)
• Country
• Profile photo and cover photo
• Sports preferences and favorite sports
• Skill levels per sport
• Weekly availability schedule

2.2 Location Data

With your permission, we collect precise location data including:

• GPS coordinates (latitude and longitude)
• Your location sharing preference (exact, fuzzy, or hidden)
• Free Roam status: whether enabled, selected sports, search radius, and start time

For more detail on how location data is collected and used, see Section 4: Location Data.

2.3 Content You Create

When you use PlayMate, we store the content you create, including:

• Direct messages and group or lobby chat messages
• Articles you publish (including title, body content, cover images, categories, and tags)
• Posts and shared content
• Place reviews and ratings
• Lobby polls and votes
• Game RSVPs and participation records

2.4 Automatically Collected Information

We automatically collect certain information when you use the Service:

• Device type and operating system
• App usage patterns and feature interactions
• Article view tracking (using anonymized IP hashes for deduplication, not identification)
• Last active timestamp
• Crash reports and diagnostic data

2.5 Information from Third Parties

When you sign in using a third-party provider (Google, Apple, or X), we receive basic profile information from that provider, typically including your name, email address, and profile photo. We only request the minimum data necessary for account creation and do not access your contacts, social graphs, or other data from these providers.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Connect you with nearby players based on your location, sports preferences, and skill level
• Enable game creation, scheduling, and matchmaking
• Enable group creation, management, and communication
• Power the Free Roam feature to automatically match you with nearby players
• Facilitate messaging between users (direct messages, group chat, lobby chat)
• Display articles you publish and track view counts
• Send notifications about games, matches, messages, and lobby events
• Process game results and maintain player statistics
• Respond to your support requests and inquiries
• Monitor usage trends to improve the Service
• Detect, prevent, and address abuse, fraud, and security threats
• Comply with legal obligations

5. Third-Party Services

PlayMate uses the following third-party services to operate:

We do not sell your personal data to any third party. We do not use advertising networks or share your data with data brokers.

6. Cookies and Tracking Technologies

Website (playmate.now)

• Authentication cookies: Set by Supabase for session management. These are HttpOnly, Secure, and SameSite cookies that are required for you to stay logged in. They cannot be opted out of without losing login functionality.
• Analytics cookies: Google Analytics 4 sets cookies (such as _ga and _gid) to track anonymous page views and user journeys. Google retains this data for approximately 14 months by default.

Mobile App

The PlayMate mobile app does not use cookies. Session tokens are stored securely on your device using your operating system's native secure storage (Keychain on iOS, Keystore on Android).

We do not use third-party advertising cookies or tracking pixels on any part of the Service.

7. Data Sharing and Disclosure

With Other Users

Certain information is visible to other PlayMate users as part of the Service:

• Your profile information (name, avatar, sports, skill levels)
• Your location, based on your chosen precision setting (exact, fuzzy, or hidden)
• Messages you send to other users in conversations, groups, or lobbies
• Articles you publish (publicly accessible)
• Posts, game RSVPs, and group membership

With Service Providers

We share data with the third-party service providers listed in Section 5 to operate the Service. These providers process data on our behalf and are bound by their own data protection obligations.

For Legal Reasons

We may disclose your information when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of PlayMate, our users, or the public, or to investigate potential violations of our Terms of Service.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to applicable privacy practices.

What We Never Do

• We never sell your personal data
• We never share your data with advertising networks
• We never provide your data to data brokers

8. Data Retention

We retain your data for the following periods:

When you delete your account, all personal data is permanently removed within 30 days. See Section 13 for details on the deletion process.

9. Data Security

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
• Database security: Row Level Security (RLS) policies are enforced on all database tables, ensuring users can only access data they are authorized to see.
• Authentication: Sessions are managed using JWT tokens with access and refresh tokens. Web sessions use HttpOnly, Secure, SameSite cookies. Mobile sessions use native secure storage.
• Access control: Our API enforces authenticated and anonymous role separation, preventing unauthorized data access.

Important note about messaging: Messages (direct messages, group chat, and lobby chat) are stored in plain text on our servers and are not end-to-end encrypted. We rely on transport-level encryption (TLS) and database-level access controls to protect message content. We recommend that you do not share sensitive personal information (such as financial details, passwords, or government IDs) via PlayMate messaging.

10. Children's Privacy

PlayMate is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. We collect birth year (not full date of birth) during registration to verify age eligibility.

If you are a parent or guardian and believe your child under 13 has created a PlayMate account, please contact us at privacy@playmate.now. Upon verification, we will delete the child's account and all associated data within 30 days.

11. International Data Transfers

PlayMate's primary infrastructure is hosted by Supabase in Mumbai, India. Your data may also be processed in the following regions:

• Google Analytics data is processed in the United States
• OAuth providers (Google, Apple, X) process authentication data in their respective infrastructure regions

If you access PlayMate from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, your data will be transferred to and processed in India and potentially the United States. We rely on the data processing terms and standard contractual clauses of our service providers to ensure adequate protection of your data during international transfers.

12. Your Rights

Rights for All Users

Regardless of where you are located, you have the right to:

• Access your personal data through your account settings
• Correct inaccurate information by editing your profile
• Delete your account and associated data
• Control your location sharing (exact, fuzzy, or hidden) at any time
• Manage your notification preferences
• Request a copy of your data by contacting support@playmate.now

Additional Rights under GDPR (EEA and UK Users)

If you are in the European Economic Area or United Kingdom, you also have the right to:

• Request access to your personal data (Article 15)
• Request rectification of inaccurate data (Article 16)
• Request erasure of your data / "right to be forgotten" (Article 17)
• Request restriction of processing (Article 18)
• Request data portability (Article 20)
• Object to processing of your data (Article 21)
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection authority

Additional Rights under CCPA (California Residents)

If you are a California resident, you also have the right to:

• Know what personal information is collected, used, shared, or sold
• Request deletion of your personal information
• Opt out of the sale of personal information (note: we do not sell your data)
• Non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at privacy@playmate.now with the subject line "Data Protection Request."

13. Account Deletion and Data Removal

You can request deletion of your account at any time through the app settings or by contacting privacy@playmate.now. You can also submit a request through our data deletion page.

When you request account deletion:

• Your account is immediately deactivated and you will no longer appear in searches or the radar
• You have 7 days to cancel the deletion by contacting support
• After 30 days, all personal data is permanently and irreversibly deleted
• Your profile, location data, direct messages, posts, and articles will be permanently removed
• Messages you sent in group conversations may be anonymized (attributed to "Deleted User") rather than fully removed, to preserve conversation context for other participants

Anonymized and aggregated data that cannot be used to identify you (such as article view counts) may be retained for analytical purposes after account deletion.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you through the app and, where possible, via email. The "Last updated" date at the top of this page will always reflect the most recent revision. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.