Privacy Policy

Last updated: October 2026

1. Overview

CricStream ("the app", "we", "us") is a cricket scoring and live streaming application for iOS and Android. This policy explains what data we collect, why, and how it is used.

2. Data We Collect

Account Data

• Email address and display name, from the account you create
• Profile avatar (optional, uploaded by you)

Match & Scoring Data

• Teams, player names, and roles you create, and any team logo or player photo you add
• Ball-by-ball match scores
• Match results and scorecards

Tournament Contact Numbers

• If you organise a tournament, you can add your own contact phone number and the phone numbers of team captains. Both are optional. See Phone Numbers in Tournaments

YouTube / Google Data

• Google OAuth access token — stored on-device only, never on our servers
• YouTube live stream RTMP configuration — stored encrypted on-device
• We do not store your YouTube credentials or access any YouTube content beyond what is needed to create and manage your live streams

Device Permissions

• Camera & Microphone — used only while you are actively broadcasting a match, to capture and transmit your live video/audio stream to YouTube. Camera and microphone data is streamed in real time and is not recorded or stored by us.
• Location (fine/coarse) — used on your device to sort live matches by how near they are to you. That reading is not sent to or stored on our servers. When you create a match you can choose to tap “Use GPS for nearby discovery”; the ground’s coordinates are then saved with the match, with any city and ground name you enter, so the match can appear in other users’ nearby search. This is where the match is played, not a record of where you go. Location is optional and is never sold or shared with advertisers.
• Notifications — if you allow them, we store a push token for your device. See Notifications.

Usage & Advertising Data

• Crash reports via Firebase Crashlytics (anonymised device info and stack traces only)
• We show ads via Google AdMob. AdMob may collect your device's advertising identifier and general device/network information to serve and measure ads, per Google's advertising policies. You can limit ad personalisation in your device's ad settings.
• App usage statistics via Firebase Analytics: app events such as how many people reach each step before going live, with device type, OS version and an app instance identifier. We do not send it your name, email, phone numbers or match data.

3. How We Use Your Data

• Provide core app functionality: ball-by-ball scoring, scorecards, live streaming
• Sync your match data across sessions via Supabase
• Show tournament contact numbers only to the people described in Phone Numbers in Tournaments
• Send the notifications you choose
• Create and manage YouTube Live broadcasts on your behalf when you tap "Go Live"
• Display a live score overlay on your YouTube stream
• Diagnose crashes, improve app stability, and understand which features are used

4. YouTube API Usage

CricStream uses the YouTube Data API v3 to:

• Create a live broadcast on your YouTube channel when you start a stream
• Bind that broadcast to your RTMP stream endpoint
• Transition the broadcast to live / complete status

We request only the minimum YouTube permissions necessary. Your YouTube data is used solely to operate the live streaming feature you explicitly initiate. We do not read, store, or analyse any other YouTube content from your account.

Our use of YouTube API Services is also subject to the YouTube Terms of Service and Google Privacy Policy.

You can revoke CricStream’s access to your YouTube account at any time at security.google.com/settings/security/permissions.

5. Data Storage & Security

• All match data is stored in Supabase (hosted on AWS, eu-west region)
• Access is controlled by Row-Level Security. Matches and tournaments you make public can be seen by other CricStream users; private ones only by you and the people you share them with. Only you, or a scorer you assign, can change your matches
• Google OAuth tokens are stored in the device's encrypted secure storage (iOS Keychain / Android Keystore)
• We do not sell, rent, or share your personal data with third parties

6. Third-Party Services

Service	Purpose	Privacy Policy
Supabase	Database & Authentication	supabase.com/privacy
Google / YouTube	Sign-In & Live Streaming	policies.google.com/privacy
Firebase Crashlytics	Crash reporting	firebase.google.com/support/privacy
Firebase Analytics	App usage statistics	firebase.google.com/support/privacy
Expo push service	Delivering notifications	expo.dev/privacy
Firebase Cloud Messaging	Delivering notifications	firebase.google.com/support/privacy
Google AdMob	In-app advertising	policies.google.com/technologies/ads

7. Phone Numbers in Tournaments

Tournament organisers can add a contact phone number for themselves and for each team’s captain. Both are optional.

• Organiser’s number — shown on the tournament page to everyone who can see the tournament, so that teams can get in touch. The organiser can change or remove it at any time from the tournament’s Edit details.
• Captains’ numbers — visible only to the organiser of that tournament. Never shown on the tournament page, to other teams or to followers.

We do not call, message or verify these numbers, and we do not share them with advertisers or any other third party.

If an organiser added your number and you want it removed, ask the organiser or email ravisfortune@gmail.com. If an organiser deletes their account, their contact number and the captains’ numbers they added are erased.

8. Notifications

If you allow notifications, we store a push token that lets the Expo push service and Firebase Cloud Messaging deliver alerts to your device, together with the notification types you choose in Settings → Notifications — for example tournament updates and alerts for matches you follow.

The token is deleted when you sign out or delete your account. You can turn notifications off at any time in the app or in your device settings.

9. Deleting Your Account

In the app: open Profile → Delete account and confirm twice. Deletion happens immediately and cannot be undone.

Without the app: email ravisfortune@gmail.com from the address your account uses, with the subject “Account deletion request”. We action these within 7 business days.

Deleted straight away: your login and password, your name, email address and profile photo, your push tokens and notifications, the matches you follow or have pinned, and — on tournaments you organise — your contact name and phone number and the captains’ phone numbers you added.

Kept: the scorecards of matches you scored — scores, overs and the ball-by-ball record — along with the teams and squads in them, and the tournaments you organised. A match is shared by everyone who played in and followed it, so it is not erased when one person leaves. It is unlinked from you instead: your name no longer appears on it, nobody can edit it afterwards, and nothing ties it back to your account. Your name may still appear in a team line-up, because that was entered as part of the team rather than as part of your account.

Anonymised match data is kept for as long as the match record exists. Crash reports already sent to Firebase Crashlytics are anonymous and expire on Google’s own schedule.

10. Children's Privacy

CricStream is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal information, contact us and we will delete it promptly.

11. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

12. Changes to This Policy

We may update this policy from time to time. Continued use of the app after changes constitutes acceptance. The "last updated" date above will always reflect the most recent revision.

---