Privacy Policy

01 Who we are

Scrimfield is a mobile app for finding casual, in-person sport. It's run by Scrimfield, based in Nepal — that's who “we,” “us,” and “Scrimfield” mean throughout this page, and who's responsible for the personal data described here. Got a question or a request? scrimfield@gmail.com.

02 Information we collect

You give us

• At signup: your name, a username, your email, your main sport, date of birth, and your home location — we need that last one to finish setting up your account (more in section 3).
• If you sign in with Google instead: just your name and email from them. Nothing more.
• Whenever you feel like it: a profile photo, a short bio, a preferred position, or any venue listings you post.
• If you email us: whatever you wrote, plus your address so we can reply.

We collect as you use the app

• One more location reading, separate from your home location, when you scan a match's QR code to confirm you showed up (section 3 again).
• Your live location and which way you're facing — but only if you've turned on live location sharing for that match (section 3).
• The matches, guilds, guild battles, chats, and reviews you're part of. Your attendance and no-show record. Your XP, level, quests, and stats.
• Whatever reviews other players at the same match write about you.
• The basic technical stuff needed to keep the service running and safe: your IP address, what kind of device and OS you're on, your app version, and some app-integrity signals (that's the reCAPTCHA / App Check bit — more in section 5). Your device's advertising identifier is only used if you choose to watch a rewarded ad (see Google AdMob in section 5); we don't touch it otherwise. The app does send crash reports and, for adults who haven't switched it off, anonymous usage counts — see the Firebase services in section 5.

03 Location data

Location matters enough to this app that it gets its own section instead of hiding in a list above. There are three separate things we do with it:

• Home location, saved at signup. This is how we match you with nearby games and work out your rough distance to venues and other adult users. Nobody else ever sees your exact coordinates or a pin on a map from this — Players Near You rounds it to the nearest 5 km, and what we send our weather provider is rounded to about 1 km.
• Attendance scan, one time only. Scanning a match's QR code reads your device location once, just to confirm you were actually there. It gets deleted along with the rest of that match's data about a day later.
• Live location sharing, opt-in and temporary. For a window around a match, or a guild battle, there's a toggle that broadcasts your current position, which way you're facing, and your username to whoever else in that match has also turned it on, so you can actually find each other near the venue. It's off unless you turn it on, you choose that fresh each time, you can switch it off whenever, and it shuts itself off the moment the window closes. Nobody outside that match sees it, and none of it is kept once the window ends.

If you're under 18, Players Near You isn't part of your app at all — you can't turn it on, and you never show up in anyone else's results. If you're an adult, there's a switch for it in Settings: flip it off and the trade is even, you stop seeing other players' distances the same moment you stop appearing in theirs.

04 How we use it, and our legal bases

Mostly, your data runs the app: matching you with nearby, age-appropriate games, checking who showed up, running guilds, reviews, and messages between people who've friended each other. Where data-protection law wants us to name a specific legal basis for each purpose, here's the table:

We don't use your profile, messages, or location to target advertising, and we don't sell anything that identifies you. The only ads in the app are the optional rewarded ones described in section 5.

05 Who we share data with

We only ever share what a feature genuinely can't work without, plus aggregated numbers nobody can trace back to a person. Every recipient gets named here, not hidden behind a general “partners” clause.

• Firebase and Google Cloud (Google). Our hosting, database, login system, and file storage — everything in section 2 lives on their servers.
• Firebase Cloud Messaging, Crashlytics and Analytics (Google), in the phone app only. Cloud Messaging delivers push notifications: it holds a device token tied to your account, and switching push off in Settings deletes that token. Crashlytics receives crash and error reports — the error itself, your device model and OS version, and your account ID so we can reproduce a bug; never your messages, name, or location. Analytics counts coarse in-app events (which screens get opened, that a match was joined) with no names, text, or locations in them. Analytics is never collected for anyone under 18, and adults can switch it off in Settings under “Notifications & privacy.”
• Google AdMob, in the phone app only, and only if you tap “Watch ad” to earn coins. Google serves the ad and receives what any ad request involves: your device's advertising identifier, device and OS details, and an approximate location taken from your IP address. We also give it your account ID and a one-time code so that, when you finish the ad, Google can confirm to us that you watched it and we can credit your coins. We never send it your name, email, messages, profile, or exact location. Where the law requires it (for example in the EEA and UK) you're asked for consent first. If you're under 18, we tell Google the request comes from a minor: no personalised or interest-based ads, and a teen content-rating cap. Nobody has to watch ads, since coins can also be earned from daily quests. Google's own Privacy Policy governs what it does with ad data.
• Google reCAPTCHA Enterprise and the platform's own app-attestation services (Apple App Attest, Google Play Integrity). These get device and usage signals to confirm a request is really coming from an unmodified copy of the app, not a bot or a tampered client. Google's own Privacy Policy governs what it does with reCAPTCHA data.
• Google, again, but only if you sign in with it — just your name and email, to set up the account. Nothing else goes to them, and we never tell them what you do inside the app.
• OpenStreetMap's Nominatim service. It sees your coordinates exactly once, at signup, so we can turn them into a place name like “Kathmandu” before we save anything. It never gets your name or your profile.
• An OSRM routing server, which sees your live location and a venue's coordinates while the directions screen is open, purely to work out the route.
• Esri draws the map, and Mapbox takes over if Esri's service is unavailable. They get the requests for the patch of map on your screen, plus your IP address like any web request, not your identity or exact location.
• Open-Meteo, our weather provider. It only ever gets a location rounded to about a kilometre, never exact, to return the forecast on your home screen and on match or venue cards. It doesn't know your name or your account.
• Other users, as covered in section 6, plus your live location during a match window if you've opted into sharing it.
• Whatever replaces any of the above. If we swap in a different map, geocoding, routing, weather, or attestation provider doing the same job, this paragraph already covers it — we won't send a separate announcement every time.
• Authorities, if the law requires it, or if we genuinely believe it's necessary to prevent serious harm.
• A buyer, in the event Scrimfield is ever sold or merged — your data would transfer to whoever takes over, still bound by this same policy, and we'd tell you before it happened.

Aggregated statistics

We might also publish, or hand to outside groups like venues, sports bodies, or city recreation programmes, aggregated numbers that have been stripped of anything identifying — how many players in a city play a given sport, say, or which nights fill up fastest. That never includes your profile, your name, your messages, or your exact location; it's rolled up across enough people that no individual comes back out of it. Data from anyone under 18 doesn't go into these numbers at all. And again: we don't sell anything that identifies you. If we ever bring in a genuinely new kind of recipient, we'll name it here.

06 What other users can see about you

What's visible: your name, username, sport, position, bio, photo, your level/XP/wins/matches-played, your verified-attendance rate, which guild you're in, reviews written about you, your rough Players Near You distance if you're an adult, and — only while it's switched on for a match — your live position, heading, and username to the other players who opted in with you.

What's never visible: your date of birth, exact coordinates, email, phone or other contact details, attendance-scan locations, or a detailed history of every match you've played.

07 Where your data is processed

Scrimfield runs on Google Cloud and Firebase, so depending on how Google's regions are configured, your data may sit on servers outside Nepal, including in the United States. If you're in the UK, the EEA, or Switzerland and your data leaves those regions, that transfer relies on Google's own Data Processing Addendum and Standard Contractual Clauses. Our Firestore database and Cloud Functions run in Mumbai, India (Google Cloud region asia-south1).

08 How long we keep it

• Match details, match chat, attendance-scan locations — gone automatically about a day after the match.
• Live location shared during a match — not kept once the sharing window closes.
• Your profile and account data — kept while your account exists, removed when you delete it (section 10).
• Direct messages and reviews — around until you, the other person, or account deletion removes them.
• Attendance and no-show history — kept while your account's active, since it's what powers no-show limits and your verified-attendance rate. We keep it for as long as the account exists, because the no-show limits and the verified-attendance rate are meaningless without the history behind them, and it is removed when you delete your account.
• Support emails — kept for up to 24 months, then deleted.
• Anything we're legally required to keep, like a parental-consent record — for as long as the law says we have to.

09 Your rights and choices

Here's what's actually available to you:

• Access — ask for a copy of the personal data we hold on you.
• Correct — fix anything that's wrong. Most of it you can edit straight from Settings; email us for whatever you can't.
• Export — get your data out in a portable format.
• Delete — your account and everything with it (section 10).
• Object — to anything we're doing on a legitimate-interest basis, Players Near You included.
• Withdraw consent — for anything you've opted into, turning off live location sharing, for instance.
• Complain — to your local data-protection authority, if you're somewhere that has one. The UK and EEA both do.

To use any of these, email scrimfield@gmail.com from the address on your account. We aim to get back to you within 30 days, and asking costs you nothing and changes nothing about how we treat you.

10 Deleting your account

Delete your account any time, right from Settings, and it actually goes: your profile, date of birth, stored location, username, login, photo, every DM thread, the reviews and venue comments you wrote, any venues you posted. You come out of every attendance record, your guild spot frees up, and live location sharing ends immediately. Reviews other people wrote about you go too. Give it a little while to fully clear. You can also ask for deletion by email without opening the app, and the steps are on our delete your account page.

Two things stay on purpose: abuse reports you filed, kept as a safety record, and any aggregated stats we'd already produced (section 5), which never had your name attached in the first place.

11 Users aged 13–17

You need to be at least 13 to use Scrimfield. Between 13 and 17, a parent or guardian has to give consent during signup, and we keep a record that it happened. It's a consent record, not identity verification — there's genuinely no way to confirm online that it was actually a parent who filled it in, and we're not going to pretend there is.

Under-18 accounts collect the same data as adult ones, because the core matching and attendance features don't work without it. What's different is how that data gets used: no Players Near You, in either direction; nothing from a minor ever ends up in the aggregated statistics in section 5; and the same “never visible” list in section 6 applies to them too.

A parent or guardian can reach scrimfield@gmail.com any time to look at, fix, or delete their child's data, or to pull consent altogether — which closes the account.

12 Security and data breaches

We rely on the access controls, database rules, encrypted transport, and app-integrity checks the platform gives us, and we keep production data access tightly limited. No system is unbreakable, though. If a breach ever puts your personal data at real risk, we'll tell you, and tell the relevant authority too if the law requires it, without sitting on it.

13 Cookies, local storage and fonts

This website doesn't use cookies, analytics or advertising trackers, and it loads its fonts from its own server, so your browser isn't sending anything to a font provider. Our host, Cloudflare, sees the usual details of a web request (IP address, browser) in its server logs. The one exception is the page that opens when you tap a link in a verification or password-reset email: it loads Firebase's sign-in code from Google.

The app keeps some things on your device so it can work: your sign-in session, your language, which screens you've already seen, whether you accepted these terms, cached lists and map settings, and an installation ID that Firebase uses. That stays on your phone, apart from what's described in section 5, and clearing the app's storage or uninstalling it removes it. The first-run welcome screen loads a font from Google Fonts, which sees your IP address like any other web request.

14 Changes to this policy

The “Last updated” date at the top moves whenever this policy changes. If a change actually matters — a new kind of data, a new recipient, a new reason we're using something — we'll put it in front of you again inside the app before you can keep going.

15 Contact

Questions, a rights request, or anything else about this page: scrimfield@gmail.com. Based in Nepal.