This policy applies to the CricOrbit mobile application ("CricOrbit", "we", "us", "our") and to the live-score pages we serve for shared matches. CricOrbit is a cricket scoring app: you record a match ball by ball, and you can share a link so other people can follow the score.
By using CricOrbit you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the application.
In short. We collect what is needed to sign you in, save your matches and run subscriptions, plus usage analytics that help us improve the app. Analytics events record what you did (for example "match created" or "delivery recorded") — never anything you typed: no names, venues, phone numbers, email addresses or codes. There is no advertising, no crash reporting and no tracking across other apps or websites, and the only Android permission the app requests is internet access. We do not sell your data.
1Information we collect
Account information
What we hold depends on how you sign in:
- Email sign-up — your email address, a username you choose, and a password. The password is stored only as a salted hash by our authentication provider; we never see it.
- Phone sign-in — your phone number is sent to Google Firebase so it can deliver the one-time SMS code. Your number is not stored in our database: the account is keyed on a synthetic, unroutable address derived from the Firebase account identifier.
- Google sign-in — the email address and basic profile that Google returns for the account you pick.
Cricket data you enter
- Team names, and the names of players you add to a team.
- Match details: venue, date, number of overs, and format settings.
- Ball-by-ball scoring: runs, wickets, extras, and the scorecard produced from them.
A player record can technically hold a date of birth and a photo. CricOrbit collects neither — no screen asks for them and there is no upload feature. Only a player's name is sent.
Subscription information
If you subscribe to Pro, the purchase is handled by Google Play and validated through RevenueCat. We receive the subscription's status, the product, its renewal or expiry date, and an identifier linking it to your account. We never receive your card or payment details — those stay with Google. RevenueCat also collects device and usage information of its own; see the table in section 4.
Stored on your device only
- Guest mode matches are saved in a local database on the phone. They are never uploaded, and uninstalling the app deletes them permanently — we cannot recover them.
- Your sign-in session, your settings (light or dark theme, and whether new matches start public), and a flag recording that you have seen the intro screens.
Usage analytics
The app sends usage events to PostHog, our product-analytics provider, so we can see which features are used and where people get stuck — for example, that a match was created, a delivery was recorded, the paywall was opened, or a sign-in failed. Events are tagged with:
- your account's internal identifier when you are signed in, or a random identifier stored on the device when you are not;
- non-identifying details of the action, such as a match's internal ID, the number of overs, the runs on a ball, or which sign-in method was chosen;
- basic device and app information PostHog collects automatically — device model, operating system and app version, language and screen size — and an approximate location (country or city) that PostHog may derive from your IP address.
We deliberately never send anything you type: no player or team names, venues, email addresses, phone numbers, passwords or sign-in codes. When you sign out, the identifier is reset so later activity on the same phone is not linked to your account. Guest-mode activity is counted the same way, but the match itself still never leaves your phone.
2What we do not collect
- No crash reporting, and no tracking across other companies' apps or websites.
- No advertising, ad identifiers or profiling. There are no ads in CricOrbit.
- Nothing you type is sent to our analytics provider (see "Usage analytics" above).
- No location, contacts, camera, microphone, photos or files. The app requests
INTERNETand nothing else. - We do not sell or rent personal information, and we do not share it for advertising.
3Who can see your matches
This is worth reading carefully, because you control it and it is easy to skim past.
| Setting | Who can see it |
|---|---|
| Private (the default, unless you turn on "public by default" in Settings) | Only you. The match is not listed to any other user of the app. |
| Public | Listed to every signed-in CricOrbit user while it is in progress. They can watch the score and scorecard; only you can score it. |
| Share link / QR | Anyone who has the link, including people with no account and no app. This works for private matches too. |
A share link is public. Marking a match private keeps it out of other users' lists; it does not disable a link you have already shared. The link contains a long random match identifier that cannot be guessed, but anyone you send it to can pass it on, and anyone holding it can see the live score, the scorecard, and the player names in that match. Share it the way you would share any public link.
Names of other people
A scoring app is inherently about other people: to score a match you type in the players' names. Those names are stored on our servers and are visible to anyone who can see that match, including through a share link.
Please only enter names you are entitled to share, use the form people are happy to be listed under, and keep a match private if in doubt. If you are scoring junior cricket, take particular care — see section 7.
4Why we process it, and who we share it with
- To provide the app — creating your account, saving matches, showing scorecards. Necessary to perform the service you asked for.
- To run subscriptions — checking whether an account is entitled to Pro and enforcing the free-match allowance.
- To keep accounts secure — verifying sign-in codes and preventing abuse.
- To improve the app — understanding, from usage analytics, which features are used and where people run into problems.
Where the GDPR applies, our lawful bases are performance of a contract and our legitimate interest in operating, securing and improving the service. We do not rely on consent for advertising, because we do none.
We share data only with the service providers that make the app work. Each processes it on our instructions.
| Provider | Purpose | Their policy |
|---|---|---|
| Supabase | Database, authentication and server functions | supabase.com/privacy |
| Google Firebase | Delivering one-time SMS codes for phone sign-in | firebase.google.com/support/privacy |
| Google Sign-In / Google Play | Optional sign-in, and subscription billing | policies.google.com/privacy |
| RevenueCat | Validating purchases and subscription status | revenuecat.com/privacy |
| PostHog | Product usage analytics (hosted in the United States) | posthog.com/privacy |
We may also disclose information where the law requires it, or to protect the rights and safety of our users. We will not do so merely because we are asked.
Our database is hosted in the Asia-Pacific (Singapore) region. Our providers operate globally, so your data may be processed in other countries under their own safeguards.
5How long we keep it
- Account and match data — for as long as your account exists.
- Usage analytics — kept by PostHog for as long as they are useful to us for understanding how the app is used. We delete the analytics linked to your account on request.
- Subscription and billing records — retained while a subscription is active, and afterwards for the period required by accounting, tax and fraud-prevention obligations.
- Guest matches — until you delete them or uninstall the app. They are on your phone only.
6Your rights and choices
- Access or correct your data — most of it is editable in the app.
- Delete your account and everything attached to it, directly in the app under Settings — see Delete Your Account.
- Export your scorecards as PDFs from Settings (a Pro feature), or ask us by email for a copy of all the data we hold about you.
- Make a match private at any time, which removes it from other users' lists.
- Withdraw a share link — contact us if a link needs to stop working.
Depending on where you live you may also have the right to object to or restrict processing, and to complain to your local data protection authority. Subscriptions are cancelled through Google Play, not through us.
7Children
CricOrbit is not directed at children under 13, and we do not knowingly create accounts for them.
We recognise that junior cricket is scored by adults who enter children's names as players. If you do this, you are responsible for having the permission of a parent or guardian, and we strongly recommend keeping such matches private. If you believe a child's information has been entered without appropriate consent, contact us and we will remove it.
8Security
- All traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
- Database access is restricted per account by row-level security, so one account cannot read another's data.
- Subscription entitlement is decided on our server after validation with the store — never by the app on your phone.
- Scoring a match is restricted to the account that created it.
No system is perfectly secure and we do not claim otherwise. If you find a vulnerability, please report it to the address below rather than disclosing it publicly, and we will work with you.
9This page
This page loads no fonts, scripts, analytics or images from anywhere else, and sets no cookies. Reading it tells us nothing about you beyond the standard server logs kept by GitHub Pages, which hosts it.
10Changes
If we change this policy we will update the date at the top. Material changes affecting how we use your data will be announced in the app before they take effect.
11Contact
Questions, data requests, account deletion or security reports:
info@tsolutions-dwc.com