Jazba Privacy Policy

1. Information We Collect

2. How We Use Your Information

3. Authentication and Security

4. Information Sharing and Visibility

5. Social Login and YouTube (Google and Apple)

6. Data Retention

7. Data Security Measures

8. Your Privacy Rights

9. Mobile App Permissions

10. Cookies and Tracking

11. Children's Privacy

12. Updates to This Policy

13. Contact Us

Account Information:

• Full name
• Email address
• Phone number (required for player profiles and team contacts)
• Password (stored as a secure hash, never in plain text)
• Profile picture
• City/location

Approximate Location (Near You):

• If you allow location, we save your phone's approximate location, rounded on your phone to about 1 km, and the nearest city. It is saved for your account and player profile, and for a team when its manager taps "Use my current location"
• We read it when you tap "Use my location", and otherwise refresh it automatically at most once every 30 days while the app is open, only if you have already allowed location. Never in the background. If you don't allow location, we use the city you pick instead
• Used only to show you nearby matches, events, news, teams, players, and Board posts first, and to send Board notifications to people nearby. You can change it any time under Profile > My location

Player Profile Data:

• Playing position (e.g., goalkeeper, defender, forward)
• Preferred game formats (5-a-side, 7-a-side, 11-a-side)
• Profile photo
• Shirt number
• Date of birth (only if you complete age verification)
• A date of birth you enter yourself the first time you use the Community Board, used only to check whether you are 18 or older. It cannot be changed afterwards, and a verified date of birth replaces it
• Team affiliations and membership history
• Match statistics and performance data

Age Verification Documents:

• ID, passport, birth certificate, or school marksheet that you (or your team manager on your behalf) upload to verify your date of birth
• Reviewed by Jazba admins and by organizers of age-restricted events you enter
• Stored privately with our storage provider (no public link) and shown only to authorised reviewers through our own servers. Used only to verify age

Team and Event Data:

• Team names, logos, banners, and descriptions
• Event banners
• Event/tournament details you create or join
• Fixture schedules and match results
• Challenge requests and responses

Community Board (Posts) Data:

• Posts you create (template, positions, format, date and time, city, age group, and an approximate point about 1 km wide taken when you post)
• Responses you send or receive, and whether you contacted someone by WhatsApp
• Reports you make and users you block
• A record of whose contact details you viewed, used to enforce daily limits and investigate abuse

Organizer Application Data:

• Full name, email address, and contact number provided during organizer application
• We may ask for additional verification, for example an ID, by email or WhatsApp during review
• Optional message describing your organizing experience or plans
• Application status and review history
• Agreement acceptance to organizer terms and responsibilities

Authentication and Session Data:

• Access tokens (short-lived, 30 minutes)
• Refresh tokens (long-lived, 30 days, stored as secure hashes)
• Session identifiers
• Last activity timestamps
• Failed login attempt counts
• Account lockout status

Verification Data:

• One-Time Passwords (OTPs) for email verification and password reset (stored as hashes, expire after 5 minutes)
• Email verification status

Technical and Log Data:

• IP addresses
• Device information and browser type
• Device identifiers and a device fingerprint, IP address ranges, and risk signals used for fraud prevention
• Push notification token
• Request timestamps and URLs
• App session events (app opened, moved to background or foreground, session length), app version, and device-integrity signals (for example a rooted or emulated device)
• Your 10 most recent IP addresses, kept on your account to detect account takeover
• Error logs and crash reports for debugging, linked to your account ID

We use your information to:

• Provide our services: Create and manage your account, display your player/team profiles, facilitate team memberships, organize events and fixtures.
• Authenticate and secure: Verify your identity, manage login sessions, detect unauthorized access, prevent fraud.
• Enable communication: Send team invites, challenge requests, event notifications, and important account updates.
• Improve our platform: Analyze usage patterns, fix bugs, develop new features.
• Ensure safety: Enforce our terms, investigate violations, protect users from abuse.
• Process organizer applications: Review and verify organizer applications, assess eligibility, and communicate application status updates.
• Promote Jazba: Use Public Content in our marketing and advertising, as described in Section 4.
• Prevent fraud: Use device and network signals to detect abuse and duplicate accounts.
• Show what's near you: Put nearby matches, events, news, teams, players, and Board posts first, and send Board notifications to people nearby, using your approximate location or the city you chose.

Our platform implements several security measures:

• Password Security: Passwords are hashed using bcrypt with secure salt rounds. We never store plain-text passwords. Minimum requirements: 6 characters, uppercase, lowercase, number.
• Token-Based Authentication: We use JWT tokens with short-lived access tokens (30 minutes) and longer-lived refresh tokens (30 days) with automatic rotation.
• Session Management: Sessions are tracked server-side. You can log out from all devices. Inactive sessions expire automatically.
• Account Lockout: After multiple failed login attempts, accounts are temporarily locked to prevent brute-force attacks.
• Rate Limiting: API requests are rate-limited to prevent abuse. Authentication endpoints have stricter limits.
• Token Reuse Detection: If a refresh token is reused (potential token theft), all sessions for that user are invalidated.

Public Information:

The following information is visible to other users of the platform:

• Your player profile (name, position, city, profile picture)
• Teams you belong to (if the team is published), including the team logo and banner
• Roster names and photos of players on published teams
• Events and fixtures you participate in
• Match results and statistics
• The name and photo of a team manager or organizer shown on shared invite links
• Community Board posts, teams and players with the city and an approximate distance (for example "Lahore, 3 km"). We never show anyone's location or coordinates. The distance to a user under 18 is never shown to others or used to find them

Public pages on jazbaapp.com can be viewed and indexed by search engines without an account.

Private Information:

The following is NOT shared with other users:

• Email address
• Password
• Authentication tokens
• Account security settings
• Age verification documents (visible only to Jazba admins, event organizers where age verification applies, and you)

Limited Sharing:

Your phone number is visible to your teammates. Organizers and team managers can use in-app contact features (for example WhatsApp) to reach players and teams, limited to 3 contacts per day.

On the Community Board ("Posts" in the app), "Let people WhatsApp me" is on by default for every post, and you can turn it off before posting. While it is on, a signed-in adult (18 or older) who taps WhatsApp on your post receives your number (your team's contact number for team posts) in WhatsApp, and you are told who is messaging you. When you accept someone's response to your post, you and they can each see the other's phone number (a team's contact number for team responses), even with WhatsApp off. Each user can view up to 8 Board contacts per day. Users under 18 cannot post, respond, or contact anyone through the Board; youth team posts are answered by parents or guardians. You can report any post and block any user, which hides their posts and stops contact through the Board in both directions. Every report is sent to our team for review, and a post is closed automatically after several reports. We keep a record of Board contacts to investigate abuse until your account is deleted.

Admin Access:

Platform administrators can view user accounts, teams, and events for moderation purposes. Admins can block accounts, restrict content visibility, and manage platform integrity. Admin actions are logged.

Promotional Use of Public Content:

"Public Content" means the information above that is visible to other users or to the public, such as team names, logos, and banners; player names, profile pictures, positions, and match statistics; and event names, banners, fixtures, results, and standings. Jazba may use Public Content, including posts, cards, and news generated from it, in its own marketing and advertising on our website, app store listings, social media, paid advertising, email, push notifications, and press or partner materials. Our Terms of Service contain the full license.

• We never use your email address, phone number, password, ID or age-verification documents, or date of birth for marketing
• We do not use an identifiable profile photo of a player under 18 in paid advertising or standalone promotional posts without the consent of a parent or guardian
• To stop promotional use of your content, email jazbapp@gmail.com with the subject "Promotional use request". We cannot recall copies already published or shared by others

Third-Party Sharing:

We do not sell your personal information. We may share data with service providers who help us operate the platform:

• Hostinger (the servers that run the Jazba API and database, located in India)
• Cloudflare (website delivery and R2 storage for profile photos and team logos)
• Cloudinary (image hosting, private storage of age-verification documents, and automated image processing, including background removal on team logos)
• Firebase (push notifications, crash reporting, and remote configuration)
• Google Analytics on our website (with IP anonymization)
• Resend (email delivery for verification and notifications)
• Expo (delivery of app updates)
• Google and Apple (sign-in)
• Google (YouTube), if you connect a channel to stream matches
• Google Play Integrity and Apple App Attest (device integrity checks)
• Social media platforms and WhatsApp, where Jazba publishes promotional content or where you choose to share
• Law enforcement (if required by valid legal process)

Some of these providers process data outside Pakistan.

You can register and log in using your Google account. When you do, we receive:

• Your Google account ID
• Email address
• Display name
• Profile picture URL

We use this information to create or link your Jazba account. Signing in with Google does not give us access to your Google contacts, calendar, or other Google services. The only other Google access Jazba asks for is YouTube, and only if you choose to connect a channel (see below). Google Sign-In accounts are automatically verified (no email OTP required).

On iOS you can also sign in with Apple. In that case we receive the identifier, email address (which may be an Apple private relay address), and name that Apple shares with us.

YouTube live streaming

Organisers can stream a match live to their own YouTube channel from the Jazba app. This feature uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to your use of YouTube. Connecting a channel is optional and separate from how you sign in.

• What we access:Google asks you to let Jazba manage your YouTube account, because live streaming needs that permission. We use it only to read the connected channel's ID, name, and picture, and to create, start, end, and check the status of the live broadcasts and streams we make for your matches. If setting up a stream fails, we delete the broadcast or stream Jazba just created. We do not read, change, or delete your other videos, playlists, comments, subscriptions, or viewing history.
• What we store:an encrypted refresh token, the permissions you granted, the channel ID, name, and picture, and for each streamed match the broadcast and stream IDs, watch link, privacy setting, and start and end times. We may show a match's watch link on its match page.
• What we share: we do not sell YouTube data, share it with third parties, or use it for advertising.
• Limited Use:Jazba's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Removing access: tap Disconnect in the app, which revokes our access with Google and deletes the stored token. You can also remove Jazba at any time from your Google Account permissions. Deleting your Jazba account does both automatically.

• Account Data: Retained while your account is active. Deleted upon account deletion request.
• Approximate Location:We keep your latest saved location (each update replaces the previous one) on your account and player profile, a team's location on the team, and the approximate point stored with each Board post. Your location is deleted when you delete your account, a team's when the team is deleted, and a post's when the post or your account is deleted.
• Authentication Tokens: Access tokens expire after 30 minutes. Refresh tokens expire after 30 days or upon logout.
• OTPs: Expire after 5 minutes and are deleted automatically.
• YouTube Connection: Kept until you disconnect it or delete your account. Our access is then revoked with Google and the stored token is deleted.
• Community Board: Posts, responses, reports, blocks, and the contact record are kept until the post is removed or your account is deleted.
• Session Data: Cleared on logout or after inactivity timeout.
• Logs: Security, device, and error logs are retained for as long as reasonably necessary for debugging, security, fraud prevention, and legal compliance.
• Blocked Accounts: If your account is blocked for violations, we may retain minimal identifying information to prevent re-registration.
• Published Content: Promotional materials already published remain in circulation (see Section 4). Teams and events you created may remain after your account is deleted, without your name as manager.

We implement industry-standard security practices:

• HTTPS encryption for all data in transit
• Secure password hashing (bcrypt)
• Token-based authentication with rotation
• CORS restrictions to prevent unauthorized API access
• Security headers (Helmet.js) to prevent common attacks
• Rate limiting to prevent abuse
• Input validation to prevent injection attacks

While we take security seriously, no system is 100% secure. We encourage you to use a strong, unique password and enable any additional security features we offer.

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correct: Update inaccurate or incomplete information in your profile.
• Delete: Delete your account and associated data from the app or the delete-user page. Accounts with no player profile, managed team, or organizer role are deleted immediately. Otherwise you send a deletion request (with a short reason), our team handles it, and the account is deleted within 30 days.
• Object to promotional use:Ask us to stop using your public content in our marketing by emailing us with the subject "Promotional use request" (see Section 4).
• Control your location:Change your saved location any time under Profile > My location, or turn off location for Jazba in your phone settings and pick a city instead.
• Logout Everywhere: Invalidate all active sessions from your account settings.
• Withdraw Consent: Stop using our services at any time.

To exercise these rights, contact us at jazbapp@gmail.com.

Our mobile app may request the following permissions:

• Camera: To take profile pictures, team logos, banners, or event photos, and to film a match you stream live or record.
• Microphone: To capture match audio when you stream live or record a match.
• Photo Library: To select existing images for your profile, and to save match recordings to your device.
• Approximate Location:To show nearby matches, events, teams, and players first. When you tap "Use my location", your city also switches to the city you are in. Approximate only (about 1 km), read while the app is open, never in the background. City locations come from GeoNames (CC BY 4.0).
• Push Notifications: To receive team invites, challenge notifications, and match updates. You can disable this anytime.

All permissions are optional and can be managed in your device settings.

Our web services use cookies and local storage for:

• Authentication (storing tokens securely)
• Session management
• Remembering your preferences

Our website uses Google Analytics to understand traffic and improve our pages. We enable IP anonymization. You can block analytics cookies in your browser settings or use Google's opt-out browser add-on.

We do not use third-party advertising or retargeting cookies. We do not currently respond to Do-Not-Track browser signals as there is no universal standard.

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information should contact us.

Users under 18 must have the permission of a parent or guardian to use our services. Some events are restricted by age category, so a player, parent, or team manager may upload documents such as a birth certificate or school marksheet. We use these documents only to check date of birth, and we do not use them for marketing. Parents and guardians can contact us to correct or delete a child's data.

We do not use an identifiable profile photo of a player under 18 in paid advertising or standalone promotional posts without the consent of a parent or guardian (see Section 4).

On the Community Board, we ask for a date of birth once to check age. Users under 18 can browse but cannot post, respond, or contact anyone, and their location or distance is never shown or searchable. Read our Child Safety Standards.

If you have questions about this Privacy Policy or your data, contact us:

Email: jazbapp@gmail.com

Website: jazbaapp.com

Mailing Address:
Jazba (Jazba Sports)
G-13, Islamabad
Islamabad Capital Territory
Pakistan, 44100