Privacy Policy

Last updated: 26 September 2026  ·  Effective date: 26 September 2026

This Privacy Policy (the "Policy") describes how Zyvenxa Technologies Private Limited ("MyGully11", "we", "us", or "our") collects, uses, discloses, stores, and protects information when you use the MyGully11 mobile application (the "App"), our website at https://mygully11.com (the "Site"), and any related services we offer (collectively, the "Services").

By downloading, accessing, or using the Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Who We Are (Data Controller / Data Fiduciary)

The entity responsible for your personal data is:

• Legal entity: Zyvenxa Technologies Private Limited
• Registered address: Kerala, India 682308
• Country of incorporation: India
• Contact email (all enquiries, including privacy and grievances): support@mygully11.com

2. About the App and the Nature of the Data

MyGully11 is a cricket community app for fans and grassroots ("gully") cricket. It lets you create a player profile, follow other players, organise and join local cricket tournaments, record live match scoring and commentary, build fantasy cricket teams, make free match predictions, answer match availability requests, add match photos, share match cards, and view leaderboards and standings.

The personal data we handle is ordinary account, profile, and usage data. We do not intentionally collect "sensitive" or "special category" personal data (such as health, financial, biometric, religious, or political data). Please do not enter such information into free-text fields like your bio or bug reports.

3. Who May Use the App

The App is intended for users aged 13 years or older. If you are in the European Economic Area or the United Kingdom, you must be at least 16 — that is the highest age of digital consent across those countries, and we apply it uniformly rather than varying it country by country. If you are under 18 (or the age of majority in your jurisdiction), you may use the App only with the involvement and consent of a parent or legal guardian. The App is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@mygully11.com and we will take appropriate steps to delete it.

4. Information We Collect

4.1 Information you provide directly

• Account & sign-in: the identifier you sign in with, and the one-time code you enter to prove it is yours. Which identifier that is depends on where you are:
  • In India: your mobile phone number, verified by a one-time password (OTP) sent to you by SMS.
  • Outside India: your email address, verified by a one-time code sent to that address. For these accounts the email address is the account identifier, and no phone number is collected at all.
  An account that signs in by phone may also add an email address and verify it with a code; an account that signs in by email cannot change that address from inside the App, because it is the credential the account is reached by. We also keep a short-lived record of each code request (the identifier, the time, and whether the code was used) so we can expire codes, stop them being reused, and rate-limit requests.
• Profile details: display name, email address (optional for phone accounts, and the sign-in identifier for accounts outside India — see above), profile photo, location (e.g. your city/area), short bio, and your cricket attributes (playing role, batting style, bowling style, player type).
• Cricket activity: tournaments you create or join, teams and squads, match scoring events and commentary you record as a scorer, fantasy teams you build (player selections, captain/vice-captain), the fantasy mini-leagues you create or join, the department an organiser places you in (or you choose) within a tournament, if you were in a tournament's player auction, which team bought you and for how much, and your follows of other players.
• Contacts you choose to invite: when an organiser/captain invites players to a tournament, the App lets you pick people from your device's contacts. Only the contacts you explicitly select (their name and phone number) are sent to us to create or invite those players. We do not upload or store your entire address book, and we do not use your contacts for advertising. See Section 7.
• Tournament invite links: sharing a tournament creates a link (mygully11.com/j/<code>) rather than a code someone has to type in. Anyone who opens that link — including someone without a MyGully11 account — can see the tournament's details and the display name of whoever organised it, so they know what they are being invited to before signing in. It does not reveal the organiser's contact details, the participant list, or any fantasy or team data.
• Match links and share cards: sharing a match creates a link (mygully11.com/m/<id>) that anyone can open, even without an account, to see the fixture and headline score; the ball-by-ball scorecard stays behind sign-in. Share cards are images the App creates on your phone from match data (for example a result, Player of the Match, fantasy result or milestone) and can show other participants' names, photos and performance. They are only sent where you choose to share or save them.
• Match photos: photos you add to a match's gallery. The App resizes each photo on your phone, and our server removes embedded metadata — including GPS location, camera details and comments — before anything is stored. We record who added the photo and which match it belongs to. Match photos are visible to any signed-in user (Section 17). If you report a photo, we record that you reported it and the reason you gave.
• Availability (RSVP): when an organiser asks who can play a match, your answer and when you gave it, and when you were last reminded. Your answer is visible to the tournament's organisers and scorers and to your own team's captain and vice-captain; your teammates see only totals, and the opposing team sees nothing. If the organiser turns on the setting that shares availability with fantasy, everyone building a fantasy team for that match can also see whether you said you are available.
• Match predictions: your answers to a match's prediction questions and the points they earn. Until predictions lock, only you can see your answers; afterwards other participants see totals of how everyone answered, not who answered what. Your display name and points appear on the prediction leaderboard.
• Fantasy team name: the name you choose for your fantasy teams, shown to other participants with your team and on leaderboards.
• Slack and Microsoft Teams posts: an organiser can connect a tournament to a Slack or Microsoft Teams channel of their choosing. We then post tournament updates there — playing XIs, scores, results, Player of the Match, fantasy tables and auction squads — which include participants' display names, profile photos and team logos. We store the channel's webhook address encrypted and do not read anything back from the channel. Who can see the channel is decided by whoever runs that workspace, not by us.
• Public tournament links: these can be opened by anyone who has the link, without signing in, and ask search engines not to index them:
  • Auction big screen (mygully11.com/auction/<code>): shows the players in an organiser's auction — their names, profile photos and roles, the bids, which team bought them and for how much, and the teams' squads. It does not show phone numbers, email addresses or the tournament's join code. The organiser can reset the link.
  • Season report (mygully11.com/report/<token>): for tournaments on the Pro plan, the organiser can share a report of the season, which names participants and shows their departments, participation, awards and highlights. The organiser can also download it as a PDF, which can include photos from the match galleries, along with a participation certificate for each person who took part. The organiser can revoke the link. An account that has been deleted is counted in the report's totals but never named.
  • Certificate link (mygully11.com/certificate/<token>): if you took part in such a tournament, you can create a public link to your own certificate, showing your name, department, the tournament and your season highlight, for example to add to LinkedIn. Only you can create it, and you can remove it.
  We count how many times each link is opened. To count one visitor once, the IP address and browser type of each visit are held in memory for 30 minutes and are never stored.
• Calendar feed: if you use Add to calendar, we give you a private link that contains a random token. It serves your tournaments' fixtures (teams, ground, time and tournament name) to your calendar app, and you can reset it. See Section 7.
• Support & bug reports: when you submit an in-app bug report or contact support, we receive your description, the bug category, and basic device context (platform, OS version, app version, device model), plus your email and message contents if you email us.
• Account-deletion requests: if you request account deletion, we record the request, its status, and any reason you provide.
• Organiser plan purchases: if you upgrade a tournament to a paid plan, we record which tournament and plan you bought, the store you bought it through (Apple or Google), the store's transaction identifier, the product identifier, whether the purchase was made in the live or sandbox environment, and the resulting entitlement. We never receive or store your card number, bank details, UPI ID, or any other payment instrument — Apple and Google process the payment and share only the confirmation described here. See Section 4.4.
• Sales enquiries: if you contact us about a Season Pass or a Custom plan, we record the plan you enquired about, your message, and the contact email and phone number you give us.

4.2 Information collected automatically

• Device & technical data: device model, operating system and version, app version and build, language, region, time zone, a device identifier, crash logs, diagnostic logs, and performance metrics.
• Usage data: features used, screens viewed, taps, navigation paths, session duration, and in-app events (see Microsoft Clarity and Firebase Analytics in Section 6).
• Push notification token: a Firebase Cloud Messaging device token (and platform) so we can deliver match, tournament, and service notifications.
• IP address and approximate location: we keep the IP address your account was created from, and the IP address and time of your most recent sign-in, against your account so our staff can investigate abuse, fraud and account-security problems and help with support requests. We do not use it to decide whether you can sign in. Our providers may derive an approximate location from your IP address (Section 6). We do not collect precise GPS location.
• Attribution data: how the App came to be installed on your device, which we store with your account when you sign up: whether it followed one of our links or campaigns or not, and if so the source and campaign (for example "invite", "friend's share", "website", or an ad campaign's name), the invite the link carried, when the link was tapped and the App installed, and AppsFlyer's identifier for the installation. See AppsFlyer in Section 6. The advertising ID is never used for this.
• Advertising data (free-tier tournaments only): when the App requests an ad, the Google Mobile Ads SDK sends Google your device's advertising identifier (the Android Advertising ID, or Apple's identifier for advertisers where one is available), IP address, device and app information, and coarse location derived from that IP address, so that an ad can be selected and measured. Every ad request the App makes is marked non-personalised, so this data is not used to build an interest profile of you or to target you across other apps and websites; it is used to fill the ad slot, cap how often you see ads, and detect invalid traffic. We separately record that an ad was shown, and which moment in the App triggered it, as an analytics event. The App also keeps counters on your device — ads shown in this match, this session and today — purely to enforce the frequency limits described in Section 5; those counters never leave your phone.
• Ad-consent status: where Google's User Messaging Platform asks for your consent to ads (see Section 12), your answer is stored on your device by that framework and shared with Google.
• Sponsor banner metrics: when a tournament displays an organiser's sponsor banner, we count that it was shown and whether it was tapped. These counts are stored in aggregate per sponsor, per placement, per day — they are not stored against your identity, and sponsors never receive personal data about you. We separately keep a short-lived per-account counter purely to stop the counts being inflated by abuse; it is deleted after 7 days.

4.3 Information from third parties

• Apple App Store / Google Play: aggregate install, crash, and review metrics. Where you buy an organiser plan, we also receive the purchase confirmation and transaction identifier described in Section 4.1, and — from Google Play — notice that a purchase was later refunded or charged back, so we can withdraw the corresponding entitlement. On Android, the App also reads Google Play's install referrer: the tag on the store link that led to the install, such as the invite or campaign it came from.
• RevenueCat, Inc.: our purchase-verification provider. It validates receipts with Apple and Google and tells us which entitlement to grant, identifying you to us by your MyGully11 account identifier.
• OTP delivery providers: from MessageCentral, delivery status of the verification SMS sent to your phone number; from Amazon SES, delivery status of the sign-in email sent to your email address, including whether it bounced or was reported as spam, so that we stop sending to addresses that cannot receive mail.

4.4 What we do not collect

• We do not collect payment-card numbers, bank account details, UPI IDs, PAN, Aadhaar, or other KYC/financial identifiers. The App does contain optional paid organiser plans, but these are charged through the Apple App Store and Google Play, which handle the payment instrument entirely — it never reaches our servers. There are still no entry fees, deposits, withdrawals, wagering, or cash prizes anywhere in the App.
• We do not collect precise GPS location, your full contacts list, the contents of your calendars (see Section 7), microphone audio, or photo library content (other than a profile photo, logo, match photo or attachment you actively choose to upload). When you ask it to, the App saves share cards or match photos to your photo library; it does not read your library to do so.
• We do not sell your personal information for money.
• We do not request personalised or interest-based ads, build advertising profiles of our users, give any advertiser or ad network your account details, phone number, email or contacts, or allow anyone to track you across other companies' apps and websites.

5. How We Use Your Information (Purposes & Legal Bases)

We use personal data for the purposes below. Where the GDPR/UK GDPR applies, the corresponding legal bases are indicated.

Automated decision-making (GDPR Art. 22). We do not carry out solely automated decision-making — including profiling — that produces legal effects concerning you or similarly significantly affects you. Fantasy and prediction points, leaderboards, standings, Player of the Match, milestones and match analysis are calculated automatically from the scoring data users enter, and are informational only.

6. Third-Party Services and Processors

To deliver the Services, we share limited personal data with carefully selected third-party providers acting as our processors or as independent controllers. We require each provider to maintain appropriate security and confidentiality measures.

We do not authorise these providers to use your personal data for their own independent marketing purposes.

7. Contacts and Calendar Permissions

7.1 Contacts (tournament invites)

To make it easy to add players to a local tournament, the App can show your device contacts so you can pick people to invite. This feature is optional and only runs when you choose to invite players.

• We request contacts permission only at the moment you open the contact picker; you can decline and add players manually instead.
• Only the name and phone number of the contacts you explicitly select are sent to our server to create or invite those players. Your full address book is never uploaded.
• We use selected-contact data solely to create the tournament/player records you requested. We do not use it for advertising, profiling, or unsolicited messaging.
• You can revoke contacts permission at any time in your device settings.

7.2 Calendar (Add to calendar)

You can add one match, or all of a tournament's matches, to your calendar. This is optional.

• On Android, adding a tournament asks for calendar permission when you tap it. The App then writes the matches into your phone's primary calendar and keeps them up to date. It reads your list of calendars, only to choose one to write to, and the events it created itself. It does not read your other events, and nothing from your calendar is sent to us.
• On iPhone, and when subscribing from Google Calendar or Outlook, your calendar app fetches the fixtures from your private calendar feed link (Section 4.1). No calendar permission is needed.
• You can revoke calendar permission at any time in your device settings, and reset your calendar feed link in the App. Signing out removes the App's record of which tournaments it is syncing.

8. How We Store and Secure Your Data

8.1 Storage locations

• Our backend: our application server runs on Amazon Web Services in the Asia Pacific (Singapore) region (ap-southeast-1), and your account, profile and activity data are stored in a TiDB Cloud Serverless managed database, also in Singapore. API traffic reaches the server through Amazon CloudFront, a global edge network.
• Images you upload: profile photos, tournament or sponsor logos, and match photos are stored in a private Amazon S3 bucket in the Asia Pacific (Mumbai) region (ap-south-1), India, and served through CloudFront. The bucket blocks all public access; images are reachable only through their CloudFront address, which is not publicly listed but is not secret either — treat anything you upload as visible to anyone who has the link.
• On your device: authentication tokens are stored securely on your device (using platform secure storage/Keychain/Keystore), and some data is cached locally for performance.
• Our processors: limited operational data (push tokens, crash logs, analytics events, attribution data, and SMS- and email-delivery metadata) is processed by the providers listed in Section 6, which may store data in India, the United States, the European Union, or other jurisdictions.
• Website hosting: the Site at mygully11.com serves these legal pages and marketing content as static content.

8.2 International data transfers

This has changed. Our application server and database are now both located in Singapore; images you upload remain in India. If you are in India, this means your account and activity data is stored outside India. Indian law permits such transfers except to countries the Central Government has restricted by notification, and no such restriction currently applies to Singapore.

Where personal data is transferred outside your country of residence — including to Singapore (AWS, PingCAP), the United States (Google, Microsoft, Slack, RevenueCat, AppsFlyer), or other jurisdictions — we rely on appropriate safeguards such as:

• the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum for transfers from the EEA/UK;
• the EU–U.S. Data Privacy Framework (and the UK and Swiss extensions) for certified U.S. providers;
• adequacy decisions where applicable; and
• your consent, where consent is the lawful basis we rely on.

You may request a copy of the relevant safeguards by contacting us at support@mygully11.com.

8.3 Security measures

We implement administrative, technical, and physical safeguards designed to protect your information, including: encryption in transit (TLS) for every connection to our API and content delivery network, token-based authentication using short-lived access tokens and rotating per-device refresh tokens held in your device's secure storage (Keychain on iOS, Keystore on Android), with only a one-way hash of each refresh token stored on our servers, a private image bucket that blocks all public access, managed secrets, principle-of-least-privilege access for staff, secure software-development practices, dependency monitoring, and incident-response procedures. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8.4 Data breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (including, where applicable, the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India) and affected users without undue delay and, where feasible, within 72 hours, as required by applicable law.

9. How Long We Keep Your Data (Retention)

• Account & profile data: retained for as long as your account is active. When you delete your account (see Section 10), we delete or anonymise your personal data, subject to the limited exceptions below.
• Cricket activity (tournaments, matches, scoring, fantasy teams, follows): retained while your account is active. Note that some records (e.g. a completed tournament's results or a match scorecard you contributed to) may be retained in anonymised or aggregated form so that shared community records remain intact for other participants. Availability answers, predictions and fantasy team names are kept with the match or tournament in the same way.
• Match photos: kept until the person who added the photo, a tournament organiser, or we delete it. Deleting a photo removes the stored files and clears cached copies from our content delivery network. Photos are not deleted when the person who added them deletes their account (see Section 10).
• Sign-in IP addresses: the sign-up address is kept for the life of your account; the latest-sign-in address is replaced each time you sign in. Both are erased when your account is deleted.
• Sign-in and verification codes: short-lived. A code expires 10 minutes after it is issued and can be used once. Emailed codes are stored only as a one-way hash, never in a form we could read or re-send. The record of the request is kept briefly to expire the code, block reuse and enforce rate limits, and is deleted outright when your account is deleted.
• Sign-in sessions: each device you sign in on has its own session. We keep a record of it: the platform, when it started and when it was last used. The App uses an access token that lasts 1 hour and is renewed automatically. A session that goes unused for 90 days ends, and you must sign in again. Records of sessions that have ended or been signed out are deleted after 30 days. Older versions of the App that do not support sessions keep a single token that lasts up to 180 days. Deleting your account ends every session and invalidates every token immediately.
• Public links and calendar feed: an auction big-screen link and a season report link last until the organiser resets or revokes them, or the tournament is deleted. Your certificate link lasts until you remove it. Your calendar feed link lasts until you reset it. Your certificate links and calendar feed are deleted when you delete your account.
• Slack and Microsoft Teams: we keep a record of each post for as long as the tournament's channel is connected. Posts already delivered to a channel stay there under that workspace's own retention settings, and we cannot delete them.
• Push notification tokens: retained until you disable notifications, sign out, or the token becomes invalid.
• Support tickets & bug reports: retained for up to 24 months after resolution.
• Crash logs and diagnostic data: retained for up to 90 days, then aggregated or deleted.
• Analytics & session insights: retained per the retention schedules of Firebase, Microsoft Clarity and AppsFlyer.
• Install attribution: kept with your account. When the account is deleted, the installation identifier, the store referrer and any referral code are erased; only the source and campaign remain, unlinked from you, as counts.
• Purchase records: records of organiser-plan purchases — the tournament, plan, store, and transaction identifiers — are retained for as long as needed for the entitlement, and thereafter for up to 8 years to meet tax, accounting and audit obligations. These records survive account deletion in the reduced form required by law.
• Advertising data: the ad request data described in Section 4.2 is held by Google under its own retention schedule; we do not receive or store it. The on-device frequency counters reset each day, session or match, and are cleared when you uninstall the App.
• Sponsor banner metrics: the aggregate per-sponsor daily counts are retained for the life of the tournament record and are not linked to you. The per-account anti-abuse counter is deleted after 7 days.
• Sales enquiries: retained for up to 24 months after the enquiry is closed.
• Account-deletion records: a minimal record of your deletion request may be retained to evidence compliance.

When retention periods expire, we delete or anonymise the data so that it can no longer be associated with you.

10. Your Rights & How to Delete Your Account

Depending on where you live, you may have some or all of the following rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority.

Deleting your account. You can request deletion directly in the App via Profile → Delete Account, or by emailing support@mygully11.com from your registered details. You may cancel a pending request at any time before it is processed.

What deletion actually does. We want to be precise here, because cricket records are shared between people and cannot simply vanish without damaging other participants' scorecards. When your deletion request is processed:

• Your name, phone number, email address, profile photo, bio, location, batting and bowling styles, and recorded sign-in IP addresses are erased from your account and from your player record.
• Your notification settings, your follows and followers, your verification (OTP) records, your calendar feed, your certificate links, and your mini-league and department memberships are deleted outright.
• Every sign-in session is invalidated, and your phone number and email are released so they can be used to sign up again later.
• Your account is marked deleted and your cricket history is kept but detached from you: scorecards, match events, tournament results and fantasy entries you took part in remain, attributed to "Deleted User", so that other participants' records stay complete and correct. The same applies to your availability answers and predictions. Season reports still count you in their totals, but no longer name you.
• Match photos you added are not deleted. They are part of the match's record and stay in its gallery, credited to "Deleted User". If you want them removed, delete them in the App before you delete your account, or list them in your deletion request.
• A minimal record of the deletion request itself, and the purchase records described in Section 9, are retained where we are legally required to keep them.

Photos of you added by someone else. If a match photo shows you and you want it removed, report it in the App (choosing the privacy reason), ask the tournament organiser, or email support@mygully11.com. We will review the request and remove the photo where the law requires it or it is otherwise appropriate.

This means deletion anonymises your participation rather than erasing shared match history. If you need something beyond this, contact us and we will consider the request on its merits under the law that applies to you.

Requests are reviewed and completed by our team. We will action your request and respond within the period required by applicable law — typically 30 days (GDPR, and the DPDP Act), or 45 days under the CCPA, extendable once where permitted.

11. California Residents (CCPA / CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) gives you rights to know/access, delete, correct, opt out of "sale"/"sharing", and non-discrimination. In the last 12 months we have collected the categories: identifiers (phone, email, device IDs), customer records (profile fields), internet/network activity (app usage, crash logs), and limited geolocation (IP-derived region).

We do not "sell" your personal information for money. Use of analytics/attribution identifiers (Firebase Analytics, AppsFlyer) may be considered "sharing" for cross-context behavioural advertising under the CPRA. Ads shown in free-tier tournaments are served by Google AdMob and are always requested as non-personalised, which is designed to exclude cross-context behavioural advertising; we nevertheless treat the advertising identifier used to serve them as within the scope of your opt-out right. You can opt out by turning on "Limit ad tracking" or deleting/resetting the advertising ID in your device settings, by taking part in tournaments on a paid organiser plan (which show no ads at all), by disabling analytics where offered, or by emailing support@mygully11.com. We honour Global Privacy Control (GPC) signals on our Site. Authorised agents may submit requests with proof of authorisation.

12. European Economic Area, United Kingdom & Switzerland (GDPR / UK GDPR / FADP)

If you are located in the EEA, UK, or Switzerland, the legal bases for processing are listed in Section 5, and you have all the rights listed in Section 10. For all data-protection enquiries, contact support@mygully11.com. You may also lodge a complaint with your local supervisory authority, including the UK ICO (ico.org.uk), Ireland's DPC (dataprotection.ie), or another EU member-state authority (edpb.europa.eu).

Ad consent. Where the EEA, UK or Swiss rules require it, the App shows you Google's User Messaging Platform consent message when it first starts, and does not request ads until you have answered it. You can change your answer at any time from Profile → About → Ad Privacy Settings in the App; that entry appears only in the regions where the framework requires it, because it is the only place the form can be shown. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Exercising your rights. EEA, UK and Swiss users may exercise every right described in Section 10 directly with us at support@mygully11.com. We answer these requests ourselves, at no cost to you, and within the statutory time limits. You may also complain to your local supervisory authority as described above.

13. India — Digital Personal Data Protection Act 2023

As we are incorporated in India, our processing is also governed by the Digital Personal Data Protection Act, 2023 ("DPDP Act"). As a Data Principal you have the right to: obtain a summary of the personal data we process and our processing activities; request correction, completion, updating, and erasure of your personal data; nominate another individual to exercise your rights in the event of death or incapacity; and readily-available grievance redressal.

Our designated grievance officer under the DPDP Act and the Information Technology Act, 2000 (and rules thereunder) is:

• Grievance Officer: The Designated Officer, Zyvenxa Technologies Private Limited
• Email: support@mygully11.com
• Address: Zyvenxa Technologies Private Limited, Kerala, India 682308

We will acknowledge grievances within 24 hours and resolve them within 15 days of receipt, or sooner where the law requires it. Unresolved complaints may be escalated to the Data Protection Board of India.

14. Other Jurisdictions

• Brazil (LGPD): rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. ANPD: gov.br/anpd.
• Canada (PIPEDA / Quebec Law 25), Australia (Privacy Act 1988), Singapore (PDPA), South Africa (POPIA), UAE, Saudi Arabia (PDPL), and others: you have rights substantially similar to those described above and may contact your national data-protection authority.
• U.S. state laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others): rights of access, correction, deletion, portability, and opt-out of targeted advertising and sale, exercisable as described in Section 11.

15. Children's Privacy

The App is intended for users aged 13 and over — 16 and over in the EEA and the UK — and for users under 18 only with parental or guardian involvement. We do not knowingly collect personal data from anyone below those ages. Applying 16 across the whole EEA means we meet the highest digital-consent age in force in any member state, without needing to treat users differently depending on which country they are in. We do not profile any user for advertising: no user's data — child or adult — is used to build an advertising profile or to target them across other apps and websites. Free-tier tournaments do show ads, but they are non-personalised and contextual only. Because gully cricket is watched by families and played by under-18s, we cap the content rating of ads served in the App at the equivalent of "PG" and block gambling and real-money-gaming advertisers in our ad-network settings. Under the U.S. Children's Online Privacy Protection Act (COPPA) and India's DPDP Act, if we learn we have collected personal data from a child without the required consent, we will delete it. If you believe a child has provided us data, contact support@mygully11.com.

16. Push Notifications & Communications

With your permission, we send push notifications (for example, match updates, tournament reminders, or service messages) via Firebase Cloud Messaging. You can disable notifications at any time in your device settings or in the App's notification settings. We do not currently send marketing emails; if this changes, you will receive a clear opt-in and an unsubscribe mechanism, and marketing would be sent from a different sending domain than sign-in codes.

Sign-in codes are not marketing. An email containing a one-time code is sent only because you have just asked to sign in or to verify an address, and it is necessary to perform our contract with you. For that reason it has no unsubscribe link and is sent regardless of any marketing preference — the way to stop receiving them is to stop requesting them, or to delete your account (Section 10).

17. Public & Community Information

MyGully11 includes community features. Your display name, profile photo, cricket attributes, follower/following relationships, tournament participation, match/leaderboard performance, fantasy team name, mini-league and department, prediction leaderboard position, and any Player of the Match, season award or milestones you earn may be visible to other users of the App. Match photos are visible to every signed-in user, and your availability answers are visible to the people described in Section 4.1. Some of this can also be seen outside the App. Organisers can post updates to Slack or Microsoft Teams channels and share auction big-screen and season report links, and you can share your certificate link. Anyone in that channel, or anyone with the link, can see what is shown (Section 4.1). Share cards and match links can be forwarded to anyone once shared, and we cannot recall them. Please consider what you choose to make public. We are not responsible for how other users use information you choose to share within the community.

18. "Do Not Track" Signals

Because there is no industry consensus on how to respond to browser "Do Not Track" (DNT) signals, we currently do not respond to them, but we honour the Global Privacy Control (GPC) signal on our Site as described in Section 11.

19. Third-Party Links

The App and Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties; please review their privacy policies before providing them with information.

20. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the App, by email, or by prominent notice on our Site before the changes take effect, and we will update the "Last updated" date above. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

21. How to Contact Us

For any questions, complaints, privacy requests, data-subject-rights requests, or grievances relating to this Policy or our handling of your personal data, please contact us:

• Email (all enquiries): support@mygully11.com
• Postal address: Zyvenxa Technologies Private Limited, Kerala, India 682308

22. Governing Law & Jurisdiction

This Policy is governed by the laws of India, without regard to its conflict-of-laws principles, and subject to the exclusive jurisdiction of the competent courts at Ernakulam, Kerala, India, except where mandatory local consumer-protection or data-protection law in your country of residence grants you additional rights or a different forum.

23. App Store & Play Store Privacy Labels

For convenience, the data categories shown in our Apple App Privacy labels and Google Play Data Safety section reflect the practices described in this Policy. In the event of any conflict between the labels and this Policy, this Policy controls.

The table below maps what we collect to the store categories. Free-tier tournaments show ads served by Google AdMob, so a device advertising identifier is used for third-party advertising. Those ads are always requested as non-personalised: nothing about you is sold, and no data is used to track you across other companies' apps or websites in the sense used by Apple's App Tracking Transparency framework — which is why the App never asks you for tracking permission.

Why the store labels look less detailed than this table. Apple's App Privacy label puts every device-level identifier — your push token, our internal device identifier, and the advertising ID — into a single "Device ID" category, and asks one question about whether that category is linked to your identity. Because the push token and device identifier are tied to your account, we answer that question yes for the whole category, even though the advertising ID by itself is not linked to you. Google Play's Data Safety section groups them the same way, under "Device or other IDs". The row above describes what actually happens to each one.