Privacy Policy

This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. We are the "Data Fiduciary" for the data we decide how to use. A venue or organiser that receives your booking or ticket details is a separate fiduciary for what it holds (see section 5 and the Business Terms).

Data you give us

• Name, username, email (Google sign-in or email code)Your account, sign-in and public profile
• Phone number, and the one-time code we send to it by SMSVerifying your phone. Optional for players, required to sign in by phone
• Date of birthChecking you are 18 or older. Never shown to anyone. Set once
• Profile photo, banner, team crest, event bannerYour public profile, teams and events
• City, About Me, sports, self-reported experienceYour public player card
• Challenges, events, teams you create, with venue name and map pinLetting nearby players find and join
• Direct messages and group chatsPlayer-to-player messaging
• 24-hour notesShort status lines, deleted after 24 hours
• Endorsements, follows, friend connectionsThe social side
• Reports you file about other users or contentTrust and safety
• Venue reviews: a star rating and optional textHelping other players choose a turf. Shown with your name
• Team registrations for an event: team name, squad listEntering a tournament

Bookings, tickets and payments

• Turf bookings: venue, court, date, time, price, status, your share when a booking is splitMaking and running your booking
• Event tickets: event, ticket type, quantity, price, and the name and contact of each ticket holder (a guest needs no LTP account)Issuing tickets and letting the organiser admit you
• The time a ticket was scanned at the gatePreventing a ticket being used twice, and telling the organiser who arrived
• Payment records: amount, status, time and Razorpay's reference for the paymentConfirming payment, refunds, accounts and tax
• Refund requests and their outcomeHandling refunds

We never see or store your card number, UPI PIN, net-banking login or wallet credentials. You enter those in Razorpay's own payment screen, and Razorpay processes them.

Collected automatically

• Precise device location, only with your permission (or a city you type instead)Showing challenges, events, turfs and leaderboards near you. Never shown to others
• Match results, rating, win-loss record, reliability scoreRankings and your public record. This is the product
• Live-score events for matches you play (runs, goals, cards, times) and the names on the scorecardLive scoring and the match record
• Push notification tokenSending notifications you have allowed
• Product analytics events tied to your account (only actions we chose to record; no automatic click or screen capture)Learning which features are used
• Crash and error reports (set up to exclude personal identifiers)Fixing bugs
• Profile view eventsThe LTP+ "who viewed you" feature
• Moderation state: reports against you, suspensions, the moderation logEnforcing our Terms
• Website server logs: IP address, browser type, pages requested, timeRunning and securing the website. Kept by our hosting provider

If you open a business account (a venue, organiser or brand, at losertopay.com/business) we also collect, from the person running it: business display name and legal name; the services it offers; contact name, phone and email; PAN (required) and GSTIN (optional); an image or PDF of the PAN card; an image or PDF of one government photo ID (passport, driving licence or voter ID); venue details you claim or add (name, address, area, coordinates, contact phone); the note you attach to a venue claim; optionally a GST certificate or certificate of incorporation; and whether you are an individual or a registered entity. We do not accept or store Aadhaar. Verification documents sit in private storage, are read only by the LTP staff who review them through short-lived individual links, are never shown to players, and are used only for verification. We do not collect your bank account details. Razorpay collects and verifies them when you connect your payout account; we keep only the reference it returns to us.

If you join the beta waitlist on the website we collect your email and, if you choose to give them, your name, city, favourite sport, and where you signed up. This is stored in our database and is not readable from the website.

What we never collect: your contacts, SMS inbox, call logs, background location, biometrics, or card numbers.

Cookies and website visits. The website sets no advertising or tracking cookies, and it shows no cookie banner because it does not need one. To learn which pages people read, we use Vercel Web Analytics, a visit counter that sets no cookie and stores nothing on your device. It counts page views by page address, the site you came from, country, browser and device type. It does not record anything after a "?" or "#" in an address, does not use an identifier that follows you across other websites, and does not count visits to the business console or the admin panel. The business console keeps your sign-in session in your browser's storage so you stay signed in.

LTP is a social sports app. Other signed-in players can see your profile: name, username, photo, banner, city, sports, rating, tier, win-loss record, match history, endorsements, follower counts, main team, About Me, and reviews you have written. Challenges and events you post are visible to nearby signed-in players. Event pages published by organisers are public on the web. If you open a player's card, a player with LTP+ can see that you viewed it. A challenge invite link shows the challenger's name, the sport and the venue to anyone who has the link.

Match links. The person scoring a match can turn on a public link. Anyone who has the link, signed in or not, can then see the score, the scorecard and the names on it, and the page can be opened from anywhere. The link is off by default. The scorer can turn it off at any time, and links already shared then stop working. If you are named on a scorecard and want the link off, ask the scorer or write to support@losertopay.com and we will turn it off. We ask search engines not to list match pages, but a shared link is public to whoever receives it. Do not put anyone's personal details in a guest name.

What stays private: your direct messages, your date of birth, your phone number, your email address, and your exact coordinates are never shown to other players. A venue or organiser sees the booking or ticket details of people who booked or bought from it, and no more.

To run the service (accounts, matchmaking, rankings, messaging, notifications, live scoring, bookings, tickets); to take payments and refunds and keep the accounts and tax records the law requires; to keep the service honest (rate limits, moderation, integrity checks); to fix bugs and learn how features are used; to send you service messages by email and, if you allow them, push notifications and optional activity reminders (switch them off under Profile, Settings); and to comply with the law.

We ask for your consent when you sign up and again for optional things such as location and notifications, in plain language and separately from these documents. We also rely on the "legitimate uses" the DPDP Act allows, for example doing what you asked us to do (a booking) and complying with law.

We do not sell your personal data. We do not use it for third-party advertising.

We share data only with providers who process it on our instructions, and with the venue or organiser you deal with:

• Supabase (database in AWS Mumbai, sign-in, file storage)Running the service
• GoogleSign-in with Google
• MSG91Sending sign-in codes by SMS to your phone number
• RazorpayPayments, refunds, and paying venues and organisers
• ExpoDelivering push notifications
• PostHog (United States)Product analytics
• SentryCrash reports
• ResendService emails
• Ola MapsVenue search and maps: your search text is sent to it
• VercelHosting the website and business console, and counting website visits without cookies
• Google Play Billing (if LTP+ is sold through Google Play)Subscription billing
• The venue or organiser you book with or buy fromYour name, contact, booking or ticket details, so it can serve you. It becomes a separate fiduciary for what it receives

We disclose data where the law requires it (for example to a court or authority) or to protect someone's safety.

Our main database and file storage are in India (Supabase, AWS Mumbai). Some providers process data outside India, notably PostHog (United States) and Sentry. Transfers are made in line with DPDP Act s.16 and any restriction the Central Government notifies.

• Your account and contentWhile your account exists
• After you delete your accountYour login is destroyed at once. Your profile is anonymised: name, username, photo, banner, About Me, city, date of birth, phone and email are erased and it becomes "Deleted player". Challenges, messages, notes, follows, endorsements, team memberships and notifications are deleted
• Registration details (name, email, phone)Kept securely for 180 days after you delete your account because the Information Technology (Intermediary Guidelines) Rules, 2021 require it. Used for nothing else, then erased
• Matches you playedKept, with you shown as "Deleted player". A match is a record of two people
• Event registrations and ticketsKept as the organiser's record of who attended, with you shown as "Deleted player"
• NotesDeleted after 24 hours
• Payment, booking, ticket, refund and invoice recordsAs long as tax and company law require, up to eight years. Personal identifiers are removed where the law permits
• Moderation and audit recordsKept where the law permits, to stop a banned person returning
• Business verification documentsDeleted when the business account is closed, unless the law requires us to keep them
• Security and access logsFor the period the law requires (at least 180 days, up to one year). Website hosting logs are kept by our hosting provider for its own, shorter period
• Beta waitlistUntil you ask us to remove you, or the launch email has been sent
• BackupsRoll off on our provider's normal cycle

Delete your account in the app (Profile, Settings, Delete Account) or at losertopay.com/delete-account.

Row-level security on every database table; least-privilege access; encryption in transit; content checks on uploads; per-user rate limits; private storage for verification documents; a staffed report and takedown process. No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires. We also report cyber security incidents to CERT-In, the Indian Computer Emergency Response Team, within the six hours its directions allow.

You can: ask for a summary of the personal data we hold and who we have shared it with; correct or complete it (most of it can be edited in the app); ask us to erase it (in-app deletion, or the deletion page); withdraw your consent at any time (deleting your account, uninstalling the app, or turning off a permission in your device settings; it is as easy to withdraw as to give, and withdrawing does not undo what was lawfully done before); nominate another person to exercise your rights if you die or cannot; and complain to us first and then to the Data Protection Board of India. Write to support@losertopay.com. We acknowledge within 24 hours and resolve within 15 days.

Some data is necessary to give you a booking, a ticket or an account. If you withdraw consent for that, we cannot continue to provide that part of the service. Withdrawing does not affect records we must keep by law (section 7).

LTP is for people aged 18 and over. We ask for your date of birth to enforce this. We do not knowingly process the data of anyone under 18, and where we learn an account belongs to a minor we delete the account and its data. We do not track or profile users for advertising.

Grievance Officer: Afraaz Hashmi, Director, Raskah Technologies Private Limited, 19 B G/F Pocket-10B, Jasola, Jamia Nagar, New Delhi, South Delhi 110025, Delhi. Email support@losertopay.com. Acknowledgement within 24 hours, resolution within 15 days. If you are not satisfied with the Grievance Officer's decision, you may appeal to the Grievance Appellate Committee (gac.gov.in) within 30 days.

If we make a material change we will tell you in the app or by email before it takes effect. Continuing to use LTP after that means you accept it, except where the law needs fresh consent, in which case we will ask again.