Effective 6 October 2026 · Last updated 6 October 2026
This policy describes what KickHeroes collects, why, how long we keep it, and what you can do about it. It is written to match what the app actually does — if you find something here that does not match your experience, tell us and we will fix one or the other.
KickHeroes operates the KickHeroes mobile application and kickheroes.net. We decide how and why your personal data is processed, which makes us the data fiduciary (data controller) for it.
Contact, and Grievance Officer under India’s Digital Personal Data Protection Act
2023:
kickheroes.founder@gmail.com
We acknowledge privacy requests and grievances within 7 days and aim to resolve them within 30.
| Data | Why | Kept for |
|---|---|---|
| Phone number | Your account identifier, and how we verify it is really you | Until you delete your account |
| Name | Shown to team-mates, on rosters and on match records | Until you delete your account |
| Date of birth, gender, playing position, preferred foot | Your player profile and position-based statistics | Until you delete your account |
| Profile photo, team logos, lineup images, match photos | Shown in the app | Until you delete your account, except where an image appears in another team’s records |
| Support messages and attachments | To answer you | 12 months after the ticket closes |
| Chat messages | To deliver them and to handle reports of abuse | 12 months |
| Data | Why | Kept for |
|---|---|---|
| Approximate location (GPS) | Only to find pickup games near you. Sent when you open the nearby-games screen. Decline the permission and you see all open games instead | Used for the search; not stored against your profile |
| Country and time zone | Correct kick-off times and currency | Until you delete your account |
| Device model, OS version, app version, device identifier | Diagnostics, and deciding whether you need an update | 90 days |
| IP address | Security, abuse prevention and rate limiting | 90 days |
| Screens visited, actions taken, session identifiers | Understanding which features are used | 90 days. Aggregate counts are kept indefinitely and identify nobody |
| Crash reports and error diagnostics | Fixing faults | Per our processors’ retention, below |
| Push notification token | Delivering notifications you have enabled | Until you turn notifications off or delete your account |
When you tap Add from contacts, the app asks permission and reads your address book on your device only, so it can show you a searchable list.
We do not upload your address book. Only the name and phone number of the specific people you select are sent to us, so we can create or find their player account and add them to your team. You can decline the permission and type names and numbers in by hand instead.
Pickup-game and match payments are processed by Razorpay Software Private Limited. Your card, UPI or bank details are entered in Razorpay’s own checkout and never reach our servers. We store only the Razorpay order and payment identifiers, the amount, currency and status, which game the booking was for, and any refund we owe or have paid.
We keep those records for 8 years to meet tax and accounting obligations, which is why booking records survive account deletion in anonymised form.
Your player profile — name, photo and career statistics — is reachable at
kickheroes.net/public/p/<your player code> without signing in,
so that it can be shared as a link.
| Processor | What they receive | Where |
|---|---|---|
| Google Firebase (Authentication, Messaging, Analytics, Crashlytics, Remote Config) | Phone number for verification, device identifiers, push tokens, usage and crash data | Google infrastructure |
| Razorpay | Payment details you enter; order and payment identifiers | India |
| Amazon Web Services (S3, CloudFront) | Images you upload | Mumbai (ap-south-1) |
| Sentry | Error reports and diagnostics | European Union (Germany) |
| Google Play Services / Apple | Standard platform telemetry | Per their own policies |
International transfers. Sentry processes error diagnostics in the European Union, and Firebase and Google Play Services may process data outside India. Where we transfer data abroad we rely on the recipient’s own contractual safeguards and on transfers being permitted to that country.
We do not sell your personal data, and we do not share it for advertising.
We process your data on these grounds:
In the app: Profile → Delete Account. It takes effect immediately.
What we erase: your name, phone number, date of birth, gender, playing position, profile photo, notification settings and registered devices. Your account can never be signed into again.
What remains, and why: matches you played stay in the records of everyone else who played them, shown as “Deleted player”. Your goals and results are part of other people’s scorelines, league tables and tournament standings — removing them would rewrite those people’s history. The same applies to the payment records we are required to keep.
If you would like the remaining anonymised records reviewed, write to us and we will look at it.
Subject to applicable law, you may:
Write to kickheroes.founder@gmail.com.
No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board as the law requires. If you believe your account has been accessed without your permission, contact us immediately.
KickHeroes is not directed at children. We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or guardian, and we do not track, profile or direct advertising at children. If you believe a child has given us personal data, contact us and we will delete it.
We will update this policy when the app changes, and revise the date at the top. If a change materially affects how we use your data, we will tell you in the app before it takes effect.