Privacy Policy

Last reviewed September 2026 · This document describes current behavior and is pending formal legal review before public launch.

What we store, and why

Your account holds your name, email address, phone number, country, state and district (and a city, if you gave one before we asked for a district), date of birth and gender, and any profile photo that came with your sign-in. Date of birth and gender exist so organisers can apply the age and gender eligibility rules that tournament categories carry. Date of birth also decides whether a parent or guardian must consent before you submit a document, and helps organisers spot a duplicate entry. Location powers tournament discovery near you.

When you register for a tournament, the organiser of that tournament sees the details the registration form asked for, including any documents the tournament requires (for example an age proof). Documents live in private storage; they are readable only by you, the organiser of that tournament, and platform administrators — never publicly, and never by other participants. The documents you upload for a tournament's document requirements are deleted automatically 30 days after its last play day; the record that the requirement was met, who reviewed it and when, stays.

For paid registrations we store the payment amount, the recipient shown to you, the transaction reference (UTR) you submit and, if you attach one, your payment screenshot. If you pay an organiser offline, we store the amount, method, reference and note the organiser records. We never see or store your bank credentials, card numbers or UPI PIN — payment happens in your own UPI app.

We keep a coarse activity signal (that your account was active in an hour, by surface — never which pages) to understand usage. It is pruned automatically after a retention window. Security-relevant events (refused admin access, requests refused by a rate limit) are kept as an operational log.

What we do not do

We do not sell or share your data with anyone outside the tournament flow you joined. We do not run third-party advertising or tracking. Public tournament pages show tournament information and, when draws or results are published, entrant names, fixtures, standings and winners.

Google account data

This section applies to you if you connect a Google account. It also applies if someone imports a file containing your details, even if you have never used Google or KhelRizz.

Connecting and choosing files

We ask Google to identify your account and let us access files you choose for KhelRizz. Google can also grant permission for your name, email address and profile details. We accept those permissions, but keep only a code that identifies your Google account, not your Google name, email address or picture.

Google limits file access to files you choose to share with KhelRizz. We also issue our own short-lived pass for a selection, which is then tied to the one file chosen. You can choose another file later; that does not remove an earlier choice.

Choosing a spreadsheet reads its file details and a list of its tabs, including their names, sizes and whether they are hidden. It does not read the cells. Cells are read later when you ask to preview or import a chosen tab and range. They can be read again while that connection and file access remain available.

We save keys that let us use the connection, including a long-lived key that lets us get access again without asking you to sign in each time. These keys are stored in a scrambled form so they are protected while stored.

Documents need separate approval

Importing documents needs separate approval. We can download a chosen PDF or image, or make a PDF copy of a chosen Google document, slide presentation or drawing. We keep both the downloaded original and the copy prepared for use in the tournament.

If a document comes from a web address, we fetch it only from a site allowed by our operators. That site learns which address was requested and receives ordinary connection information, such as the address of the server making the request. We do not send it your sign-in details, keys or cookies.

How we use and keep the data

We use the data to bring people into a tournament, check and correct their details, check entry rules and documents, and run team selection, squads, draws and matches. Saved history helps organisers check what happened and recover an import.

We keep the imported participant details and the whole response Google sends for the chosen range until the import is deleted or the tournament is removed. That includes cell values, formulas, formatting, links, hidden row and column details, and details about the spreadsheet and its tabs. We also keep import history: the rows, how columns were matched up, plans, checks, decisions and reasons, including rows that were never confirmed. Correction history keeps old and new values, including names and contact details.

We keep file choices, file and permission details until the import is deleted or the tournament is removed, and the connection record and its saved keys while connected or until the tournament is removed. We also keep document references, approvals, processing history and both document copies. Both copies of a document attached to a player's tournament entry are deleted with the player's documents 30 days after the tournament's last play day; there is no scheduled deletion of the other saved imported data or its history. When a tournament is removed, or a private draft is discarded, its saved imports go with it.

Who can see it

• Tournament organisers and platform administrators can access data for their work. Organisers can download participant lists, including contact details, and permitted document copies. A copy already downloaded is outside a later removal from KhelRizz.
• Team owners and captains can see player names and playing details, such as skill ratings, squad lists and line-ups, where their tournament role allows it. Team members and entrants whose tournament record is linked to their account can see teammate or opponent names and match details where those views are available to them.
• You can see your own tournament record only if it is linked to your KhelRizz account. A record created for a new person by an import has no account link. Signing in later does not link that imported record to you.
• On public tournament pages, anyone can see entrant names after a draw is published, and winner names when results are decided and published. For imported participants, these can be the names from the spreadsheet.
• Our hosting providers hold the data under contract. Google receives our requests for the files you choose. A site hosting a web-address document receives the request described above.

Disconnecting and asking for removal

Disconnect clears our saved keys and stops access through that one connection, for that person in that tournament. If no other connection still uses that Google account, it also hands our permission back at Google; if Google does not confirm that, we tell you, and you can remove it at Google yourself. It does not disconnect other people or tournaments, or erase saved imports, documents or history.

To remove permission at Google, use your Google account permissions. That stops future access under that permission; it does not erase copies already kept by KhelRizz.

To remove saved data, ask the tournament organiser or email mykhelrizz@gmail.com. You can ask even if you never connected Google or created a KhelRizz account. We will remove or anonymize your details and confirm the outcome, including anything we must keep. A tournament’s owner, or the organiser who ran an import, can delete that import’s saved copies from the tournament’s import pages; the players added from it stay, and a record of the removal is kept. There is no button that erases every saved import at once. Administrators have a separate process to remove specifically approved document copies; that does not erase import history.

Our promise about Google data

We follow the Google API Services User Data Policy, including Limited Use: we use and share Google data only to provide or improve the features you use, within the limits of that policy. We do not sell this data, use it for advertising, or use it to train AI models.

Corrections and deletion

You can correct your profile at any time from the account menu, except your sign-in email and photo, and any city saved before we asked for a district. If you want your account deleted, contact us — we will remove or anonymize your personal details. One honest limit: verified payment records and competition results are retained, anonymized where possible, because financial history and published results cannot silently disappear.

Contact

Reach us at mykhelrizz@gmail.com.