Privacy Policy
Effective 24 September 2026. This is the current version; changes are described at the end.
CricAI.co is a cricket scoring service. This policy says what we hold, why we hold it, who else sees it, and how to make us change or delete it. It covers the website and app at cricai.co and the internal video tooling described under “Match footage” below.
The short version. We sell nothing and we advertise nothing. We run no analytics, no tracking pixels and no advertising network. We ask a person scoring a match for an email address or a phone number so their matches come back to them, and we ask people watching for nothing at all.
The one thing worth reading carefully is players: a scorer types other people's names into a scorecard, and those names go on a public page. That section is below.
Who we are
CricAI.co is operated by the team behind the CricAI cricket scoring platform. For anything in this policy — including a request to see, correct or delete your data — write to [email protected]. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the data described here, and that address reaches the person responsible for answering you.
What we collect, and from whom
Three kinds of person meet this service, and we hold very different amounts about each.
If you score matches (you have an account)
| Display name | The name you chose, or the one on your Google profile at first sign-in. We do not overwrite it later. |
|---|---|
| Email address | If you signed up with an email, or signed in with Google. |
| Phone number | Only if you chose to sign in by phone, or added one so you could be put on a team roster. |
| An account identifier | An opaque id from our authentication provider. We never store a Google password, a Google access token or a Google refresh token for your account — we ask Google who you are, once, at sign-in, and discard everything else it returns. |
| The matches you score | Every ball, as an append-only record, along with the teams and players you entered. |
| A session | See “Cookies” below. |
If you appear in a scorecard as a player
You can be in this service without ever having used it. A scorer adds players by name alone — no phone number, no email, no account, and no app to install. That is a deliberate choice: requiring every player to register is the single most disliked thing about the apps we are an alternative to.
The consequence is that we hold a name someone else typed, attached to what that person did in a match — runs, wickets, overs. If a phone number or email is later added so you can be invited to a team, we hold that too, and only then.
A scorecard is public. Anyone with the link can read it without an account, and search engines are allowed to index it. That is the point of the product — a scorer shares one link into a group chat instead of asking forty people to install something — but it means your name and your figures are on a public web page. If you would rather they were not, write to [email protected] and we will remove or anonymise them.
If you are watching a match
Nothing. No account, no sign-up, no cookie is set, and the page carries no JavaScript at all. Our servers keep ordinary web logs — the request, the time, and the network address it came from — for security and debugging, and nothing is built from them.
Match footage
Separately from scoring, we record video of cricket being played in order to build and test automatic scoring. This is a small internal programme, run by our own operators with equipment we control; it is not something that happens because someone scored a match on their phone.
- Footage is captured by our operators, who are told what they are recording and why, at grounds where we have permission to record.
- Recordings are uploaded to a single Google Drive account that we own and operate. Our systems read back only files they themselves uploaded, and nothing else in that account.
- Access is restricted to named people on our side. Footage is not published, not sold, and not given to anyone else.
- If you were filmed and want the footage removed, write to [email protected].
CricAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Why we hold it
- To run the service. To sign you in, to keep your matches attached to you, and to render a scorecard.
- To publish what you asked us to publish. A shared match link is public because you shared it.
- To keep it working. Error logs, and the security measures below.
- To build automatic scoring, from footage, as described above.
We do not profile you, we do not make automated decisions about you, and we do not use anything here to target advertising, because we do not carry advertising.
Who else sees it
We use a small number of service providers, each for one job. None of them is permitted to use your data for their own purposes.
| Supabase | Our database, and the service that checks a password or completes a Google sign-in. |
|---|---|
| Google Cloud | Where the application runs, in the Mumbai (asia-south1) region. Google Drive, for footage. |
| Cloudflare | Serves cricai.co and passes requests to us. |
| MSG91 | Sends the one-time code, if you sign in by phone. |
| Google Fonts | Two typefaces on our public pages. Your browser fetches them from Google, which means Google sees the request. |
| Your browser's push service | Only if you turn on match notifications. Delivering a notification necessarily goes through Apple, Google or Mozilla, depending on your browser. |
We will also disclose data where the law requires it. We do not sell personal data, and we do not share it with advertisers or data brokers. If the service is ever acquired, this policy travels with it and we will say so here before anything moves.
Some of these providers operate outside India, so data may be processed abroad.
Cookies
One cookie, sos_session, set only after you sign in. It holds a random token and
nothing about you — no name, no email, no identifier a third party could read. It is
HttpOnly, so no script can read it, and it expires after thirty days without use.
Signing out invalidates it on our side as well as clearing it from your browser.
There are no analytics cookies, no advertising cookies and no third-party cookies, which is why this service has no cookie banner: there is nothing to consent to.
How long we keep it
- Your account and your matches: until you ask us to delete them. Matches are the product's memory — a season's records are worthless if last month's matches vanish.
- Sessions: thirty days from last use, then deleted.
- One-time codes: minutes. They expire and are swept.
- Web and error logs: a short operational window.
- Footage: for as long as it is useful for building automatic scoring, and deleted on request.
Deleting your account deletes your matches, and a public link to one stops working.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask us to show you what we hold about you, correct anything wrong or incomplete, delete it, or explain how it was shared. You may also nominate someone to exercise these rights if you cannot. Write to [email protected] and we will answer.
These rights are not limited to people with accounts. If your name is in a scorecard because somebody else typed it, the same rights apply, and that is the request we most expect to receive.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
How we protect it
- Everything travels over HTTPS.
- We never store your password. Authentication is handled by our provider, and a Google sign-in leaves no Google credential with us at all.
- Session tokens are stored only as a hash, so a copy of our database hands out no working session.
- Our database is not exposed to the public internet through any automatic data API.
No service can promise it will never be breached. If one happens and it affects you, we will tell you and the Data Protection Board, as the Act requires.
Children
Grassroots cricket is played by children, and a scorecard may contain a child's name because an adult scorer entered it. We do not knowingly create accounts for anyone under 18, and we do not profile or advertise to anyone. A parent or guardian who wants a child's name removed from a scorecard should write to [email protected], and we will remove it.
Changes
If this policy changes we will update the effective date at the top. Where a change is significant — a new purpose, a new provider, a new category of data — we will say so on this page rather than quietly revising it.
Contact
Questions, corrections, deletions and complaints all go to the same place: [email protected].