Score with a single tap. Every ball.
Score with a single tap. Every ball.
Legal
Last updated: October 14, 2026
Email address or phone number — used to identify you when an Admin or Team Manager role is granted, to let you access those roles, and to send you the one-time sign-in code.
Your name — the name you give us when you sign in. We show it only to people who score or run matches with you, for example when scoring passes from one phone to another. It is not your player name, and you can change it at any time on your Account page.
Date of birth, and a phone number or email address for a player profile — optional. A League Admin may enter them when adding a player, and you may add or change your own on your Account page. We use them for one purpose only: to recognise when the same person has two player profiles, so CricEZ support can review a request to merge them and your matches and statistics are kept together. We never show them to anyone else — not to other players, not to League Admins, and not on any public page — and we never use them for messages, marketing or display. When we check a possible merge, a reviewer sees only whether the two profiles match, never the values themselves. If you have claimed your profile, only you can change these details.
A record of joining two sign-ins. If you use “Join accounts” to bring an email address and a phone number together into one account, we keep a record that the two were joined: which account survived, which was joined into it, when, and what was moved. That record holds account identifiers and category labels only — it does not store a second copy of your email address or phone number. While a join is in progress we also hold a short-lived record of the one-time joining code, stored as a one-way hash rather than the code itself, along with when it expires and whether it has been used. It is deleted or expires shortly after. We join two sign-ins only after you have signed in with both, one after the other, and then chosen “I agree — join these accounts” on a screen that names both and explains what joining does.
Records created before you sign up. When a League Admin grants you a role using an email address or phone number, we create a record for that address so the grant has somewhere to live, before you have ever signed in. When you first sign in with it, that record joins whatever account you already have.
Location — only if you explicitly grant browser location permission (or manually type in a city/zip), used solely to show leagues and matches near you on the home page. You can deny this or clear it at any time; the app works without it.
Match, roster, and statistics data — ball-by-ball scoring data, player names and rosters, team and league structure, entered by Admins and Team Managers as part of using the Service.
Feedback you send us — if you use the in-app feedback form, we record the message you write, the category you chose, the screen you were on and the app version, and we store the email address and phone number already on your account alongside them so we can reply. Each report gets a ticket id, which we show you when you submit it.
Automatic error reports — when a page in the app hits an unexpected error, an unhandled promise rejection, or a screen that fails to render, the app sends us a short report by itself. This happens automatically, not in response to anything you do, and whether or not you are signed in. The report contains the error message and stack trace, which of those three kinds of failure it was, the path of the page you were on (never the query string, and never the part after the “#”), the app build version, your browser’s user-agent string, and the time we received it. It carries no account identifier, and we do not record your IP address with it. Before the report is written down we strip out email addresses, sign-in tokens, and values written as token=, password= or apiKey= — that is a best-effort pass over text produced by the code that failed, so we cannot promise it catches everything. These reports are written only to our server logs and are not stored in our database, which is why a request to delete your personal data (sections 5 and 7) does not reach them.
Daily visitor counts — To count how many people visit CricEZ each day, we combine your IP address and browser type with a random value that changes every day and is then deleted, and keep only a one-way code that cannot be turned back into your IP address. We use it only to count daily visitors: we do not set a cookie, we cannot recognise you on a different day, and at the end of each day we delete the codes and keep only the totals. We also count page views and how often a sponsor is shown or clicked; these counts contain no information about you.
To operate the Service: authenticating role access, personalizing the home page to your location, and displaying live scores, scorecards, and statistics — to you and, for public match/league data, to other visitors.
The admin console uses a session cookie to keep you signed in to the admin area. We do not use advertising or tracking cookies.
Service providers. We use service providers to run the Service, and they process data on our behalf to provide their services to us. They fall into these categories: cloud infrastructure and hosting, database, sign-in and communications (email and SMS), bot protection, location lookup, payments, push notifications, issue tracking, and AI. What each category receives is described below. A current list of our material subprocessors is available at /subprocessors.
Hosting and storage. The Service, its server logs and its database are run by cloud infrastructure, hosting and database providers on our behalf.
Location lookups. Turning a typed city/zip into map coordinates is done by a location lookup service, which receives the text you typed.
AI-generated match summaries. Where a league has AI summaries enabled, match data for that league’s matches — scoring events, player and team names, and match context — is sent to our AI provider to generate the written summary, and the generated text is stored with the match. This feature is off by default, and while it is off no match data is sent to our AI provider at all. It applies only to league matches; quick (leagueless) matches never generate a summary.
Feedback tickets. Feedback you submit through the in-app form is stored in our own database. Where a ticket is also copied into our private issue tracker so it can be worked on, that copy carries only the ticket id, an internal account identifier, the category and your message — never your email address or phone number.
Sign-in. Signing in is handled by our sign-in provider, which receives your email address or phone number in order to send your one-time code; for SMS codes, that phone number is passed on to an SMS delivery provider. After two sign-ins have been joined, our sign-in provider continues to recognise both of them. We map the older one onto your joined account each time you sign in, so signing in either way reaches the same place. The sign-in form uses a bot-protection service to block automated abuse, which receives your IP address and browser challenge data.
Payments. If you buy a plan, the payment is handled by our payments provider, which receives your payment details and the billing information needed to process it.
Push notifications. Where the CricEZ mobile app offers push notifications and you turn them on, your device’s notification token and the text of each notification are sent to a push-notification service so it can deliver them.
Where your data is processed. Your data may be processed in the United States, and in other countries where our service providers operate. If you use the Service from outside the United States, your data will be transferred to the United States to be processed there.
We do not sell your data, and we do not share it with advertisers.
Match and league data is retained as long as the league operates the Service. You can ask your League Admin to remove your role grant, or email contactus@cricez.ai to request removal of your personal data, at any time.
Backups. We keep database backups for up to 30 days so we can recover from a failure. When we remove your personal data at your request, it is removed from the live Service straight away, but a copy can remain in those backups until they age out — at most 30 days. We do not restore a backup in order to bring deleted data back.
If you have joined two accounts. Joining does not delete either account’s data — it brings it together under one account. After a join, everything that was under both sign-ins is part of the one account, so a request to remove your personal data covers all of it. The sign-in you joined from keeps working and continues to reach the joined account; it is not a separate account you need to remove separately. We keep the record that the join happened, because it is a record of something that occurred — but as described in section 1, that record holds identifiers and labels only, so removing your personal data removes it from that record at the same time. Backups made before the join still hold the two accounts as they were until they age out, at most 30 days, and anything you ask us to remove after the join follows the same 30-day rule described under Backups above.
Merging two player profiles. Every merge is reviewed and approved by CricEZ support, never by the person who asked for it. When two profiles are merged we keep a permanent record of the merge — which profile remained, which was merged into it, who asked, who approved, and which records moved — so a mistaken merge can be reversed by our support team. That record holds identifiers only; it does not store a copy of any date of birth, phone number or email. We also keep a record of who entered each of these private details, but never the value itself.
Feedback you have sent. A feedback report keeps the email address and phone number that were on your account when you sent it. When you delete your account yourself, we clear that email address and phone number from every report you sent. The message you wrote is kept, because the report is a record of something that happened. Tell us your ticket id if you want a specific report removed.
This policy may be updated from time to time. The “Last updated” date above reflects the most recent revision.
Questions about this policy, and requests to access, correct, or delete your personal data, can be sent to contactus@cricez.ai.