Privacy policy

Account data: name, email, phone, password hash, account type, organization details.

Tournament data: teams, players, contacts, fixtures, scores, media and certificates uploaded by organizers.

Billing data: plan, invoices and payment references. Card and UPI credentials are handled entirely by our payment gateway; we never see or store them.

Technical data: IP address, device and browser information, and product usage events used for security, quotas and analytics.

To run your account and tournaments, process payments and quotas, send transactional email and match notifications, prevent abuse, provide support, and improve the product. We do not sell personal data.

We share data only with processors that make the service work — hosting and database, email delivery, payment gateway, and AI providers used for poster and website generation (prompts and the content you submit for generation). Each is bound by contract to protect the data.

Tournament pages, leaderboards, certificates and microsites you publish are intentionally public. Do not upload personal contact details of players into fields meant for public display. Player contact information is stored separately and is never exposed on public pages.

We use strictly necessary cookies for authentication and session security, and minimal analytics to understand feature usage. You can block cookies in your browser, but sign-in will not work without the necessary ones.

Account and tournament data is kept while your organization is active and for 30 days after closure, after which it is deleted or anonymised. Invoices are retained as long as tax law requires.

You can access, correct, export or delete your data from the dashboard, or by writing to privacy@kheloonline.in. Grievances can be raised with our grievance officer at grievance@kheloonline.in.

Accounts are for users aged 18 and above. Minors may appear as players in a tournament only where the organizer has obtained guardian consent; the organizer is the controller of that data.

Data is encrypted in transit, tenant-isolated at the database layer with row-level security, and access is role-restricted. Provider API keys are stored encrypted. No system is perfectly secure — report issues to security@kheloonline.in.