Privacy Policy & Data Protection Standards

Last updated:

TkaTak Sports (operated by Tkatak Sports Pvt. Ltd., Karnal, Haryana, India; referred to as “we”, “our”, or “us”) provides sports scoring, tournament management, and live broadcasting tools via our website (https://tkataksports.com) and mobile applications. This Privacy Policy describes how we collect, use, store, protect, and handle your information, including data obtained through Google API Services and YouTube APIs.

1. Information We Collect

Depending on how you use TkaTak Sports, we may collect:

• Public Match Data: Match scores, ball-by-ball figures, player names, team rosters, tournament brackets, and sporting statistics created by match scorers and tournament organizers. This data is intended for public display.
• Account and Profile Information: When scorers or players register, we collect name, email address, profile photo, and sports preferences to administer accounts and maintain athletic career profiles.
• Authentication and Log Data: We use Firebase Authentication to manage secure user sessions. Standard server logs (IP address, browser type, referring URLs) are collected to ensure service stability, prevent fraud, and maintain platform security.

2. Google User Data & YouTube API Services

TkaTak Sports integrates with Google API Services, specifically the YouTube Data API v3, to allow authorized match organizers and scorers to live stream sports events directly to their official YouTube channels from the TkaTak Sports Stream Studio.

When you choose to connect your Google / YouTube account, we request the following OAuth scopes:

• https://www.googleapis.com/auth/youtube: Used to create, configure, and manage live sports video broadcasts and live streams on the user's authorized YouTube channel.
• https://www.googleapis.com/auth/youtube.force-ssl: Used to securely configure live streaming metadata (broadcast title, description, privacy status, and RTMP ingest stream keys).
• https://www.googleapis.com/auth/youtube.readonly: Used to view and display the user's YouTube channels within the app so the user can select their intended broadcast destination.

Purpose of Processing: Google and YouTube user data is accessed strictly to deliver user-initiated live streaming functionality—specifically to generate RTMP broadcast keys and broadcast live sporting events with real-time score tickers to your YouTube channel.

3. Data Protection Mechanisms for Sensitive Data

TkaTak Sports maintains rigorous technical, administrative, and physical safeguards to ensure that sensitive data—including Google user data, YouTube API credentials, and OAuth tokens—is protected against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between user devices, our servers, and Google API endpoints is strictly encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 and TLS 1.3) over HTTPS. Plaintext transmission of sensitive data or credentials is strictly prohibited.
• Encryption at Rest: All sensitive data, including Google OAuth access tokens, refresh tokens, and session identifiers, is encrypted at rest using strong AES-256 (Advanced Encryption Standard with 256-bit keys) encryption. On mobile devices, authentication credentials are stored within platform-provided, hardware-backed secure storage (Android Keystore and iOS Keychain).
• Access Controls & Principle of Least Privilege: Access to sensitive user data, server clusters, and production databases is strictly limited to automated application workflows required to initiate and maintain live streams. No administrative personnel, employee, or contractor can view or access raw OAuth tokens or private credentials. All administrative access requires Multi-Factor Authentication (MFA) and is logged and audited.
• Secure Token Handling & Lifecycle: Google OAuth tokens are stored in private, sandboxed storage and are never exposed in public client bundles, diagnostic crash logs, URL queries, or browser consoles. Tokens are automatically refreshed through secure server/SDK mechanisms and are immediately revoked and deleted upon sign-out.
• Vulnerability Management & Monitoring: We perform regular code reviews, automated security scanning, and vulnerability patching to defend against injection attacks, unauthorized access, and data leaks.

4. Google API Services User Data Policy — Limited Use Disclosure

TkaTak Sports' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. No Sale or Unauthorized Sharing of Google User Data

We do not sell, rent, lease, trade, or monetize Google user data or YouTube account information to any third parties, data brokers, advertising platforms, or commercial partners under any circumstances.

Google user data is never shared with third parties, except directly with Google/YouTube servers to execute your live stream requests, or as strictly mandated by valid legal process or law enforcement obligations.

6. AI / Machine Learning Model Training Disclosure

TkaTak Sports does not use Google user data, YouTube API data, or user credentials obtained through Google APIs to develop, train, retrain, or improve generalized Artificial Intelligence (AI) and/or Machine Learning (ML) models.

7. Data Retention, User Control & Deletion

We respect your ownership of your data and provide transparent controls to manage, disconnect, and permanently delete it:

• Data Retention: Google OAuth access tokens and YouTube channel metadata are retained only for the duration of your active session or while your YouTube channel remains connected to TkaTak Sports. Once you disconnect your YouTube channel or log out, all associated local tokens are purged immediately.
• Revoking Google Account Access: You can revoke TkaTak Sports' access to your Google/YouTube account at any time through the Google Security Permissions page at https://myaccount.google.com/permissions.
• Permanent Account & Data Deletion: You have the right to permanently delete your TkaTak Sports account and all associated records. Deletion can be requested at any time by:
  1. Using the in-app Delete Account option in the mobile application settings.
  2. Visiting our dedicated deletion portal at https://tkataksports.com/delete-account.html.
  3. Emailing our data protection team directly at majracricketclub@gmail.com or support@tkataksports.com.
  Upon receiving a deletion request, all personal information, stored authentication tokens, and profile credentials are permanently purged from our active systems and databases within 30 days.

8. Cookies and Advertising

Firebase Authentication utilizes local browser storage to securely manage session tokens for reading match data.

This Site uses Google AdSense to display advertising. In connection with serving ads:

• Third-party vendors, including Google, use cookies to serve ads based on prior visits to this Site or other websites.
• Google's use of advertising cookies (such as DoubleClick / DART) enables it and its partners to serve ads based on visits to this and other internet sites.
• You can opt out of personalized advertising by visiting Google Ads Settings or aboutads.info.

Ads are served in accordance with the Google advertising policies.

9. Children's Privacy

TkaTak Sports provides a general-audience platform for community sports scoring. Young athletes under the age of 13 may only participate and have match statistics recorded with the knowledge and consent of their parent, legal guardian, team manager, or school sports administrator.

10. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

• Organization: Tkatak Sports Pvt. Ltd.
• Address: Karnal, Haryana, India
• Data Protection Contact Email: majracricketclub@gmail.com
• Support Email: support@tkataksports.com
• Website: https://tkataksports.com