Privacy Policy

1. Information We Collect

We practice strict data minimization and collect only the following categories of information when you interact with the platform:

• Account & Sign-In Information (Google OAuth & Email Link): When you sign in using Google Sign-In or an email magic link (powered by Google Firebase Authentication), we receive your email address, basic display name, and unique authentication identifier. We do not request access to your Google contacts, Google Drive, calendar, or any sensitive/restricted Google scopes.
• Student Registration Details: Student's full name, gender, education level (Classes 8 to 12, or Intermediate 1st and 2nd Year), school or junior college name, and up to two (2) selected sport categories. Providing a personal student phone number is optional.
• Parent or Guardian Information: Parent or legal guardian's full name, phone number, and confirmation of parental permission for the student to take part in HITAM Sports Championship Junior 2.0.
• Team & Tournament Records: Team names, captaincy assignments, team join requests and approvals, roster lock timestamps, match schedules, attendance, and official match scores.
• Essential Technical & Session Data: A cryptographically signed, httpOnly session cookie (hitam_session) used strictly to keep you signed in, along with basic server security logs to prevent abuse.

2. How We Use Your Information

We use the collected information strictly for the following purposes:

• To authenticate your account and save your registration progress across devices.
• To verify student eligibility (grade/intermediate year, gender division, and school affiliation) for HITAM Sports Championship Junior 2.0.
• To enable students from the same school to create teams, request to join squads, and allow captains to submit and lock official team rosters.
• To generate tournament pools, knockout brackets, match schedules, and publish live or final match scores.
• To send essential transactional notifications related to your registration, sign-in links, team roster status, and match fixtures.
• To contact you regarding future HITAM academic or sports programmes only if you explicitly opt in to optional marketing communications during registration.

3. Google User Data & Limited Use Disclosure

Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data (your email address and basic profile name) is used exclusively to authenticate your identity and associate you with your championship registration or organiser role.
• We do not sell, license, or share Google user data with third-party advertisers, data brokers, or marketing networks.
• We do not use Google user data for serving advertisements or training generalized artificial intelligence / machine learning models.

4. Data Visibility & Sharing

We restrict access to personal information based on role:

• Public Pages: Publicly accessible pages (Sports, Fixtures, and match scoreboards) display only team names, school names, sport categories, match times, and scores. They never expose student phone numbers, email addresses, or parent/guardian contact details.
• Team Captains & School Teammates: Students and captains from the same school can view a teammate's name, class/intermediate year, and sport category to form teams. Captains cannot see phone numbers or email addresses.
• School Coordinators & HITAM Organisers: Authorized HITAM tournament administrators and verified school coordinators can view registration records and parent/guardian contact numbers for eligibility verification, roster administration, and emergency/safety coordination during the event on 28–31 October 2026.
• Service Providers: We rely on standard cloud infrastructure providers acting as data processors to host and run the platform (Google Firebase for authentication, Cloudflare for web hosting and edge security, Neon/PostgreSQL for encrypted database storage, and Resend for transactional emails).

5. Student Privacy & Parental Consent

Because HITAM Sports Championship Junior 2.0 is designed for school students (Classes 8–12) and intermediate students (1st and 2nd Year), every registration requires a parent or legal guardian's name, contact phone number, and explicit confirmation that the parent or guardian consents to the student's participation and registration. A parent or guardian may contact us or submit a deletion request at any time to review or remove their child's information.

6. Cookies & Data Security

We use a single essential session cookie (hitam_session) marked httpOnly and SameSite=Lax to maintain your authenticated session, and browser localStorage temporarily while you complete the multi-step registration wizard. We do not use third-party advertising cookies or cross-site tracking pixels. All traffic is encrypted over HTTPS/TLS.

7. Data Retention & Your Deletion Rights

We retain registration and match records for the duration of HITAM Sports Championship Junior 2.0 and for post-tournament certificate, prize, and audit administration. To request correction or deletion of your registration or account data at any time, please submit a request on our Delete My Data page. HITAM organisers review and process all deletion requests promptly.