Privacy policy
Contents
This Policy explains what personal data Emvipi collects, why, where it is kept, who gets it and what your rights are. It is the written notice required by Article 23 of the Law "On Personal Data".
1. Who we are
Owner and operator of your data: [Company legal name], [legal form], TIN [INN], address [address], Tashkent, Uzbekistan ("Emvipi", "we"). Person responsible for personal data (Law, art. 31): [name / role], [email], in the app (Profile → Help & support → Contact us).
2. Data we collect
| Data | Where it comes from | Why we use it |
|---|---|---|
| Phone number | You, at sign-up | Login by a one-time code from our Telegram bot (by SMS later, if switched on); one account per person. Never shown to other users. |
| Name (as you type it) | You | Shown to others as first name + last-name initial |
| Profile photo (optional) | You | Shown on your profile and in game lists, after moderation |
| City and district | You | Default area for the game feed |
| App language | You | Texts, notifications, Telegram bot messages |
| Sport levels (beginner / intermediate / advanced per sport) and preferred formats | You | Fair games, level guide on games |
| Push notification token of your current device | Your device | Sending notifications |
| Bookings: games, number of friends, friends' names (optional), cancellations | Your use of the app | Running bookings and the Rules |
| Attendance, no-shows, bans, reliability % | Organiser's marks and the app | Rules on no-shows and bans; shown on your profile |
| Game results and MVP votes, match photos you appear in | Organisers and players | Game history and statistics |
| Ratings you give organisers: 1–5 stars, issue tags, optional comment | You | Checking the quality of games and organisers (Emvipi only). Not shown to other users or organisers for now; we will update this Policy before showing them |
| One-game restriction requests about you or made by you (organisers): reason, optional video link, admin decision and its reason | Organisers and Emvipi admins | Safety and fair play (Game Rules, section 5) |
| Free games and free postings (credits) | The app | Bonuses |
| Spot alerts (games you watch for a free spot) | You | Telling you when a spot frees up |
| Blocks and reports you make, with optional comment | You | Safety |
| Notification settings, in-app notification list and the texts of notifications sent to you | You / the app | Optional notifications on or off; showing past notifications |
| Problem reports (text, optional screenshot, app and OS version, phone model), linked to your account | You | Fixing problems |
| Crash reports: error text and technical trace, app version, phone OS version, screen name, and a random id created for each app install (not your phone's hardware id); if you are signed in, also your account id, so we can see which account had the problem | Your device, automatically | Fixing crashes. Kept 30 days |
| Reason for deleting (optional, one of 4 choices) with the day | You | Improving the app |
| Server and login records: IP address, time, request | Our hosting provider, automatically | Security, abuse prevention |
Your location is not sent to us. If you allow location access, your phone uses it on the phone only, to show the distance to games ("x km") and your position on the map. Emvipi's servers never receive or store your location. The only map points we store are those of venues that organisers save (places, not people).
Extra data for organisers
| Data | Why |
|---|---|
| Application: sports, main district, venues, experience, games per week, Telegram and Instagram links | Deciding on the application; links are shown on your organiser profile |
| Venues: name, address, map point, surface, photos | Shown on your games after moderation; approved photos may also be shown on other organisers' games at the same venue |
| Games you post, cancellations and reasons, cancellation rate, games hosted | Running games; shown publicly |
| Match photos you upload | Shown after moderation |
| Posting fee payments: amount, status, payment reference, masked card number (first and last digits only, e.g. 8600 ** 4417), link to the electronic fiscal receipt, refunds. We store no receipt images or screenshots | Payments, receipts, refunds, accounting. We do not store card numbers; the payment provider [Multicard] holds card data |
Telegram login: when you sign in with our Telegram bot, we keep your phone number, Telegram user ID, Telegram chat ID and the time they were linked, only to send you login codes. We do not store your Telegram username, name or photo. This link is deleted when you delete your account. [Prod: true from the backend release with be 6146e4d9.]
Admins only: the Telegram user id of Emvipi admins, so the admin bot accepts their actions.
What we do not collect: your location (see above), passport data, biometric data (we do not use face or fingerprint login), genetic data, health data, home address, contacts list. No analytics or advertising tools are in the app (no Firebase Analytics, Crashlytics, AppMetrica, Amplitude or Mixpanel). Firebase is used only to deliver push notifications.
Friends you book for: if you type a friend's name, make sure they agree. We store only the name, nothing else.
3. Legal basis
We process your data with your consent, which you give when you sign up by ticking [the consent box] after reading this Policy (Law, art. 18, 21), and to perform the agreement with you (the Terms of Use). You may withdraw consent at any time by deleting your account (section 8).
4. Who can see your data
- Other users see: first name + initial, photo, levels, games played; your reliability % only you and the organisers of games you book; for organisers: games hosted, cancellation rate, venue details, Telegram/Instagram links. Guests (not logged in) see games but not player lists.
- The organiser of a game you booked also sees your booking, friends' names and level, so they can form teams and mark attendance. Organisers do not see your phone number.
- Emvipi admins see what is needed to review applications, reports, restriction requests and photos. For a restriction request they may contact the player (by phone or in the app) before deciding. Admin notices go to a private Telegram group; they contain display names, the last 4 digits of a phone at most, and profile ids, never full phone numbers or locations.
- Service providers (processors), only for the purposes above:
| Provider | What for | Where data is |
|---|---|---|
| Supabase Inc. (on Amazon Web Services) | Database, login, file storage, server functions. Its login service keeps its own sign-in log (phone number, time, IP address) under Supabase's retention rules | Frankfurt, Germany (EU) |
| Google LLC – Firebase Cloud Messaging | Push notifications (device token + notification text) | USA / global |
| Google LLC – Google Maps SDK | Showing maps; the map component on your phone draws your position dot (Google's own terms apply to it) | USA / global |
| Eskiz [legal name] | Sending SMS login codes (phone number + code), only once SMS login is switched on (not at launch) | Uzbekistan |
| [Multicard Payment JSC, brand "Rahmat"] | Organiser card payments, refunds, fiscal receipts | Uzbekistan |
| Telegram | Login codes from the Emvipi bot (Telegram user ID, the phone number you share in the bot, the code message); private admin notices (see above) | Telegram servers |
The app has no third-party crash or analytics service. Crash reports and problem reports are stored in our own database (Supabase, Frankfurt). The website uses Hotjar (section 11).
- Authorities, when the law requires it.
- We do not sell your data and do not use it for advertising.
5. Where your data is stored ⚠
Our main database is hosted in Frankfurt, Germany, so your data is transferred outside Uzbekistan.
What the law says today (our reading, to be confirmed by a lawyer):
- Since 27.03.2026 (ZRU-1125), Article 27¹ part 2 requires storage inside Uzbekistan only for: biometric data, genetic data, and data of users of telecommunications operators working in Uzbekistan. Emvipi does not collect biometric or genetic data.
- Other personal data may be stored and processed abroad if one of these is met (art. 27¹ part 3): (a) the country is on the government's list of countries with equal protection; (b) we adopt standard contract terms or binding corporate rules approved by the authorised body; or (c) we follow international data-management standards from a list approved by that body.
- Article 15 also allows transfer to a country without equal protection with your consent.
Our basis for storing data abroad: by accepting this Policy you agree that your data is transferred to and stored in Germany (EU) and processed by the providers listed in section 4.
6. How long we keep data
| Data | Kept |
|---|---|
| Account data | While your account exists |
| After you delete your account | Deleted at once: your login and phone number, your Telegram login link and open login requests, sport levels, notification settings and blocks. Erased from your profile at once: name, photo, push token, district, Telegram/Instagram links. Your bookings in games that have not started are cancelled. Your past game history (bookings, attendance, results) stays under an anonymous id that cannot be linked to you, so organisers' and other players' statistics stay correct (Law, art. 16 on depersonalised data) |
| Phone hash during a ban | If you delete your account while banned, a one-way code (hash) of your phone is kept until the ban ends, then erased by a daily job, so a ban cannot be avoided by signing up again |
| Login requests (phone, Telegram user ID, one-time link, login code, times) | 1 day, deleted by a daily cleanup (at most about 2 days) |
| The Telegram message carrying a login code (on our side) | 1 hour |
| Login-code request log (phone, app install ID, IP address, Telegram or SMS) | 2 days, to enforce anti-abuse limits |
| Crash reports | 30 days |
| Unpublished game drafts | Deleted the day after their start time passes |
| In-app notification list and sent notification texts | Until you delete your account |
| Reports you made or that name you | 1 year after the report is closed |
| Restriction requests and decisions (incl. video links) | 1 year after the decision |
| Ratings you gave | Kept with game history; after you delete your account they stay without your name (anonymous) |
| Problem reports and screenshots | 1 year |
| Payment and fee records and receipts (organisers) | 3 years |
| Server and login records | Kept by our hosting provider under its own rules (on our current plan about 1 day for API logs) |
| Delete reason | Day + reason only, no link to you |
7. Security
Access to the database is limited by row-level rules: each user can read and change only their own data through the app. Phone numbers are kept only in the login system and are not in any table other users can query. Connections are encrypted (HTTPS). Secrets and keys are not stored in the app. Only you can log in to your account, and only on one device at a time.
8. Your rights
You have the right to (Law, art. 22, 23, 30):
- know whether we process your data, what data, why, from where, how long, and to whom it goes (including abroad);
- correct your data (most of it you can edit in the app; other corrections within 3 days of your request, art. 11);
- withdraw consent and delete your account: in the app, Profile → Edit profile → Account → Delete account, or on our website [emvipi.uz/delete], or by writing to us. You cannot delete while you have an active game you organise; cancel or finish it first;
- object to processing;
- complain to the authorised state body for personal data [name: State Personalisation Centre / as designated] or to a court.
We answer requests within [10] days. A refusal is given in writing with reasons (art. 22).
9. Age
Emvipi is for people aged 16 and over. If you are 16 or 17, Uzbek law (Law "On Personal Data", art. 21) requires the written consent of your parent or guardian to process your data: you may sign up only with that consent, and you confirm it at sign-up. We do not knowingly allow anyone under 16; if we learn that a user is under 16, we delete the account.
10. Notifications
Notifications about your bookings, cancellations, game changes, no-shows and bans are always sent, because they are part of the service. Reminders, nearby games and photo reminders can be turned off in Settings. You can turn off all notifications in your phone settings.
11. Website analytics (Hotjar)
Our website uses Hotjar (a Contentsquare service) to see how visitors use its pages, so we can improve them. This is on the website only: never in the app, not on website pages opened from inside the app, and not on the Telegram login page.
- When it runs: Hotjar loads on every website page, without a cookie banner. You can turn it off at any time (see below).
- What it records: your visit to our pages without your name: pages opened, clicks, mouse movement and scrolling, screen size, device type, browser and approximate country. Text you type into fields is hidden and not recorded. We do not give Hotjar your name or phone number, and the visit is not linked to your Emvipi account.
- Cookies: Hotjar sets cookies on our site only:
_cs_id(up to 13 months) and_cs_s(30 minutes) to recognise a returning browser, and_cs_c(up to 13 months), which stores Hotjar's consent state. No account or payment data is involved: the website has no login and takes no payments. - Refusing it: block or delete cookies for our site in your browser settings, or use an ad or tracker blocker (it blocks hotjar.com and contentsquare.net). If you pressed «Decline» on our earlier cookie banner, Hotjar stays off in that browser until that choice (
_cs_optoutcookie) expires or you clear it. We do not rely on the browser's «Do Not Track» setting. - Processor: Hotjar Ltd (Contentsquare group) processes this data on our behalf. Its privacy policy: https://www.hotjar.com/legal/policies/privacy/. The data may be stored outside Uzbekistan (see section 5).
- Kept: as set in our Hotjar account, at most 12 months.
12. Changes
We will tell you in the app before an important change to this Policy takes effect. If a change needs new consent, we will ask for it.
13. Contact
[Company], [address], [email], in the app (Profile → Help & support → Contact us).