Privacy Policy

This policy explains what KirKit collects about you, why, who else sees it, how long we keep it, and what you can ask us to do with it. It covers the KirKit mobile app, the KirKit website, and the servers behind them.

KirKit is operated by KhedMaidan, V.P.O Palkwah, Tehsil Haroli, District Una, Himachal Pradesh 177220, India ("we", "us"). If anything here is unclear, write to kirkit@khedmaidan.com and we will explain it in plain language.

1. Information you give us

To create an account we need a username, a mobile number, a password and your date of birth. We send a one-time code to your mobile number and check it before the account is created, so the number has to be one you control. We store your password only as a cryptographic hash — nobody at KirKit can read it.

Your date of birth is stored as a calendar date. It decides whether you are old enough to be here at all, whether you can take part in anything involving money, and which age-restricted tournaments you qualify for (Under-19, Under-16 and so on). We do not store a computed age, and we do not use your birthday for advertising.

Your player profile is whatever you choose to fill in: display name, profile photo, cover photo, bio, playing role, batting and bowling style, club, and the place you play — country, state, district, tehsil, village or city, and optionally your society or colony name. Location on KirKit is typed in by you. The app does not read your device's GPS or network location: it asks for no location permission on Android or iOS, and it contains no maps or location library. Your locality matters because village-, district- and society-level tournaments are only open to players from that place.

Content you post — posts, reels, stories, comments, photos, videos, live streams, live-chat messages, challenge entries, team and tournament details, and the messages you send in direct chats.

Not available in this release. Identity verification is switched off, and the app does not ask for or collect an Aadhaar number. Nothing described here happens today. It applies from the day verification is switched on, which cannot happen before payments are.

Identity documents, only if money moves. Organisers, streamers and players who want to withdraw earnings must complete an Aadhaar-based identity check. You enter your Aadhaar number and the one-time code sent to your Aadhaar-linked mobile. We never store your Aadhaar number. It goes straight to our verification partner and is discarded. What stays on our side is a masked version of the number in which only the last four digits are readable, the name, date of birth and gender the check returned, and the result of the check. The photograph the Aadhaar record returns is discarded. Where a selfie or liveness check is required, we keep the selfie and the match result. These records outlive your account — see section 10.

Reports you send us about other people's content or behaviour, including any explanation you type in.

2. Information created when you use KirKit

Your cricket record — the balls, runs, wickets and matches recorded against you by whoever is scoring, and the career statistics and leaderboard positions derived from them.
Your connections — who you follow, who follows you, your friends, your teams, the invitations between you, and the accounts you have blocked.
Usage events — a first-party record of what happens in the app: the event name, your account and role, a session identifier, the platform and app version, when it happened, and a small amount of context about the screen or item involved. We use this to understand which features are used and where people get stuck.
Payment records — for tournament entry fees, promotions, streamer bookings and Premier League payments, we record the amount, currency, our platform fee, the gateway fee, the status, a receipt number, and the order and payment identifiers our payment gateway returns. We never see or store your card number, UPI PIN, bank account number or net-banking credentials — those go directly to the payment gateway.
Device and delivery data — if you allow notifications, we store the push token your device is issued and the platform it belongs to, so we can deliver notifications. Deleting the app or logging out removes the token.
Technical logs — our servers process your IP address to apply rate limits, to identify the request in ordinary server logs, and to detect abuse. Requests carry a correlation identifier so we can trace one request through our systems when something breaks.
Diagnostics and crash reports — when something fails we record the error, where it happened, and enough context to fix it. These reports are configured to strip personal detail before they leave our systems.

3. Information from other services

Google Sign-In. If you sign in with Google, Google sends us your Google account identifier, your name, your profile picture link and your email address. We store only the Google account identifier and your name. Your email address and your Google profile picture are used to complete the sign-in and are then discarded — KirKit has no email field and does not send you email.

Identity verification partner. Our Aadhaar verification partner returns the verified name, date of birth, gender and a masked Aadhaar number, as described above.

Payment gateway. Razorpay tells us whether a payment succeeded, and gives us the order, payment and refund identifiers we use for reconciliation and receipts.

Public cricket and weather data. We fetch match and weather information from third-party services. Nothing about you is sent to them.

4. Why we use your information

To create and run your account, and to keep you signed in.
To show your profile, posts, reels, stories and statistics to the people you have shared them with.
To run tournaments, matches, scoring, teams and leaderboards, and to check eligibility rules based on your age and locality.
To take payments, calculate fees, issue refunds, credit and pay out wallet balances, and keep the accounting records the law requires.
To verify identity before we pay money out, and to meet our obligations against fraud and money laundering.
To send you notifications you have asked for, and service messages about your account.
To keep KirKit safe: checking the text you submit against a list of prohibited terms before it is published, reviewing reports, removing content that breaks our rules, honouring the blocks you set, and acting against accounts that abuse the platform.
To fix faults, measure how features are used, and improve the app.

5. What everyone can see, and what you control

KirKit is a social platform, and parts of your account are public by design. Your username, display name, profile and cover photo, bio, playing details, locality, club, career statistics, leaderboard position, teams, follower and following counts, and anything you post publicly are visible to other signed-in users. Your mobile number is visible on your profile to other signed-in players — that is how one player contacts another to arrange a match, and it is why profiles require you to be signed in. Your password, your date of birth, your payment records and your identity-verification details are never shown to other users.

You can block any account, from its profile, from a chat, or from the menu on anything it posted. Blocking works both ways at once: neither of you sees the other's posts, reels, stories, comments or streams, neither of you can message the other, and any follow between you is removed. The person is not told. Your block list is yours alone — nobody can see that you blocked them — and you can undo it at any time from Settings, under Blocked accounts.

6. Who else processes your information

We do not sell your personal information, and we do not share it for anyone else's advertising. We use these service providers to run KirKit:

Cloudflare R2 — stores every photo and video you upload.
Mux — carries and records live streams, and serves video playback.
YouTube (Google) — when a match is streamed on YouTube, the video is played through YouTube’s own player inside the app, so your device contacts Google and Google receives the request as it would for any YouTube video.
Razorpay — processes payments and refunds.
MSG91 — delivers the one-time codes we send to your mobile number.
Google Firebase Cloud Messaging — delivers push notifications. Google Sign-In authenticates you if you choose that route.
Our identity-verification partner — performs the Aadhaar check described above.
Sentry — receives error and crash diagnostics.
Our hosting and database providers — run the servers and databases KirKit needs to work.

We also disclose information when the law requires it — a valid order from a court or a government agency — and when we need to establish, exercise or defend a legal claim.

7. Advertising

KirKit ships with Google AdMob built in but switched off. No advertising SDK is started and no ad request is made while it is off. If we turn advertising on, ads will appear only between posts and reels, and the AdMob SDK will then be able to use your device's advertising identifier to select and measure ads. You can reset or limit that identifier in your device settings at any time. We will update this policy and tell you in the app before ads are enabled.

8. Age

You must be at least 13 years old to have a KirKit account, and you must not create one if you are younger than that. If you are under 18, you may use KirKit only with the involvement and consent of a parent or guardian, and they are responsible for your use of it.

Anything involving money is limited to users aged 18 and over — paying an entry fee or for a promotion, earning into a KirKit wallet, withdrawing money, and being hired as a streamer. We work this out from the date of birth on your account, which is one of the reasons we ask for it.

If we learn that we hold the personal information of a child under 13, we will delete the account and its data. If you believe a child under 13 has an account, write to kirkit@khedmaidan.com.

9. How we protect your information

Traffic between the app and our servers is encrypted in transit. Passwords are stored only as hashes. Sign-in tokens are short-lived, are rotated, and are detected and revoked if one is reused. Your tokens are stored in the device keychain, not in ordinary app storage. Access to production systems is restricted to the people who need it. No system is perfectly secure, so please use a strong password you do not reuse anywhere else, and tell us immediately if you think someone else is using your account.

10. How long we keep it

Your account and profile — while your account is open. When you delete it, the personal detail on the account is erased rather than merely hidden; the Delete Your KirKit Account page lists exactly what goes and what stays.
Posts, reels, stories and comments — until you or we remove them. Removed content is retained in a deleted state for a limited period so we can restore it after a mistake, investigate a report, or answer a legal demand.
Direct messages — until the conversation is deleted. Deleting your account deletes your one-to-one conversations outright, along with every message in them.
Payment and accounting records — retained for at least eight years after the transaction, because Indian tax and company law requires us to keep them. Deleting your account does not delete them.
Identity-verification records — the verified name, date of birth, gender, masked Aadhaar number and check result are retained for five years after your account closes, or longer where the law requires, so we can show the checks behind money we paid out. Deleting your account does not erase them.
Consent records — the fact that you accepted these documents, and which version, is retained for as long as we may need to evidence it.
Reports — reports you filed and reports filed about you are retained so moderation decisions can be reviewed.
Usage events, logs and diagnostics — usage events are deleted when you delete your account; server logs and diagnostics are retained for a limited operational period and then deleted or aggregated.

11. Your rights

You can:

See and correct most of what we hold, directly in the app — your profile, locality, playing details and content are all editable.
Ask for a copy of the personal information we hold about you.
Delete your account from Settings, or ask us to delete it. See the Delete Your KirKit Account page.
Ask us to erase information that we are not required to keep.
Withdraw consent to things that run on consent, such as push notifications, which you can turn off in the app or in your device settings.
Complain to us, and to your data protection authority if you are not satisfied with our answer.

Write to kirkit@khedmaidan.com from the mobile number or account you are asking about, or from inside the app. We will ask you to verify that the account is yours before we act — otherwise anyone could ask for your data. We answer within 30 days.

12. Where your information is processed

KirKit is operated from India, and your information is processed there. Some of the service providers listed above operate globally and may process your information outside India. Where they do, we rely on their contractual commitments to protect it to the standard described in this policy.

13. Changes to this policy

If we change this policy we will publish the new version here and update the "last updated" date shown beneath it. If the change is significant, we will tell you in the app and, where the law requires it, ask you to accept the new version before you carry on using KirKit.

14. Contact us

Support, privacy and data requests: kirkit@khedmaidan.com

Postal address: KhedMaidan, V.P.O Palkwah, Tehsil Haroli, District Una, Himachal Pradesh 177220, India.

Grievance Officer (as required by Indian intermediary rules): Pardeep, kirkit@khedmaidan.com. We acknowledge grievances within 24 hours and resolve them within 15 days.