Legal
Privacy Policy
Last updated: 12 July 2026
Kickoff is operated by Rowa Tech ("we", "us"), a company registered in the Kingdom of Saudi Arabia — Commercial Registration No. 7053947060. This policy explains what information we collect, why we collect it, and how to control or delete it.
If you have questions, email support@kickoffsa.com.
1. Information we collect
Information you give us when you register or use the app
- Name (first and last) — to display you to teammates and organisers.
- Email address — to sign you in and to send account messages (verification, password reset).
- Phone number (optional) — to help organisers contact you about a tournament.
- Date of birth — for age-appropriate division placement and to apply our rules for players under 18 (section 5).
- City — to recommend tournaments near you.
- Position and jersey number (optional) — for team rosters and match cards.
- Profile photo (optional) — uploaded to our object storage (Cloudflare R2).
- Team and tournament images (optional) — custom team crest artwork uploaded by captains, and tournament cover images and tournament photos uploaded by organisers. These are also stored in Cloudflare R2.
- Apple ID / Google ID if you sign in with those providers — only the unique identifier and email released to us by Apple/Google. We do not access your contacts, calendar, files, or anything else.
Information generated as you use the app
- Match results, goals, assists, suspensions, team memberships, tournament registrations.
- Push notification token (an Expo push token) so we can send you match reminders and result updates. Notifications are delivered through Expo's push service and then Apple/Google. You can disable push notifications in your phone's Settings.
Information we collect automatically
- Crash and error reports via Sentry. These contain a stack trace, your user id, the device model, and the OS version. They do not contain your email, personal messages, or other user content.
- Standard server logs (IP address, request path) retained for up to 30 days for security and debugging.
We do not collect: precise location, contacts, calendar, microphone audio, browsing history, or advertising identifiers.
2. How we use your information
Each use rests on a legal basis under the Saudi Personal Data Protection Law (PDPL):
- Run your account, let you participate in tournaments, process entry-fee payments and refunds, and send you transactional emails and push notifications related to your tournaments — needed to provide the service you signed up for (our contract with you).
- Show match fixtures, results, and rosters to other participants of the same tournament or team — needed to provide the service.
- Store optional information you choose to add (phone number, position, jersey number, photos) — your consent, which you can withdraw by removing the information in Edit Profile.
- Diagnose crashes, fix bugs (via Sentry), and keep the service secure — our legitimate interest in a working, safe service.
We do not run third-party advertising and we do not sell your data.
3. Who we share with
- Cloudflare R2 — stores profile photos, team crests and custom crest artwork, tournament cover images, and tournament photos. Images are served via short-lived signed URLs.
- Sentry — receives crash and error reports, identified by your user id (not your email).
- Expo — delivers our push notifications; receives your push token and notification content and passes them to Apple/Google for delivery.
- Resend — sends transactional emails (verification, password reset).
- Apple / Google — only when you choose to sign in with those providers, and only the data described above.
- Payment processor (Moyasar) — entry fees are collected by Rowa Tech through Moyasar's checkout. Moyasar processes your card details; we never see or store them. We keep transaction records (amount, status, tournament reference).
- Other tournament participants — your name, profile photo, position, jersey number, and match-related stats are visible to other people in the same tournament or team.
- Tournament organisers — if you are a team captain, the organiser of a tournament you register for can see your phone number so they can coordinate with you.
- Team captains — when you ask to join a team, its captain and co-captain can see your phone number and date of birth (along with your name, position, and stats) to review your request.
- Referees — if you have a referee role, organisers can see your name, phone number, and email to assign you to matches.
Outside the cases above, your email, phone number, and date of birth are not visible to other users. We do not share data for advertising.
4. Data retention and deletion
- Account data is kept while your account is active.
- You can delete your account from Edit Profile → Delete Account. Deletion removes your name, email, phone, photo, date of birth, jersey, and other personal info immediately. Match and tournament records you participated in are anonymised and kept so other players' history stays intact.
- One exception: if you are the captain of a team that still has other active members, or your team is registered in a live tournament, you'll be asked to hand the captaincy to someone else (or disband the team, or wait for the tournament to finish) first. After that, deletion works immediately.
- Payment and refund records are kept as required by Saudi commercial and tax regulations, even after account deletion.
- Crash reports in Sentry are retained for 90 days and then automatically deleted.
- Server logs are retained for 30 days.
5. Children and players under 18
Kickoff is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal information, email support@kickoffsa.com and we will delete it.
Players aged 13–17 may use Kickoff and join tournaments only with the consent of a parent or legal guardian, who should read this policy and our Terms of Service. A parent or guardian can contact us at support@kickoffsa.com at any time to see, correct, or delete their child's data.
6. Security
We use HTTPS for all network traffic, encrypt passwords with bcrypt, store secrets in a managed secret store, and limit access to production data to a small number of engineers. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
7. Your rights
Under the PDPL you can:
- See your data — most of it is visible inside the app on your profile.
- Get a copy of your data — email support@kickoffsa.com.
- Edit your data — Edit Profile inside the app.
- Delete your data — Edit Profile → Delete Account.
- Ask questions or complain — email support@kickoffsa.com.
We respond to requests about your data within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the Saudi Data & AI Authority (SDAIA), the competent data protection authority.
8. Changes to this policy
If we change this policy, we will update the "Last updated" date at the top and, for material changes, prompt you in the app the next time you open it.