Privacy policy

Version 3, in force since 3 November 2026

What changed

Says what we keep when you play a season match early, and what the other fans in your season are told; that videos also add Energy and play season matches early, with no daily limit; what we keep of Ad-free's daily unlocks; that Stripe uses your internet address to offer your own currency; and how long the records of a sale are kept for our accounts and taxes. Also says that adults may see ads on the website too, which company shows them, and what it gets.

This policy says what CricMic keeps about you, why, who else handles it, how long we keep it, and what you can do about it. It covers the website at https://cricmic.com and the CricMic apps.

Who is responsible

Nexever Private Limited, Design Place, A-28 (K), Phase 7 Industrial Area, Mohali, Chandigarh Sector 55, Rupnagar, S.A.S. Nagar (Mohali), Punjab 160055, India (corporate identity number U72900PB2016PTC045218), runs CricMic and publishes its apps, and decides how your personal data is used ("we", "us"). Under India's Digital Personal Data Protection Act, 2023, we are the data fiduciary for your data.

For anything about your data, use our contact form or write to support@cricmic.com. For a complaint, write to our Grievance Officer, Amandeep Singh, at grievance@cricmic.com. We acknowledge a complaint within 24 hours and resolve it within 15 days.

What we keep

Your account.

• Your email address, to send your sign-in codes.
• If you sign in with Google, your Google account's id and email address.
• If you sign in with Apple in the iPhone app, Apple's id for you, the email address Apple shares with us (which can be one Apple makes to hide yours), and a key Apple gives us that we use only to end the link with Apple when you delete your account.
• Your handle, and a display name if you give one.
• Your year of birth, so we know your age group.
• Your language.
• The day you last used CricMic, so we can close a guest account nobody uses any more.
• Playing without an account makes a guest account, with no email address and no year of birth.

What you play. Your moves, scores, puzzles, streaks, badges, points, levels and titles; your auctions, squads, team sheets and seasons, which season matches you have watched, and which match days you played early and how (with videos, Ad-free or balls); your Match XI picks, predictions and poll answers; your duels and Versus matches; and your places on the boards.

What you write and do.

• Your chat messages, and the names you give your franchise and your season.
• If you run a page, its name and description, your polls, and the YouTube channel address you give us so we can check the page is yours.
• The reports you send, and the fans you block.
• The messages you send us from our contact form: what each is about, your words, the email address we reply to and your name if you give one, and the page and the app version you wrote from.
• When you accepted these documents, and which version.

Your devices.

• The type and model of your phone or computer, its system and app version, and its screen and memory class.
• If you turn notifications on in the app, the token your phone gives us for them.
• If you turn notifications on in your browser, the push subscription your browser gives us to send them.
• In the app, a check through Google's Firebase App Check that requests come from our real app, and crash reports if you keep them on in Settings.

Your notifications.

• Your notification settings: which kinds you want, and when you'd like to hear that today's puzzles are up.
• Your phone's or browser's time zone, so we keep quiet hours, 22:00 to 08:00 where you are. At night we send only what you are waiting on right then: your Versus opponent, or a live room you joined starting.
• Whether your phone allows notifications, so we never send to one that said no.
• Your notifications from the last 30 days, in your inbox, with when each was sent, read and opened.
• If you tick News from CricMic, a record of each time you tick or untick it, with the version of the words you saw.
• If you play without an account, whether the age check in the app, or the year question on the website, said you are 18 or over, never your year of birth.

Ads in the app (only for a fan of 18 or over).

• When you accepted the notice about Google's ads, and which version of it.
• Each offer of a video: what it would unlock (a puzzle and its day, a Time Machine side, Energy, or your season's next match), your phone's platform, which ad unit, how it went and when, and Google's reference for the ad shown, so you can report it.
• If you have Ad-free, each unlock it gives you without a video, so it keeps to its daily number.
• The record Google sends us of each video watched: its reference, the ad unit and what came of it.
• How many full-screen ads you were shown today and when the last ad of any kind was, so you see no more than our daily limit.
• Whether you turned video offers off, and whether we made your account ad-free, and until when.
• For banners we keep nothing of yours: we only count them, in totals that never name you.

Ads on the website (only for a fan of 18 or over).

• If you play without an account, whether you told us you are 18 or over, never your year of birth.
• Each offer of a video: what it would unlock, which company served the ad, how it went and when.
• How many full-screen ads you were shown today and when the last ad of any kind was, counted with the app's, so you see no more than our daily limit.

Purchases (only for a fan of 18 or over).

• For each purchase: what you bought, where (Apple, Google Play or Stripe), its price and currency, whether it was a test purchase, and when it was bought, given to you and refunded.
• The reference the store or Stripe gave it (from Apple, its transaction numbers; from Google Play, its order number and a code we make from its purchase token; from Stripe, its payment's and checkout's references), and what they answered when we checked it.
• For a payment through Stripe, the checkout you opened: which pack, its price, whether it was paid, and when it opened, was paid or ran out.
• Your balls, and each change to them: bought, used to refill Energy or to play a season match early, taken back after a refund, or given by our staff, with their note.
• Whether your Ad-free was bought or given.

We never see your card, bank or UPI details, your billing address or the email address of your store account: Apple, Google Play or Stripe keeps them.

Sponsors' promotions. When a sponsor's promotion is on your screen for a second, or you tap its link, we count it by day, by where it showed and whether it was in the app or on the website. We keep no record of which fan saw or tapped it. To count each fan once a day without keeping who they are, we keep a scrambled count that can't be turned back into a fan. To show you a promotion only a few times a day, our server remembers how many you've seen today, for that day alone.

Technical details. Your IP address and your browser's details, which we use to keep CricMic secure, to stop abuse and to set fair limits. The cookies and storage we use are in our cookies policy.

What we don't keep. We never collect your precise location, your contacts or your photos, and never your card, bank or UPI details. Ads in the app and on the website aren't chosen for you from what you do on other apps or websites, we don't track you across them, and we never sell your data.

Why we use it

We use your data with your consent, which you give when you accept these documents, and for the few uses the law allows without it, such as meeting a legal duty. We use it:

• To run CricMic for you: your account, your games, your boards and your matches.
• To keep CricMic safe and fair: stopping abuse, cheating and spam, and checking reports.
• To give you what you bought once, to check each purchase with the store or Stripe, to take it back if the payment is refunded or reversed, to keep purchases for adults only, and to stop repeated refunds after use.
• To show ads in the app to adults who accepted the notice: to offer videos for one more play that is never scored, for Energy, or to play your season's next match early; to make sure each video unlocks once; to space out the videos that play a season match; and to check our records against Google's.
• To show ads on the website to adults: to offer a video for one more play that is never scored, to show a full-screen ad between games, to keep to the day's limits, and to count how ads do in totals that never name you.
• To let you play a season match early: to take the balls it costs, or one of Ad-free's daily number, only once, and to tell the other fans in your season that the day was played early.
• To show sponsors' promotions, and to give each sponsor totals that name no fan.
• To answer the messages you send us, and to keep a record of how we handled a complaint.
• To count how CricMic is used, in totals that never name you, and to find and fix crashes, errors and slow screens.
• To send you the emails you need: sign-in codes, season reminders, and a note when we change these documents and ask you to accept them again. Each reminder email has a link to stop them, Stop these emails, at its foot.
• To send notifications, only if you turn them on, and only the kinds you choose. You can turn each kind off at any time in your notification settings, and every one in your browser's or your phone's settings.
• To send News from CricMic (new games, events, and a note if you've been away), only if you tick its own line, which starts unticked. It comes at most twice a week, never to anyone under 18, and you can untick it at any time as easily as you ticked it.

Under 18s

You must be 13 or older to use CricMic, with an account or without one, and under 18 you need a parent's or guardian's permission.

For anyone under 18 we keep the least we can: the email address you sign in with, your year of birth and a handle, besides what you play. Other fans see only the handle, never a name. If you write to us, we keep the email address we reply to and your words, never a name. We show no ads and no sponsors' promotions, send nothing to an ad service, sell you nothing, do no targeting and send no News from CricMic. The same goes for anyone whose age we don't know.

If we learn that someone under 13 has an account, we delete it. A parent or guardian can write to support@cricmic.com about a child's account.

Who else handles your data

We use a few companies to run CricMic. They handle your data only to provide their service to us, under agreements that protect it:

• Cloudflare: delivers and protects the website and checks for bots.
• Google: signs you in with Google if you choose to, and through Firebase delivers notifications to your phone, checks the app is genuine and collects crash reports.
• Apple: signs you in with Apple in the iPhone app if you choose to, delivers notifications to iPhones and checks the iPhone app is genuine.
• The companies behind your browser (Google, Mozilla, Apple or Microsoft) deliver notifications to your browser, if you turn them on. They can't read what the notifications say.
• Our hosting provider: runs the servers CricMic lives on.

We send our emails, your sign-in codes and reminders, from our own server.

Some companies decide for themselves how they use what they receive, under their own privacy policies:

• Google AdMob shows the ads in the CricMic app, only to a fan of 18 or over who accepted the notice. To show one, Google gets your phone's advertising ID (all zeros on an iPhone, since the app never asks to track you), a rough location from your internet address, your phone and app, and which ads you see and how. Google uses these to show the ad, to count how often you see it, to stop fraud and to measure ads in totals. We ask Google for ads that aren't chosen from what you do elsewhere. With a video we send Google only a number made for that one offer, so we know it was watched: never your name, email, age or account. Google's privacy policy: https://policies.google.com/privacy.
• The company that shows ads on the website. Which one: none yet, since the website shows no ads today. It shows them only to a fan of 18 or over, never on the landing page, the legal pages or while you sign in. To show one, it gets your browser and device, a rough location from your internet address, and which ads you see and how. It, and the advertisers and other companies it works with, including Google, may set and read cookies or similar storage in your browser to show ads, count them, limit how often you see one and stop fraud. We ask for ads that aren't chosen from what you do on other sites. We send it nothing that names you: never your name, email, age or account.
• Apple and Google Play sell balls and Ad-free in the iPhone and Android apps and take the payment. They tell us that a purchase was made, which product and when, and if it is refunded. Apple's privacy policy: https://www.apple.com/legal/privacy/. Google's: https://policies.google.com/privacy.
• Stripe, a payment company, takes the payment when we sell balls or Ad-free on the website or in the Android app. You give Stripe your payment details on its own secure page: your email address, your card or UPI details, the name on your card, and, for a card issued outside India, your billing address. Stripe also uses your device and internet address to stop fraud, and to offer to charge you in your own currency. We send Stripe the pack and its price, our reference for the checkout, your handle in the payment's description, and the email address of your account so it can send your receipt; never your year of birth. Stripe tells us whether you paid, the amount, and if the payment is refunded or disputed. Stripe's privacy policy: https://stripe.com/privacy.

A sponsor gets only the totals we count, which name no fan. Tapping a sponsor's link opens their own site in your browser, where their own privacy policy applies, and we send them nothing about you.

Other fans can see your handle, your badges and your scores where CricMic shows them, and your chat messages in the leagues and rooms you share. If you play in a creator's room, its top fans, with their handles, can be shown on the creator's videos and live streams; a fan not known to be an adult is shown without one. When you play a match day early in a season with friends, the others are told the day was played early, never by whom. Our staff can see who played it and how.

We share data with the authorities only when the law requires it.

Where your data is

Our servers are in Mumbai, India. The companies above may handle your data in other countries. Where that happens, we make sure your data has the protection the law asks for.

How long we keep it

We keep your data while you have an account. Your notifications stay in your inbox for 30 days and are deleted after 35.

A guest account that nobody has used for 60 days is closed, unless it holds a purchase, and what it kept is deleted 30 days later, as for a deleted account below.

Ads: each offer of a video, in the app or on the website, and Google's record of each video watched in the app, is kept for 13 months, to check against Google's monthly payments, then deleted. Today's count of full-screen ads is reset each day.

Sponsors' promotions: the daily totals, which name no fan, are kept with the campaign's records. Today's count of what you've seen goes at the end of the day, and the scrambled counts of fans 40 days later.

Messages you send us are kept for a year after they come, and complaints for three years, as the record of how we handled them, then deleted. Each message is also emailed to our support mailbox, and a complaint to our Grievance Officer too. Those copies are kept for the same time, and our staff delete them on the same schedule.

When you delete your account:

• At once, your email address, handle, name and year of birth are cleared from your account, and the link with Google or Apple is ended.
• You are signed out everywhere, your notification tokens, notifications and notification settings are removed, and your chat messages are hidden and their words deleted.
• At once, your video offers switch and any ad-free days go, and so does Ad-free bought from us.
• Your email address and name are cleared from the messages you sent us; their words stay until their time is up, with nothing naming you. Our staff also delete the copies of those messages in our support and grievance mailboxes.
• Anything our staff had removed for breaking the rules, such as a chat message, stays hidden with its words for 180 days after it was removed, as India's IT Rules, 2021 ask, then its words are deleted.
• Within 30 days, what you kept for yourself alone is deleted: your games and your private seasons, your balls and their changes, your video offers and the ads notice you accepted, and the record of your News from CricMic ticks, which we keep until then as the proof of your consent. Google's records of videos you watched stay until their 13 months are up, with nothing naming you.
• A match day you played early in a season you shared with others stays in that season's record, and within 30 days nothing on it names you. In a private season it goes with the season.
• Your purchases and Stripe checkouts are kept for 180 days after you delete your account, with nothing on them but the account's number, since a store or a bank may still refund or reverse a payment; then they are deleted from CricMic. Our accounts keep the record of each sale that company and tax law require, for as long as they require, usually eight years.
• What other fans were shown, such as boards and matches you played with them, stays without your name on it.

Kept 180 days after you delete your account. India's IT Rules, 2021 ask us to keep the details you registered with for 180 days after an account ends. So we keep your email address, your Google or Apple account's id if you signed in with them, your handle and name, the dates you joined and left, and a record of which versions of these documents you accepted and when, apart from everything CricMic shows or uses. Nobody sees them unless the law requires it, and they are deleted after the 180 days.

Server logs, which can hold IP addresses, are kept for 180 days, as India's cyber security rules (CERT-In's directions of 2022) ask, then deleted.

Backups of our servers are kept for 30 days, so what we delete leaves them within 30 days after.

Your rights

You can:

• get a copy of your data: tap Email me my data in Me on the website or in Settings in the app, and we email it to you as a file, with your purchases, your balls, your Stripe checkouts, your video offers and the season match days you played early in it;
• correct it, since you can change your handle and details in CricMic;
• delete your account, in Settings in the app or at Delete your account on the website;
• take back your consent, or a permission you gave: notifications, each kind in your notification settings; News from CricMic, by unticking it; video offers, by turning them off in the app's Settings (taking back your consent to these documents means deleting your account);
• turn off ads on the website: video offers off in Me (the same switch as the app's), your browser's settings for cookies, Google's Ads Settings page (https://adssettings.google.com) and https://www.aboutads.info;
• name someone to use these rights for you if you die or can no longer use them yourself.

Use our contact form or write to support@cricmic.com for anything you can't do in CricMic itself. A refund of something bought from Apple or Google Play is asked of the store.

If you are not happy with our answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

If you live in the United Arab Emirates

The UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives you the right to know what we keep and why, to a copy of it in a form you can take elsewhere, to have it corrected or erased, to have its use limited or stopped, and to take back your consent at any time. Use them as this policy says, or write to support@cricmic.com. You can also complain to the UAE Data Office.

If you live in the United Kingdom or the European Union

The UK GDPR and the EU's GDPR protect your data too. We rely on:

• our agreement with you (these terms) to run your account, your games and your matches, and to give you what you buy;
• our legitimate interests to keep CricMic safe and fair, to stop abuse, cheating and fraud, and to count how CricMic is used in totals that never name you;
• your consent for notifications, for News from CricMic and for ads in the app, which you can take back at any time;
• a legal duty to keep what Indian law asks us to keep.

You have the right to a copy of your data (also in a form you can take elsewhere), to have it corrected or erased, to have its use limited, to object to our use of it, and to take back your consent. You can complain to the Information Commissioner's Office in the UK, or to the data protection authority where you live in the EU.

Your data is stored in Mumbai, India and handled by the companies above, some of them in other countries. Where the GDPR asks for safeguards when data leaves the UK or the EU, we rely on those it allows, such as the standard contractual clauses in our providers' terms.

Keeping it safe

Everything between your device and CricMic is encrypted. The app's sign-in tokens and the sign-in codes we email are stored scrambled, what the stores and Stripe tell us about a purchase is stored encrypted, and our staff sign in with two-factor codes. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects you, as the law requires.

Changes

We may update this policy. Each version is listed on this page with the date it came into force and what changed. When a change matters to you, we ask you to accept the new version.

Contact

Questions about your data go to our contact form or to support@cricmic.com.