iScoreboard Privacy Policy

I. Who We Are and Scope

Controller: Bolo Mobile, Inc. Contact details are in Section X.

Scope: This Policy describes how we collect, use, store, share, and otherwise process information when you use iScoreboard.live, our mobile apps, and related online services. Third parties such as app stores, OS vendors, payment processors, and push providers process information under their own policies and terms.

II. Information We Collect

We process information only as needed to provide services, comply with law, and protect security. What we actually collect depends on the features you use and your choices:

2.1 Account and identity-related information

• Profile elements you authorize via WeChat on supported mobile clients, Huawei ID, Apple ID, or other sign-in methods we support (e.g., avatar, nickname, openId, unionId, or other platform account identifiers as applicable);
• Data needed to complete sign-in, maintain account sessions, handle account linking and deletion requests, and meet security or compliance requirements, such as sign-in timestamps, IP addresses, device identifiers, and authorization or unlinking logs where permitted by law and as required by the platform.

2.1.1 Google Sign-In (versions that offer this feature)

• Choice and purpose: iScoreboard, operated by Bolo Mobile, Inc., provides scoreboards, timers, and match tools. Basic scoring and timers do not require Google sign-in. In Android versions that offer Google sign-in, we process Google identity information only when you choose that option, to identify or create your iScoreboard account, maintain your session, and provide the groups, sync, and other account features available in that version;
• Information accessed: From the ID token returned by Google sign-in, we verify your Google account identifier (sub), verified email address, and name, when provided by Google. The identifier recognizes the same Google user; email and name may initialize your account profile. This sign-in flow does not read your Google profile photo, ask for your Google password, or request permission to read Gmail messages, Drive files, calendars, contacts, or photos;
• Transmission and storage: The identity credential is sent over HTTPS to our authentication server for signature, expiry, and replay-protection checks. We associate the Google account identifier with your iScoreboard account and store email and name as account profile data. This flow does not request an access token or refresh token for continuing access to other Google APIs. Your subsequent iScoreboard session credential is handled separately from the Google identity credential;
• Use and sharing limits: Google sign-in data is used only for these account functions and necessary security processing. We do not sell it, use it for personalized advertising, or use it to train general-purpose AI models. We do not disclose it to third parties except service providers delivering necessary hosting or security services under purpose restrictions, where required by law, or with your separate express authorization;
• Retention and deletion: We retain the Google account association and profile only as long as needed to provide account services. Use the account deletion entry under Me in the app, or contact [email protected], to request deletion. Sections V and VI explain deletion and any necessary security or transaction record retention. Clearing or uninstalling the app does not automatically delete your server account;
• Revoking access: You can remove the iScoreboard connection in your Google Account third-party connections. Revoking Google authorization and deleting data already stored by iScoreboard are separate actions; to erase existing profile data, also request account deletion or contact us. Revocation may prevent further Google sign-in, while basic scoring remains available;
• Google user data commitment: iScoreboard's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own processing is also subject to the Google Privacy Policy.

2.2 Service usage information

• Score data, team names, activity posts and sign-ups, real-time sharing sessions (e.g., WebSocket), and similar feature data—some stored locally on your device and some synced to our servers when you are signed in;
• Diagnostics and usage: device model, OS version, app version, crash logs, performance metrics, feature usage frequency (often de-identified or aggregated); the iOS client and the Android client distributed on Google Play integrate Firebase Analytics, and the Android (Google Play) client also integrates Firebase Crashlytics for crash and stability diagnostics, and related analytics and diagnostic data may be processed by Google as our processor—the iScoreboard.live website is also integrated (see Section 4.3);
• Information you voluntarily send via in-app feedback, customer support, or app store reviews (we anonymize or de-identify feedback where possible for product improvement—see Section III).

2.3 Website cookies, logs, and analytics

• When you visit iScoreboard.live, our servers may log technical data such as time of access, referrer, browser type, and coarse location derived from IP (not precise GPS);
• We may use cookies, local storage, or similar technologies for session management, preferences, or traffic measurement; the site currently integrates Firebase Analytics (Google Analytics for Firebase, added via the Google tag / gtag.js) for web analytics, and related analytics data may be processed by Google as our processor—see Section 4.3 for details. You can control cookies in your browser settings; some features may not work if you disable them.

2.4 Payments and orders

• When you purchase digital goods (e.g., membership), we process order-related data such as order ID, product type, payment status, and time of purchase. The Google Play version sends product identifiers and purchase tokens to our server over HTTPS for verification with Google Play, including payment, renewal, expiry and refund status. For purchases made without app sign-in, verified purchase credentials and entitlement state are encrypted on the device; our server keeps necessary transaction records, which may be linked to the app account after sign-in. We do not ask you to enter full card numbers or payment passwords inside our app; payments are handled by app stores, WeChat Pay, or other licensed payment providers.

2.5 Sensitive information we do not seek by default

• Unless a feature clearly requires it with your separate consent or law mandates otherwise, we do not collect sensitive personal information such as precise location, contacts, SMS, call logs, or biometrics for the purposes described here. Any permission request is explained in the system dialog, and you can revoke permissions in device settings.

2.6 Clipboard (write-only; no reads)

• When this applies: When you use copy share code, copy account ID, copy support contact, or similar actions, the app writes text to the system clipboard so you can paste it elsewhere.
• Purpose: Writing is solely to complete that copy action; the app does not read system clipboard contents, and does not use clipboard data for profiling, advertising, or other purposes.
• Frequency and scope: We do not read the system clipboard (including no access to detect whether paste is available, and no background, timed, or per-frame polling). The app does not provide a “paste from clipboard” feature; if you paste via the system IME in a text field, that is handled by the system/IME without the app actively reading the clipboard.

2.7 Recording (voice notes)

• When this applies: In the mobile clients (iOS, Android, HarmonyOS), you can attach a post-match voice note (up to 60 seconds) to a match record, so you can capture key points and play them back on the record detail page. Voice notes in the Android Google Play local edition are free and do not require sign-in. Sign-in and membership conditions for iOS, Mainland China Android, and HarmonyOS clients depend on the features offered by that client.
• Purpose: Voice notes are recorded for local saving and playback only, for your own reference; they are not uploaded to our servers, are not included in cloud sync or real-time sharing, and are not used for speech recognition/transcription, profiling, advertising, or any other purpose.
• Permission, storage, and backup: We request and use the microphone permission (the corresponding microphone permission on iOS, Android, and HarmonyOS) only when you actively start a recording; the microphone is not accessed otherwise. Audio files are stored in M4A format in the app's private sandbox directory and are not synced with your account. The app currently provides no in-app, system, or cloud backup feature, and voice files are not backed up by the app.
• Retention and deletion: Voice notes are stored locally together with the corresponding match record. You can delete a single voice note, delete the whole match record, or use “Clear all data” in the app to remove them together; deleting a match record also deletes its voice note. Recordings under 2 seconds are discarded automatically; temporary files from canceled, interrupted, or failed recordings are cleaned up automatically.

III. How We Use Information

• Provide, maintain, and improve features (scoring, sharing, activities, sync, account sign-in and linking, account deletion handling, etc.);
• Secure our services, prevent fraud, troubleshoot, and conduct analytics (including de-identified or aggregated statistics);
• Comply with legal obligations and cooperate with lawful regulatory or judicial requests;
• Send important service-related notices (e.g., security, updates to terms or policies); marketing communications only where permitted by law or with your consent;
• Handle your inquiries, complaints, and rights requests.

IV. Sharing, Processors, and Disclosure

We do not sell your personal information. We may share or entrust processing only where lawful, legitimate, and necessary:

• Processors: cloud hosting, analytics, customer support, fraud prevention, and similar vendors bound by contract to safeguard data and process it only as described in this Policy;
• Affiliates: within the scope needed for unified accounts and service experience, subject to this Policy;
• Platform partners: Huawei, Apple, Tencent/WeChat, Tenpay, Google, and other partners as needed for WeChat sign-in, other third-party sign-in, WeChat Pay, in-app purchases, push notifications, and compliance audits, who process data under their own policies;
• Legal requirements: where required by law, litigation, or competent authorities;
• With your consent: other cases where you give separate authorization.

Third-party SDKs: Clients may integrate SDKs or platform capabilities. We strive to list major SDKs, purposes, and privacy policy links in-app (e.g., third-party information sharing list); please refer to the disclosures in the build you install. The iScoreboard.live website currently does not use the WeChat Sign-In SDK or WeChat Pay SDK.

4.1 WeChat Sign-In SDK / WeChat account sign-in capability (if integrated)

• SDK or capability: WeChat Sign-In SDK or WeChat Open Platform SDK (if integrated);
• Developer entity: Shenzhen Tencent Computer Systems Company Limited and its affiliates;
• Applicable scope: supported iOS, Android, and HarmonyOS clients, depending on the build actually integrated; the iScoreboard.live website currently does not apply.
• Purpose: enable WeChat account authorization, sign-in, account recognition, account linking, avatar/nickname display, and cross-client account association;
• Types of information processed: WeChat account identifiers (such as openId, unionId, or similar identifiers returned by WeChat), avatar, nickname, authorization credential, or sign-in status information; the SDK may also process basic information such as device model, OS version, network state, app version, and app identifier to provide sign-in functionality;
• Privacy links: Tencent Privacy Protection Platform; Tencent Privacy Policy.

4.2 WeChat Pay SDK / WeChat Pay capability (if integrated)

• SDK or capability: WeChat Pay SDK and WeChat Pay capability (if integrated);
• Service providers: Tenpay Payment Technology Co., Ltd., Shenzhen Tencent Computer Systems Company Limited, and their affiliates;
• Applicable scope: supported iOS, Android, and HarmonyOS clients, depending on the build actually integrated and the payment page shown; the iScoreboard.live website currently does not apply.
• Purpose: complete purchases of membership and other digital goods, create orders, invoke payment, receive payment result notifications, verify transactions, and handle refunds or after-sales support;
• Types of information processed: order ID, product name or type, payment amount, payment status, purchase time, merchant ID, app identifier, prepay transaction session identifier, WeChat Pay transaction ID, refund ID, and device, network, and transaction security information needed for payment and risk control. We do not collect your full bank card number or payment password.
• Privacy links: Tenpay Privacy Policy; WeChat Pay User Service Agreement.

4.3 Firebase Analytics and Crashlytics (iOS and Android clients, and the iScoreboard.live website)

• SDK: Firebase Analytics (Google Analytics for Firebase); the Android client distributed on Google Play also integrates Firebase Crashlytics (crash and stability diagnostics);
• Provider: Google LLC and its affiliates;
• Scope: the iScoreboard iOS client, the iScoreboard Android client distributed on Google Play, and the iScoreboard.live website (the website uses the same Google Analytics service via the Google tag / gtag.js). Firebase Crashlytics is integrated only in the Android (Google Play) client. HarmonyOS clients, the iScoreboard Lite WeChat mini program, and wearable editions do not currently integrate these SDKs.
• Purpose: measure screen views, app launches and sessions, feature usage, scoring and tool flows, sign-in and sharing outcomes, purchase flows, and in-app purchases so we can understand product use, analyze conversion and retention, and improve the product experience;
• Types of information processed: app-instance identifiers, vendor identifiers (IDFV on iOS; on Android, the Firebase installation identifier and, when provided by the device, the Google Advertising ID (AAID)), device model, operating system and version, device language and time zone, app identifier and version, network information, approximate region inferred from IP, and analytics events such as screen names, feature actions, session state, timestamps, and purchase-related information (such as product identifier, amount, currency, and purchase result). For the website, this also includes Google Analytics cookies or client identifiers, pages and URLs visited, click events, and access times. Google states that it uses IP addresses during collection to provide the service and infer approximate region but does not log or store those IP addresses; the exact scope depends on the enabled SDK features and Google's official documentation;
• The current iOS build uses FirebaseAnalyticsCore without IDFA collection capability and does not link AdSupport, so this SDK does not collect the advertising identifier (IDFA). Firebase Analytics may still process IDFV and a randomly generated app-instance identifier;
• In the Android (Google Play) client, the Firebase SDK declares the AD_ID (and related ad-services) permissions, so analytics may read the Google Advertising ID (AAID) when the device provides it, solely for product measurement and attribution. This build integrates no advertising SDK and the identifier is not used to serve ads. You can reset or delete the identifier in your device settings (Settings → Privacy → Ads), after which Firebase Analytics no longer receives the AAID while other measurement continues;
• We do not intentionally send player or team names, account identifiers, phone numbers, email addresses, place names, note or feedback text, casting codes, notification payloads, raw error text, or other user-entered or directly identifying business content to these SDKs. Analytics events may carry randomly generated object identifiers created by the app (such as a UUID record ID); these identifiers contain no readable content and cannot identify you outside this app;
• Android reporting details: event and parameter names are normalized in-app (lowercase letters, digits, and underscores only; up to 40 characters for names, 100 characters for values, and 25 parameters per event), and reserved fields such as device name, country/province/city, channel, and tokens are stripped before reporting;
• Crash diagnostics in the Android (Google Play) client (Firebase Crashlytics) report crash stacks together with device and app version, OS version, and memory and runtime state, so we can locate and fix crashes; they do not include your business content or account information;
• Data may be processed on Google infrastructure outside your country or region. Where this constitutes a cross-border transfer of personal information, we will provide required notice, obtain separate consent where applicable, and complete other procedures required by law;
• Privacy and data-processing information: Firebase Privacy and Security; Google Privacy Policy; Firebase data collection for Apple platforms; Firebase Crashlytics overview.

V. Storage, Cross-Border Transfers, and Retention

• We generally store personal information in mainland China. If a cross-border transfer is needed, we will follow applicable law (e.g., security assessment, standard contractual clauses, certification, or separate consent) and provide required notices.
• Score data may exist both locally on your device and on our servers when you are signed in and use sync; you can delete local data via app features, uninstalling, or clearing app data.
• Local storage: To provide our services, different clients may store feature data on your device, including: scoring and timer match records, session data to resume interrupted matches, common names and places, local bookings, user preferences (such as sound, vibration, appearance, language), and sign-in credentials (encrypted). Voice notes (see 2.7) are stored locally on the device only. You can manage local data via the relevant in-app features, clearing app data, or uninstalling; local storage on each client has a reasonable capacity limit, and the oldest data is cleared automatically on a first-in-first-out basis when the limit is reached.
• We retain information only as long as necessary for the purposes described unless a longer period is required or permitted by law. After that, we delete or anonymize data.

VI. Your Rights

Where applicable law grants you rights over your personal information—such as access, copy, rectification, supplementation, erasure, restriction or objection to certain processing, withdrawal of consent, account deletion, and portability—we will respond in accordance with the law.

• Access and rectification: Manage nickname, avatar, and similar fields in-app or via the identity provider that manages your account;
• Erasure and account closure: The app now provides an account deletion feature. After signing in, you can start deletion from the relevant entry under Me in the app (the exact label and path depend on your installed version), confirm as prompted, and submit your request. After deletion is completed, we delete or anonymize most personal information linked to your iScoreboard account, including profile data (such as nickname, avatar, and email), third-party sign-in bindings, membership benefits, feedback you posted and related comments/likes/reports, and common names/places synced to our servers, and we immediately revoke sign-in for that account. This action cannot be undone. It closes only your iScoreboard account and does not delete your WeChat, Apple, Huawei, or other third-party accounts. For security and legal compliance, we may verify your identity before processing. Please note: (1) Local data on your device (such as on-device score records, bookings, common names, and preferences) is not automatically deleted when you delete your account; you can uninstall the app or clear app data yourself; (2) where required by law, we may retain or de-identify certain transaction, security audit, or dispute-related information for the period required by law, then delete or further anonymize it. If you only want to delete some data without closing your account, contact us via in-app Help & Feedback or the contacts in Section X.
• Withdraw consent: For processing based on consent, you may withdraw via system permissions, feature toggles, or by contacting us; withdrawal does not affect prior processing that was lawful;
• How to exercise rights: Use in-app Help & Feedback or the contacts in Section X. We will respond within statutory timelines and may verify your identity for security.

VII. Children

We take minors' privacy seriously. If you are under 14, please use our services with a guardian's guidance and consent. Guardians may contact us via Section X with questions about children's information.

VIII. Security

• We use administrative and technical measures consistent with industry practice (e.g., access controls, encryption in transit and at rest where appropriate, security reviews).
• No method of transmission or storage is completely secure. If you believe your information is at risk, please contact us promptly so we can take reasonable steps.

IX. Changes to This Policy

We may update this Policy for business, technical, or legal reasons. For material changes, we will notify you by reasonable means such as website notices, in-app prompts, or push messages. The updated Policy takes effect on the date stated at the top or in the notice; continued use constitutes acceptance unless law requires separate consent.

This Policy is provided in Simplified Chinese, Traditional Chinese, and English for users with different language preferences. The versions are kept consistent; in case of any discrepancy among language versions, the English version prevails.

X. Contact Us

• In-app Help & Feedback;
• Email: [email protected];
• Company: Bolo Mobile, Inc.

We generally respond within 15 business days (complex cases may be extended as permitted by law).

XI. Platform-Specific Supplements

These supplements describe common differences by channel. They do not limit features you do not use or future releases. If they differ from the general sections above, the disclosure that better matches your actual use and does not reduce your statutory rights prevails.

11.1 Website (iScoreboard.live)

• Cookies, local storage, and server logs may be used; Firebase Analytics (Google Analytics for Firebase, added via the Google tag / gtag.js) is currently integrated to measure traffic sources, page views, and click interactions; related data is processed by Google as our processor—see Sections 2.3 and 4.3;
• The website currently does not integrate the WeChat Sign-In SDK or WeChat Pay SDK. If the site offers downloads, payments, or account pages in the future, those flows are governed by this Policy plus any on-page notices.

11.2 iOS app

• WeChat sign-in may be supported; OS permissions (e.g., notifications, photo library for screenshots, network access) are requested only as needed for features, as shown in system dialogs and in-app notices;
• Firebase Analytics: integrated in the iOS client for product usage measurement and analytics. See Section 4.3 for the processing scope, purposes, and third-party information; the Android (Google Play) client is covered in 11.3 and Section 4.3, and the website integration in 11.1;
• Recording (voice notes): The iOS app provides post-match voice notes (up to 60 seconds, requires sign-in and membership); the microphone permission is requested and used only when you actively record. Voice files are stored in the app's private directory for local playback only, not uploaded to servers and not used for speech recognition/transcription (see 2.7);
• Local storage: match records, timer records, common names/places, local bookings, and preferences are stored locally on the device (files, preference storage, and Keychain-encrypted credentials, etc.); you can manage them via in-app features or by uninstalling the app;
• If you use Sign in with Apple, Apple in-app purchases, WeChat Pay, push notifications, or similar capabilities, related data is processed by Apple, Tencent/WeChat, Tenpay, or the relevant provider under their own rules; for WeChat sign-in, we process only the information needed for account recognition, linking, and display within the granted scope.
• The iOS app is published and distributed on the Apple App Store by Bolo Mobile, Inc. (the App Store publisher), which is also the controller referred to as "we" in this Policy.

11.3 Android app

• Android apps may be downloaded, installed, or updated through Google Play or official APK download pages; store pages, downloads, updates, reviews, accounts, payments, and similar processing are governed by the relevant channel rules and privacy policies;
• Analytics and crash diagnostics: the Android client distributed on Google Play integrates Firebase Analytics (product usage measurement) and Firebase Crashlytics (crash and stability diagnostics), with related data processed by Google as our processor; see Section 4.3 for the collection scope, the AD_ID permission, and your controls. This build integrates no advertising SDK; for other Android distribution builds, the SDKs actually bundled in that build apply;
• WeChat sign-in and WeChat Pay may be supported; device model, OS version, and app version may be used for compatibility and diagnostics; push may use system or vendor channels;
• Clipboard: as described in Section II.2.6, the app does not read the system clipboard; it only writes when you use copy-related features;
• Recording (voice notes): The Android app provides post-match voice notes (up to 60 seconds). Voice notes in the Google Play local edition are free and do not require sign-in; sign-in and membership conditions for Mainland China Android builds depend on the features offered by that build. the microphone permission is requested and used only when you actively record. Voice files are stored in the app's private directory for local playback only, not uploaded to servers and not used for speech recognition/transcription (see 2.7);
• Local storage: match records, timer records, common names/places, local bookings, and preferences are stored locally on the device; credentials such as sign-in tokens are encrypted and stored per system security requirements; you can manage related permissions in system settings, and manage local data via in-app features or by uninstalling the app;
• Storage, notifications, and other permissions map to specific features and can be managed in system settings.

11.4 HarmonyOS app

• WeChat sign-in and WeChat Pay may be supported, and Huawei ID sign-in, Huawei in-app purchases, Huawei Push, and similar services may also be used; identifiers and permissions follow HarmonyOS rules and the relevant third-party terms;
• Recording (voice notes): The HarmonyOS client provides post-match voice notes (up to 60 seconds, requires sign-in and membership); the microphone permission is requested and used only when you actively record. Voice files are stored in the app's private directory for local playback only, not uploaded to servers and not used for speech recognition/transcription (see 2.7);
• Local storage: match records, timer records, voice notes, common names/places, local bookings, and preferences are stored locally in the app (relational database, preference storage, and app sandbox directories); credentials such as sign-in tokens are encrypted and stored per system security requirements;
• Distribution may include Huawei AppGallery and other HarmonyOS ecosystem channels.

11.5 Sports watch and wearable editions

• Features may be limited compared to phone apps; networking and sync with a phone or cloud may transmit and store scores or settings;
• Exact networking behavior, sync scope, and permissions are described in that edition's in-app notices and OS prompts.