Privacy Policy

Last updated: 29 July 2026

Sportilink is a sports community platform. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to the Sportilink mobile app and the Sportilink website.

We process personal data in accordance with Law No. 27 of 2022 on Personal Data Protection of the Republic of Indonesia (UU PDP).

By creating a Sportilink account you confirm that you have read this policy. Where we rely on your consent — in particular for precise location, identity verification documents, and the Meet feature — we ask for that consent separately, and you can withdraw it at any time as described in section 10.

1. Information You Provide

Account details: name, username, email address, phone number, and login credentials.
Profile details: profile photo, date of birth, gender, sports, skill levels, description, and sport preferences.
Content you create: clubs, match sessions, events, tournaments, venues, coach profiles, marketplace listings, chat messages, commendations, reports, and feedback.
Identity verification documents — only if you choose to verify: a photograph of your government-issued ID card and a selfie holding that ID. See section 3.
Meet and Seeker profiles — only if you choose to use those features: the interests you select, your written description, the age range and genders you want to be matched with, your skill levels, and your availability schedule. See section 4.
Payment-related information: payment instructions you publish as an organiser, invoice amounts, and payment receipts you upload as an image.

2. Information We Collect Automatically

Location: your device location, when you grant location permission. See section 5.
Device and push data: a Firebase Cloud Messaging token so we can deliver notifications, plus device platform and app version.
Usage and analytics: which screens you open and which key actions you take, such as signing up, creating a session, or joining a club. See section 7.
Technical logs: IP address, timestamps, and error information generated when your device communicates with our servers.

3. Specific (Sensitive) Personal Data

Under UU PDP, some of the data we handle is classified as specific personal data and receives extra protection.

Identity documents. If you choose to become a verified host, you upload a photo of your ID card and a selfie holding it. We use these only to confirm that you are a real, identifiable person and to unlock host features and the Partner interest in Meet. We do not sell them, do not use them for advertising, and do not show them to other users. Only authorised Sportilink administrators reviewing your verification can view them, and they are excluded from every public response our servers return.
Data revealing romantic interests. If you enable the Partner interest inside Meet, the fact that you are looking for a romantic partner — together with the genders and age range you select — is personal data that can reveal information about your relationship status and sexual orientation. We collect it only if you switch that interest on yourself, we use it only to build your Meet deck, and you can remove it at any time by editing or pausing your Meet profile.

Providing this data is always optional. Sportilink is fully usable without identity verification and without Meet.

4. Meet, Session Seeker, and Club Seeker

These features exist to introduce you to other people, so by design they show some of your information to users you have not met.

Meet shows other users your display name, profile photo, age in whole years (never your date of birth), gender, your written description, your selected interests, sports and skill levels, whether you are identity-verified, and an approximate distance from them.
Session Seeker and Club Seeker show your name, username, profile photo, age, gender, sports, levels, interests, availability window, and an approximate distance.
Distances are always rounded and are never shown below a minimum floor, so your exact position cannot be inferred from them. We never share your coordinates with another user.
Meet applies mutual filtering: you appear only to people whose preferences you match and who match yours.
The Partner interest additionally requires identity verification and a minimum age of 18, checked when you save your profile, when your deck is built, and when you swipe.
Your swipes are stored so that we do not show you the same person twice and so we can tell you when two people have liked each other. We never tell someone that you passed on them.
You can pause any of these profiles at any time, which removes you from other people's results immediately.

5. Location

We store only your most recent location. Each update overwrites the previous one — we do not build a location history or a movement trail.
We use it to show nearby clubs, sessions, events, venues and courts, to order Meet and Seeker results nearest-first, and to notify you about new sessions within the radius you chose.
Other users never receive your coordinates, only a rounded distance as described in section 4.
You can refuse or revoke location permission in your device settings. Nearby and Seeker features will stop working or fall back to a non-geographic ordering; the rest of Sportilink continues to work.

6. How We Use Your Information

To create and operate your account and profile.
To provide the features you use: clubs, sessions, events, tournaments, venues, courts, coaching, marketplace, chat, leaderboards, badges, and activity points.
To introduce you to other users through Meet, Session Seeker, and Club Seeker.
To send notifications you have asked for, such as session invitations, chat messages, matches, and sessions that fit your availability.
To verify identity where you have requested it.
To keep the platform safe: investigating reports, enforcing our Terms of Use, detecting fraud and abuse, and applying warnings, suspensions, or bans.
To measure how people find and use Sportilink so we can improve it.
To comply with legal obligations and respond to lawful requests from authorities.

7. Analytics

We use Google Firebase Analytics to understand how people discover and use the app — for example, how many people who install the app go on to create a session. Before any event leaves your device it passes through an allowlist that strips identifying information: we do not send your name, email, phone number, exact location, message contents, or free text you have written. Analytics is disabled entirely in our development builds.

Firebase Analytics is operated by Google, which acts as our processor for this data and may store it on servers outside Indonesia.

8. Who We Share Information With

We do not sell your personal data. We share it only with:

Other users, strictly as described in section 4 and through your public profile.
Service providers who process data on our behalf, under contract and only on our instructions: Google Firebase (analytics and push notification delivery); our file storage and content delivery provider (profile photos, uploaded images, identity documents, and payment receipts); our email delivery provider (verification codes, login links, and service emails); and our messaging provider (WhatsApp verification codes, where you choose that channel).
Authorities, where we are legally required to disclose, or where disclosure is necessary to protect the safety of a person or the integrity of the platform.

International transfers. Some of these providers store data outside Indonesia. Where that happens we rely on the provider's contractual data-protection commitments and take reasonable steps to ensure your data receives a comparable level of protection, as required by UU PDP.

9. How Long We Keep Your Information

Account, profile, and content: for as long as your account exists.
Location: only the single most recent value, until it is replaced or your account is deleted.
Identity verification documents: while your verification is active, and deleted within 90 days after you withdraw verification or delete your account, unless we are required to keep them longer to comply with law or to resolve a dispute.
Chat messages: while your account exists. A message you sent remains visible to the person who received it.
Payment records and receipts: for the period required by applicable Indonesian tax and accounting law.
Analytics events: according to the retention period configured in Google Analytics.
Moderation records such as reports and bans: retained after deletion where necessary to keep banned users off the platform.

10. Your Rights

Under UU PDP you have the right to:

be informed about how your data is processed;
access the personal data we hold about you and obtain a copy of it;
correct or update inaccurate or incomplete data;
delete your data and withdraw your consent;
object to or restrict certain processing;
request that we stop processing and delete your data; and
lodge a complaint.

You can exercise most of these directly in the app: edit your profile, pause or edit your Meet and Seeker profiles, revoke location permission in your device settings, turn off notifications, and delete your account. For anything else, contact us at [email protected] and we will respond within the time required by law.

11. Deleting Your Account

When you delete your account we remove your account record and profile data, your Meet, Session Seeker and Club Seeker profiles and swipes, and your uploaded images including any identity verification documents, within 90 days.

Some things do not disappear:

Messages you sent remain in the recipient's conversation.
Content that belongs to a group — a club, a session, an event, a tournament result — may remain, with your name removed or replaced.
Records we must keep for legal, tax, security, or dispute-resolution reasons.
If your account was banned, we keep the minimum information necessary to enforce that ban.

12. Children

Sportilink is not intended for children under 13, and you must be at least 13 to create an account. The Meet feature is available only to users aged 18 and over. If you are between 13 and 18, your parent or guardian must consent to your use of Sportilink, and their consent is required for us to process your data. If we learn that we have collected data from a child below the applicable age without valid consent, we will delete it.

13. Security

We protect your data with access controls, hashed credentials and verification codes, encrypted transport, and strict separation of sensitive fields — identity documents, phone numbers, email addresses, and verification codes are excluded from the data our servers return to other users. No system is perfectly secure, but if a personal data breach occurs we will notify you and the relevant authority within 3 x 24 hours, as UU PDP requires.

14. Changes to This Policy

We may update this policy. When we make a material change we will update the date at the top and notify you in the app before the change takes effect. Continuing to use Sportilink after that means you accept the updated policy.

15. Contact

Questions, requests, or complaints: [email protected]