Privacy Policy

1. Introduction

GameTab ("we", "our", or "us") is a sports group management app developed by Nexavyn (ABN: 21 696 400 476), a sole trader business based in Australia. It helps you organise, join, and participate in local sports games and tournaments. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what choices you have.

By using GameTab, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the app.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Full name (first and last name)
• Email address
• Password (stored as a secure hash — never in plain text)
• Username (auto-generated from your name on signup, with a neutral fallback when your name cannot be converted into the supported username characters; a unique public identifier)
• Your acceptance of the current Terms of Service and Privacy Policy (version, context, and acceptance time), and your confirmation that you are at least 16. We record the attestation, not your date of birth.

2.2 Profile Information

All profile details in this section, including the sex selection described below, are voluntary. Edit Profile lets you choose Male, Female, or Prefer not to say, or leave the selection blank; you can change or clear it later.

• Sex selection (Male, Female, Prefer not to say, or left unanswered). This is stored in your account profile under the technical field name gender. It chooses male, female, or neutral artwork for your own Home screen, and it is shared with the admin team (Owner, Co-admins and Managers) of each group you belong to, to help them organise games, tournaments and group activities and understand who takes part in their group. Choosing Prefer not to say, or leaving it unanswered, selects neutral artwork, and your group admins see only that choice.
• Phone number (optional on your profile and optional when submitting a request to join a group — you can leave it blank)
• Suburb/City, State/Region, and Country (manually typed or picked by you — an approximate locality only, so other players know roughly where you are based; we never ask for your home street address and do not store raw device GPS coordinates in your profile)
• Profile photo
• Bio / short description
• Sport interests and skill levels

Private group player ratings: a group's Owner or Co-admin may assign a player rating from 1 to 10 to help balance teams. All admin tiers in that group can view the rating. It is not shown to ordinary members, including the rated player, or on public profiles. The rating is deleted when the player's membership ends, including on account deletion.

2.3 Game and Group Activity

When you participate in groups and games, we record:

• Groups you create or join
• Games you register for or create (dates, times, venue name, participant status)
• Your participation status: Confirmed, Waitlisted, or Cancelled
• Game venues (place name and address text)
• Group locations (place name and address, plus approximate latitude and longitude generated from that address to support nearby-group search — these are venue coordinates, not your live device location)
• Your device's approximate coordinates, but only if you tap "Use my location" in Explore — these are rounded to roughly 100 metres, sent to our servers solely to run that one nearby-group search, and are not stored in our database or linked to your account (see Section 3.6)
• Optional public group-admin contact details and visibility choices, such as an email address, phone number, or WhatsApp number displayed on a public group profile
• Tournament participation and scores you submit
• Personal weekly goals and weekly outcome history, such as target, sport, matches, wins, losses, win rate, and completion status. These are visible only to you.

2.4 In-App Communications

• Group chat messages within a group
• Game chat messages within a game (including "Notify Team" updates such as running late or can't make it)
• Direct messages between group admins and members
• Message metadata: emoji reactions, @mentions, replies, edits, and pinned status
• Announcements you author (admins) and comments you post on group announcements
• Emoji reactions ("likes") on announcements and read/seen status
• Whether you saved or bookmarked an announcement, and when you saved it
• Poll votes
• Feedback and support messages you submit within the app. Bug reports can include device details you choose to give us (phone type and model, and app version)

2.5 Credits, Billing and Transactions

• In-app credit balance per group
• Credit transactions (amounts, dates, type, and notes)
• Credit requests sent or received between group members
• Subscription records for Admin Plan users (plan history, trial dates). Only a group's Owner holds an Admin Plan subscription; a Co-admin or Manager uses the Owner's plan and does not have a separate subscription of their own.
• Admin Plan subscription status received from the app store: which plan and version (Standard or Plus) the Owner holds, when it renews or expires, whether it is set to auto-renew, and a store transaction identifier
• The number of unique members across the groups you own, and the number of groups you own, used to determine which plan size applies. Groups where you hold the Co-admin or Manager role are not counted towards your own plan size.
• Whether we have already sent you a given billing notice — such as a trial-ending reminder — so that each is sent only once

2.6 Notification and Push Token Data

• Device push notification tokens (to deliver alerts to your device)
• Your notification preferences (per type and per group)
• In-app notification history (type, message, timestamp)
• A short-lived server-side delivery queue entry — the notification text, its type, the group it relates to, and the recipient — held while the notification is waiting to be handed to Apple or Google, and deleted shortly afterwards (see Section 7.5)

The app also derives your current unread-notification count from these existing notification records. On supported devices that count may be shown on the GameTab app icon as a badge. The badge itself is a device display setting; it does not create a new profile or activity record.

2.7 Device, Session, Security and Safety Data

• Device platform (iOS or Android) — used only for targeted push notification delivery
• Authentication session tokens (stored locally on your device and sent with your requests to authenticate them)
• If you enable multi-factor authentication (MFA): one-time email verification codes, delivered to your email address via our email provider (Resend — see Section 5.2), stored as a hash (not plain text) once generated, expiring 10 minutes after being sent and purged from our database within 24 hours; the account identifier and time of each accepted code request, kept for up to 24 hours to enforce email limits; plus a record of which sessions have completed MFA verification
• While you have a chat screen open, a short-lived "presence" record so we can avoid sending you push notifications for a conversation you are already viewing (removed when you leave the screen)
• Reports or complaints you submit, or that concern your content or conduct, together with the reason given, an excerpt of reported messages or comments, the reported announcement title, text and available image, related moderation actions, and the outcome (see Sections 4.1 and 7.6)
• Whether your account is currently restricted or suspended for safety, security, misuse, or Terms enforcement
• Group-level block records showing the group, blocked account, which admin (Owner, Co-admin, or Manager) applied the block, and time of the action
• Your personal block list — if you block another user, we store who you blocked so their content can be hidden from you and direct messages between you can be prevented. The person you block is not told, and your block list is not visible to other users.
• Which direct-message conversations you have chosen to hide from your own chat list

2.8 Information You Provide About Others

• Guest players: group admins (Owner, Co-admin, or Manager) can add a guest player to a game by entering the guest's name. If you add a guest, you must have that person's permission. Guest names are visible to game participants and are included in the group's game records. Guests are not counted towards the group Owner's plan size and are not used for billing.
• Score entries: when logging personal scores you may enter a partner or opponent name as free text.

If your name has been entered by another user and you would like it removed, contact us at [email protected].

2.9 Group Payment Details (Admin-Entered)

Any of a group's admins — Owner, Co-admin, or Manager — can optionally add payment details (such as a PayID, BSB and account number, or similar) to the group's info page, so members know how to pay membership or session fees directly. This information is visible only to current members of that group — never to the public or to non-members browsing Explore Groups. GameTab does not process, verify, or store any actual payment made using these details; any such payment happens directly between the member and whichever admin collects it, exactly as described for G-Credits in Section 2.5.

2.10 Personal Venue Library (Admins)

Admins can save venues for reuse across groups. A saved venue may include a label, place and address, the groups it is tagged to, an optional booking link, venue contact name and phone number, notes, use count, and last-used time. The Venue Library is private to the admin who created it, with one exception: if you tag a venue to a group that has other admins (an Owner, Co-admin, or Manager besides you), those other admins can see that venue's name and address only — its booking link, contact name, contact phone number, and notes stay visible only to the admin who saved it. When an admin selects a saved venue for a group, game, template, or tournament, the relevant venue details become part of that shared activity and are visible to the users who can view it.

3. Device Permissions

GameTab requests the following device permissions. Each is requested only when the relevant feature is used, and you can manage or revoke them at any time from your device Settings.

3.1 Camera

• Why: To take a photo when updating your profile picture
• When asked: Only when you tap "Take Photo" in profile settings
• Data handling: Photo is resized on your device and uploaded to our cloud storage (see the image storage note below). No other camera access occurs.

3.2 Photo Library / Media

• Why: To select a photo for your profile picture, a group's cover image, or an announcement image; and to save an image to your library when you explicitly request it (for example, saving a shared game card)
• When asked: Only when you tap "Choose from Gallery" (or save an image)
• iOS Limited Access: We fully support iOS Limited Photo Access. If you grant limited access, only photos you select are visible to the app.
• Data handling: Selected photo is uploaded to our cloud storage. We do not browse or scan your photo library.

3.3 Share Invitations (No Contacts Permission)

• Why: To let you share invite text using any app you choose
• When used: Only when you tap "Share invite via any app"
• Data handling: Recipient and app selection are handled by your device and selected app, not by GameTab

3.4 Calendar

• Why: To add game reminders to your calendar so you never miss a match
• When asked: Only when you choose to add a game to your calendar
• Data handling: Events are written to your device calendar only. No calendar data is sent to our servers.

3.5 Push Notifications

• Why: To alert you about new games, player updates, reminders, group announcements, and messages
• When asked: On first app launch after login
• Data handling: A push token is stored in our database linked to your account, and deleted when you log out. You can customise notification types within the app and mute individual groups.
• App-icon badge: On supported devices, GameTab may show the number of unread in-app notification records on the app icon. Marking notifications read, returning the app to the foreground, or signing out refreshes or clears that device display.
• Android system permissions and channels: On Android, the app also declares the standard notification-delivery permissions (post notifications, exact alarm scheduling, and restart-after-reboot) used solely so reminders and notifications arrive reliably. Pushes are placed into system categories such as Games, Chat, Groups, Credits, Plan & Billing, and Other so you can control categories in Android Settings. These controls are managed by Android and are not used to collect additional data.

3.6 Location

Game and group venues are entered as addresses by you or your group admin. For a group location, GameTab may use OpenStreetMap Nominatim to convert that address into approximate latitude and longitude and store those venue coordinates so nearby groups can be found. These coordinates describe the entered venue or locality; they are not your live device location and are not used to track your movements.

The Explore tab includes an optional "Use my location" feature. If you tap it, GameTab requests your device's GPS location (foreground only, and at reduced accuracy) to find groups near you. To run that search, your coordinates are sent to GameTab's servers, which rank and filter groups by distance from you. Before they are sent, the coordinates are rounded to roughly 100 metres — precise enough for a 5–20 km radius search, but deliberately coarser than your exact position. These coordinates are processed in Australia, are used only for that single search, and are not saved to your profile or stored in our database. As with any request to our servers, the request itself may appear briefly in routine infrastructure logs. We do not use your location to track your movements or build a location history, and the app never requests location silently or in the background.

Third-party geocoding: Separately, when you use "Use my location", your device sends your GPS coordinates to Apple Maps (iOS) or Google Maps (Android) to resolve them into a place name — for example, "Norwest, NSW, Australia". That lookup is performed by your device's operating system and is subject to Apple's and Google's respective privacy policies. GameTab uses only the resulting place name, which is shown to you as the label for the active location filter.

4. How We Use Your Information

4.1 Automated Content Screening

When you send — or later edit — a group chat message, game chat message, direct message, announcement comment, or announcement title or body, the text is checked automatically on our servers against a list of prohibited terms before it is stored. If it matches, the text is refused at the point of sending and you are shown a message asking you to reword it. Nothing is posted, and the refused text is not stored or added to your account record — we do not keep a log of blocked attempts.

This check is a fixed keyword comparison, not artificial intelligence or profiling. It looks only at the text of the message you are sending; it does not consider who you are, your history, or anything else about you, and it does not by itself restrict, suspend, or penalise your account. It also includes simple checks for deliberately disguised spellings. Because it is a blunt word match, it can occasionally refuse a message that was not intended to breach our rules — you can simply reword and send again, and you can contact [email protected] if you believe a term is being blocked in error.

Screening applies to text only. Uploaded images are not scanned automatically; they rely on the reporting process described in the Terms of Service.

Safety and Terms enforcement: We may review information reasonably relevant to a report, suspected misuse, fraud, security incident, or breach of our Terms, and use it to investigate the issue and decide whether proportionate action is needed. Action may include content moderation, a warning, feature restrictions, temporary suspension, or account termination as described in the Terms of Service. Misuse-related suspension or termination decisions are made or reviewed by a person; we do not currently terminate accounts solely through automated decision-making. Separately, and unrelated to misuse, Admin Plan features and the groups you administer are paused automatically when your subscription or free trial ends, as described in the Terms. You may contact [email protected] if you believe an enforcement action was made in error.

5. How We Share Your Information

5.1 With Other GameTab Users

Public profile fields. Your name, username, profile photo and account-creation time can be retrieved through GameTab's public-profile endpoint without a signed-in account. Your city, state, country, bio and sport skills are also public when you leave their corresponding Profile Privacy toggles on; each is returned as no value when its toggle is off. The app normally displays these fields in relevant group, game, tournament and member contexts, but the underlying endpoint is not restricted to people who share a group with you.

The following shared activity is visible to other members within the relevant groups or activities:

• Your game participation status (Confirmed / Waitlisted / No-show)
• Comments you post on announcements and your announcement likes
• Polls show live totals to current members of the relevant group. For an Open poll, those members can also see which option or options you selected before, during, and after voting. For a Private poll, other ordinary members cannot see how you voted; relevant group admins can access the option-linked vote breakdown to manage and finalise the poll
• Messages, reactions, @mentions, and edits you post in a group chat (visible to that group), a game chat (visible to that game's players), or a direct message (visible to the other participant)
• Scores and results you submit, leaderboard standing, and tournament participation

The following is visible only to group admins (Owner, Co-admin, and Manager) of groups you belong to or have requested to join: your phone number, shared so the group's admins can contact you about your membership or request; and your G-Credit balance and transaction information for that group, so the admins can see and — except for a Manager, who can view but not change credits — administer group credits.

Your sex selection is visible to the admin team (Owner, Co-admin, and Manager) of each group you belong to, but not to the admins of a group you have only requested to join. They can use it to organise games, tournaments and group activities, and to understand who takes part in their group.

If a group admin chooses to publish group contact details, the selected group email address, phone number, or WhatsApp number is visible to people viewing that public group's profile. Admins control which details are published and should use contact details suitable for public display.

The following is never included in the public-profile endpoint or visible to another ordinary user through GameTab: your account email address, password, phone number and sex selection (except to the relevant group admins as described above), notification/privacy settings, MFA state, plan data, and device information. Your personal performance statistics and weekly goals are visible only to you. Your G-Credit balance and transaction information are visible only to you and the relevant group's admins.

5.2 With Service Providers

We do not sell, rent, or trade your personal data. We do not share personal data with advertisers or data brokers. We do not use your data for third-party advertising tracking, behavioural profiling, or targeted marketing of any kind.

This website. The GameTab pages on nexavyn.com — including this one — load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Loading a font discloses your IP address and browser details to Google, whose handling is governed by Google's Privacy Policy. Apart from that, these pages set no cookies, run no analytics or advertising scripts, and do not track you. The GameTab app does not use Google Fonts.

5.2a Where Your Data Is Processed (Overseas Disclosure)

Your account data, app content, and uploaded images are stored in Australia (our database and file storage run on Supabase infrastructure hosted in the AWS Sydney region, ap-southeast-2).

Some of the service providers listed above process limited data outside Australia, primarily in the United States:

• Sentry (US) — crash diagnostics, performance traces, session stability, and navigation breadcrumbs with an anonymised user identifier
• Expo (US) — push notification routing (device tokens and notification content) and over-the-air update delivery (app version, platform, and update-channel information; no personal account data)
• Resend (US) — transactional email delivery (email address and email content, including MFA one-time login codes when MFA is enabled)
• RevenueCat (US) — Admin Plan subscription management (account identifier, plan held, store subscription identifiers; no payment details)
• Apple / Google — push delivery and, if you use "Use my location", on-device geocoding, under their own global infrastructure and policies

We only share with these providers the minimum data needed for their function, as set out in the table above.

5.3 App-Initiated Device Actions

Certain in-app actions open your device's native applications without sending data through GameTab:

• Phone Dialler — when a group admin taps a member's phone number, GameTab opens your device's native dialler with the number pre-filled. No call is initiated, recorded, or routed through GameTab. This action requires no additional device permission.
• Maps — when a user taps a game location, GameTab opens the device's Maps application with a pre-filled address. No location data is sent to or processed by GameTab.
• Share Sheet — when sharing an invite, GameTab generates a text snippet and opens the device share sheet. Recipient and app selection are entirely controlled by you and your device.

5.4 Legal Disclosure

We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of GameTab, our users, or the public.

6. Data Storage and Security

• Database and file storage are hosted by Supabase (PostgreSQL cloud database)
• All data is transmitted over HTTPS/TLS encrypted connections
• Passwords are hashed using Supabase's secure authentication (bcrypt)
• Database-level access rules (row-level security and restricted projections) limit non-public records to the users entitled to see them — for example, group content is accessible only to that group's members. The intentionally public profile fields described in Section 5.1 and publicly linkable uploaded images described in Section 3.2 are exceptions and can be accessed as stated there.
• Optional multi-factor authentication (email verification codes) can be enabled in Settings; when enabled, it is enforced on our servers for every session
• Session tokens are stored locally on your device and auto-refreshed
• Push tokens are deleted immediately when you log out
• Diagnostics, sampled performance traces, session-stability records, and navigation breadcrumbs sent to Sentry use an anonymised user identifier rather than your name or email, and Sentry's default data-scrubbing settings are applied
• Automated database backups are taken daily and managed by our hosting provider (Supabase). Backups exist solely for disaster recovery, are not used for any other purpose, and are automatically overwritten on a short rolling cycle

Staff access. GameTab is operated by Nexavyn, a sole-trader business. A small number of authorised personnel hold administrative access to the production database, which can technically reach any record. That access is used only where necessary to operate and maintain the service, investigate a report or suspected misuse, respond to a support or billing problem, or comply with a legal obligation — not to read your messages or browse your data casually. The access rules described above govern what every ordinary app user can see, including group admins; they are not a limit on this operational access, and no privacy policy can honestly claim otherwise.

7. Data Retention

7.1 Account and Profile Data

Your account and profile data (name, email, photo, sex selection, sport skills, location), personal Venue Library, weekly goals, and announcement bookmarks are retained for as long as your account is active or until you remove the relevant item. When you delete your account, personal data is deleted, its direct account link is removed from retained shared records, or it is retained on a limited basis as described in Section 8.4.

7.2 Chat Messages

Chat messages are subject to automatic retention limits to manage storage and protect user privacy:

Messages older than 90 days are automatically and permanently deleted from our database each day via a scheduled process. Pinned messages are exempt from automatic deletion — a pinned message is retained until it is unpinned by an admin, at which point it becomes subject to the standard 90-day deletion cycle on the next scheduled run. (Direct messages cannot be pinned and are always purged at 90 days.)

Emoji reactions, reply references, and read receipts associated with deleted messages are also removed as part of the purge process.

Reported announcement evidence. We retain the title and text as they were reported, together with the available reported image. The image is protected from editing and deletion while a report retains it. Access to retained private images is limited to authorized reviewers once the original post is removed. This evidence follows the report retention period in Section 7.6, including pending escalations.

One exception — reported messages. If a message or comment is reported, the report record keeps a short excerpt of it (up to 500 characters). That excerpt is deliberately kept even after the original message is purged at 90 days, because a report is most useful precisely when the original is gone. The excerpt is retained under Section 7.6, not under the 90-day chat schedule. It is visible to that group's admins (Owner, Co-admin, and Manager) and to us — never to other members. Reports about a direct message go to independent admins of its group, excluding the reported person. GameTab reviews cases with no independent admin, eligible escalations, and reports left undecided for 3 days (see Section 7.6).

7.3 Games, Groups, Announcements, Polls, and Tournaments

Group records themselves are retained until the group's Owner deletes the group — only the Owner can delete a group; a Co-admin or Manager cannot. Content within a group is subject to automatic time limits:

Leaving or being removed from a group: your access to that group's chats, announcements, polls, member list, resources, and future group activity ends immediately. Your contributions to shared content (such as messages, poll votes, reactions, and comments) remain with that content until its normal retention period ends, and stay visible under the name recorded at the time to everyone still in the group. Direct messages between you and that group's admin are kept: once you no longer share a group the conversation becomes read-only for both of you — neither side can send another message — but each of you keeps the history until it is deleted on the normal 90-day cycle described in 7.2. Games that have ended and completed or cancelled tournaments you participated in remain available to you as read-only personal history. You must first leave any game that has not ended and withdraw from any unfinished tournament; unresolved G-Credit balances must also be settled or, where the app permits, expressly waived before membership ends. A G-Credit request still waiting on the group's Owner or Co-admin must also be resolved — cancel it yourself or wait for their decision — because credits approved after you leave would land in a balance you could no longer see or use.

Group deletion: memberships, join requests, invites, live G-Credit balances, the group chat and its game chats, announcements, polls, templates, saved group resources, and the group's live profile are removed. Direct messages are the exception: a one-to-one conversation between an admin and a member is not part of the group's shared content, so it is kept read-only and deleted on the normal 90-day cycle instead. Games that have already ended, their rosters, and completed or cancelled tournaments are preserved for participating members until their normal retention period ends, with the deleted group's name and sport stored as a historical label. Credit transaction history is preserved with the deleted group's name as a historical label and its live group reference removed, as described in 7.4. A group cannot be deleted while it has a game that has not ended, an unfinished tournament, or a non-zero member G-Credit balance. Only the group's Owner can delete it, and must re-enter their current password and type the exact group name. Associated stored images are queued for secure deletion with automatic retries.

7.4 Credits, Billing, and Financial Records

What we do not hold. Because Admin Plan subscriptions are sold through the Apple App Store and Google Play, those stores — not GameTab — are the seller and payment processor. We do not hold invoices, payment methods, billing addresses, or transaction amounts for subscriptions, so there is nothing of that kind for us to retain. The accounting records behind our own tax obligations come from the periodic payout statements the stores provide to us, which report aggregate revenue rather than identifying individual subscribers. Your own purchase receipts are held in your Apple or Google account under their privacy policies.

What we do keep. We retain a record of which Admin Plan and version (Standard or Plus) you held and when, your free-trial dates, and the store-issued subscription identifiers needed to recognise your subscriptions across devices and to resolve support or billing disputes. These are kept for as long as your account is active and for up to 2 years afterwards, which is our current maximum for this category.

G-Credits. Credit transaction records are retained for up to 7 years where reasonably needed for accounting, record-keeping, audit, fraud prevention, or dispute resolution, or where retention is required or permitted by law. G-Credits represent money that changes hands directly between members and their group admin — often for real costs such as court hire — so both sides may need the history long after the fact. Seven years is our current maximum for this category; it does not mean that Australian law requires every record to be kept for seven years. We review whether identifiable records remain reasonably necessary and delete or de-identify them sooner where appropriate. If your account or group is deleted before then, direct account and group references are removed where possible for the remainder of the period, so the ledger stays complete for the group without naming you to anyone reading it — including that group's admin. Because these records exist partly to settle disputes, we keep a separate internal key that lets our support team re-link your own transactions to you if a dispute about them is raised; that key is held with the limited deletion record described in Section 8.4, is not available inside the app, and expires with that record. Note that a credit transaction can also carry a short note written by whichever Owner or Co-admin made it (a Manager cannot create credit transactions): we cannot de-identify free text, so if they typed a name it stays in their record of that charge. Resolved credit requests are retained for 2 years.

7.5 Notifications, Push Tokens, and Security Data

In-app notification records are retained for 90 days. Push notification tokens are deleted immediately when you log out of the app, and any token not used for 180 days is automatically purged. Server-side push delivery queue entries are deleted within 3 days of being queued once the notification has been sent or has failed, and in all cases within 7 days. MFA verification codes are purged within 24 hours. Feedback you submit is retained for up to 2 years.

7.6 Moderation and Safety Records

Records created by the reporting and blocking features are kept on a separate schedule from the content they relate to:

Reports are visible to the admins of the group the reported content belongs to, including reports about a direct message with a group's admin team, but never to the person being reported. GameTab sees a report only when no group admin other than the person reported can review it, or when the member who reported an admin asks us to review it. If you contact us about content or a user, we use what you send us to look into it.

7.7 Backups

Our database is backed up automatically every day for disaster recovery. When data is deleted from the live database — whether by you, by an admin, or by an automatic retention purge — residual copies may persist in these backups for a short period until the backups are overwritten on their normal rolling cycle. Backups are never used to restore individually deleted content, are not accessible through the app, and are not used for any purpose other than recovering from a system failure.

7.8 If GameTab Is Discontinued

If we permanently discontinue GameTab, we will handle personal information in accordance with this Privacy Policy and applicable law. Where reasonably practicable, we will give advance notice as described in the Terms of Service so that you can request access to your personal information or delete your account before the service closes. During an orderly shutdown, we may continue to use personal information only as reasonably necessary to provide notice, maintain security, respond to access, correction, deletion, billing, or support requests, settle accounts, resolve disputes, and meet legal obligations.

After the service closes, we will take reasonable steps to securely delete or de-identify personal information that is no longer needed. Information that must still be retained for legal, accounting, fraud-prevention, dispute-resolution, or other permitted purposes — including the limited records described in Sections 7.4 and 8.4 — will remain protected, will not be used to continue operating the discontinued service, and will be deleted or de-identified when it is no longer required or permitted to be retained. Residual backup copies will expire through the normal process described in Section 7.7.

8. Your Rights and Choices

8.1 Access and Correction

You can view and update the editable parts of your profile at any time within the app (More → Edit Profile). Your public username is the exception: it cannot be changed through self-service because other members use it as a stable account identifier. If it is mistaken, inappropriate, or creates a safety or privacy concern, use Request a correction beneath the username in Edit Profile. That authenticated request is linked to your account and reviewed by support. The sex selection on the profile form is optional; choosing Prefer not to say, or leaving it unanswered, is always available and uses neutral Home artwork.

8.2 Notification Preferences

Manage notification types and mute specific groups within the app (More → Settings → Push Notifications). You can also revoke push notification permission via device Settings.

8.3 Permission Management

• iOS: Settings → Privacy & Security → [Permission] → GameTab
• Android: Settings → Apps → GameTab → Permissions

8.4 Account Deletion

Permanently delete your account from within the app (More → Settings → Delete My Account). Only groups you own block deletion — every group you own, including an inactive or disabled group, must first be deleted or transferred to someone else through the normal group process. A Co-admin, Manager, or member-only account does not need to leave or delete any group manually. All users must settle outstanding credit balances, leave games that have not ended, and withdraw from unfinished tournaments. Account deletion requires typing DELETE and re-entering the current password.

If you can no longer access the app, you can also request account deletion by emailing [email protected] from the email address registered to your account. We will verify the request and complete the deletion within 15 days. A standalone summary of both options is also available at nexavyn.com/gametab/delete-account.

Deleted permanently: the database records below are removed in the account transaction. The stored profile-photo prefix is queued in that same transaction for secure Storage deletion; automatic retries handle temporary Storage failures.

• Your profile (name, phone, photo URL, bio, location, sex selection, sport skills, preferences) and the queued stored profile-photo file
• All group memberships and roles, and pending join requests and invites
• Your reactions on announcements
• Your saved-announcement bookmarks and view metadata
• Your personal Venue Library, weekly goals and goal history, and group-level block records linked to your account
• Your personal block list — both people you blocked and records of other users having blocked you
• Your hidden direct-message conversation settings
• Your personal score logs (My Stats). Score entries other players logged that mention you are their records and keep the name recorded at entry.
• All push notification tokens and in-app notifications you received
• Every admin (Owner, Co-admin, and Manager) of each group you belonged to is notified that you deleted your account, so they know you are no longer in their group and that re-inviting you is not possible. That notice names you and is deleted on the normal 90-day notification cycle (Section 7.5)
• Feedback records linked to your account. The notification we receive when you submit feedback carries only its type and a reference number: not your message, and never your name or email address, so once this record is deleted the copy in our support mailbox no longer identifies you
• Terms, Privacy Policy, and age-attestation acceptance records linked to your account
• Your authentication credentials (email login, password, sessions, MFA records)

Shared records that remain after the direct account link is removed (shown as "Deleted User" where applicable), so that other members' history and records retained for the purposes above stay intact:

• Game participation records within their normal retention window
• Tournament match history and poll vote counts
• Comments you posted on announcements, shown as "Deleted User"
• Credit transaction history — retained with direct account links removed for up to the operational maximum described in 7.4, and reviewed for earlier deletion or de-identification where appropriate. Your balance is always zero before deletion is allowed, so nothing is left owed in either direction. A support-only key kept with the deletion record below can re-link these transactions to you if you or your admin later dispute one; nobody using the app can
• Admin Plan history (which plan, when, trial dates) — retained with direct account links removed for up to 2 years as described in 7.4
• Reports other users filed about your content — the report survives with its excerpt and outcome for the period in Section 7.6, with the link to your account removed, so a moderation decision stays reviewable
• Reports you filed about other users' content — the report is the group admin's moderation record, not only yours, and an unresolved one is never deleted automatically (Section 7.6). It survives with your reporter link removed, so you are no longer identifiable as the person who filed it, and is then retained for the period in Section 7.6
• Chat messages you sent are no longer linked to your account (they display the name recorded at the time of sending) and are purged on the normal 90-day cycle

Limited audit record: for account-deletion verification, fraud prevention, dispute handling, and compliance administration, we currently keep a limited deletion record (your name, email address, plan, deletion date, and aggregate account statistics — no activity content) for up to 7 years, stored separately from the live app and not visible to any user. Alongside it we keep a separate technical audit entry recording that a deletion took place and when, also for up to 7 years, so we can demonstrate the request was carried out. This is a product retention maximum, not a claim that every deletion record is legally required for seven years. We periodically assess whether the identifiable fields and continued retention remain reasonably necessary and delete or de-identify the record sooner where appropriate. Your email address is also blocked from re-registration for 24 hours after deletion.

External subscription service: deletion also queues an automated request to remove the GameTab customer profile identified by your account UUID from RevenueCat, with retries if the provider is temporarily unavailable. RevenueCat deletion does not cancel an Apple or Google subscription; you must cancel that separately in your store account. If a later store event recreates a customer profile for the deleted UUID, we ignore it for entitlement purposes and queue deletion again.

Email you send us: if you email support — including to request deletion under this section — that correspondence sits in our support mailbox and is not removed by deleting your account in the app, because it is our record of a request you made to us and of how we answered it. We keep it for up to 2 years and then delete it. This is the only category of your personal information that in-app deletion does not reach; everything we generate ourselves is either deleted or de-identified as described above.

Backups: residual copies of deleted data may persist in our automated daily backups for a short period until those backups are overwritten on their normal rolling cycle (see Section 7.7). Backups are used only for disaster recovery and are never used to reinstate deleted accounts.

8.5 Data Export / Access Request

To request a copy of your personal data, contact us at [email protected]. We will respond within 15 days.

9. Children's Privacy

GameTab requires users to be at least 16 years old (see our Terms of Service), and the app is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has created an account or provided us with personal information (including as a guest player added by an admin), contact us at [email protected] and we will promptly delete it.

10. Diagnostics and Performance Monitoring

GameTab uses Sentry (provided by Functional Software, Inc., sentry.io) to automatically collect crash reports and error diagnostics, monitor app performance, and measure whether app sessions complete without errors. Performance tracing is sampled rather than collected for every transaction.

Sentry may collect:

• Device model and operating system version
• App version at the time of an error or monitored session
• A stack trace and technical context when an error occurs
• Performance trace and timing information for sampled app operations
• Session status used to measure stability
• Navigation path breadcrumbs that help identify which app screen preceded an error (not message content or text typed into forms)
• An anonymised user identifier (a one-way hash of your Supabase user ID — not your name or email)

One narrow exception, for billing faults. If a purchase or renewal fails to be applied to your account — for example if the confirmation we receive from the app store cannot be processed — our server sends Sentry an alert that includes your account identifier in full rather than the anonymised hash described above. We do this because the whole purpose of that alert is to let us find the affected account and restore access you have already paid for, which an anonymised identifier would make impossible. These alerts are created only when something has gone wrong with a subscription. They contain your account identifier, which plan was involved and the technical error, and deliberately contain no name, email address, payment details or store receipt.

This information is used solely to identify and fix issues, diagnose slow operations, restore paid access that failed to apply, and improve app reliability. It is not used for advertising, behavioural profiling, or general product-marketing analytics. Sentry data is handled under Sentry's privacy policy, available at sentry.io/privacy.

GameTab does not currently use third-party advertising or general behavioural analytics services.

11. Data Breach Notification

In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme.

Notifications will be sent to the email address associated with your account and/or posted at nexavyn.com/gametab/privacy.

12. Australian Privacy Act

Nexavyn operates in Australia and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply. Australian privacy law provides rights and processes concerning access, correction, and privacy complaints. It does not provide a general right to erasure in every circumstance. Separately, GameTab voluntarily provides the account-deletion options in Section 8.4, subject to the limited retention described there.

Under the APPs, where they apply, you can:

• Know what personal information we hold about you
• Request access to personal information we hold about you
• Request correction of inaccurate, incomplete, or out-of-date information
• Ask GameTab to delete your account or particular information; we will action the request where available and explain any information that must or may lawfully be retained
• Complain about a breach of the APPs

To exercise any of these rights, contact us at [email protected]. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Australia. Any disputes relating to this policy shall be subject to the jurisdiction of Australian courts.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy at nexavyn.com/gametab/privacy and updating the "Last Updated" date above.