Privacy Policy
This Privacy Policy explains how CaptainPass ("we", "us", "our") collects, uses, and protects your information when you use the CaptainPass mobile application, owner web portal, and admin dashboard (the "Service"). By using the Service you agree to this Policy.
1. Who we are
CaptainPass is operated by LVLUP Technologies LLC (Commercial Registration 1652392), Sultanate of Oman. We are the data controller for the information described in this Policy. Contact: support@captain-pass.com.
2. Information we collect
- Account information: name (and an optional Arabic name), email address, phone number, date of birth, gender and nationality โ provided by you at signup. Optionally: your preferred sports, a short bio, and a profile photo. If you sign in with Google or Apple we ask only for your date of birth and gender.
- Skill ratings: we calculate your rating from an optional calibration questionnaire and from your match results. You do not set it yourself, and it is stored per sport.
- Saved card reference: if you choose to save a card, our payment provider stores the card and gives us only a reference token. We never receive or store your card number.
- Authentication data: when you sign in with Google or Apple we receive a verified email and unique identifier; we do not see your social account password.
- Game and booking data: games you create, join, or pay for, including venue, time, and your role (captain or player).
- Reviews and replies: ratings and text you submit about venues, plus the venue owner's reply to your review.
- Wallet and payment metadata: wallet credit balance, refund history, and payment confirmations from our payment processor. We never see or store your full card number.
- Photos you upload: your profile picture and, if you manage a venue, your venue photos, logo and commercial-registration document. Profile pictures and venue photos are visible to other users; commercial-registration documents are not.
- Venue business data (owners only): business name, commercial-registration number and document, and bank payout details (bank name, account number, IBAN, beneficiary name). Used solely to verify the venue and pay out bookings; never shown to players.
- Device data: device type, OS version, app version, push notification token (so we can send you game reminders), and crash diagnostics.
- Usage analytics: events such as logins, game joins/cancellations, screen views, and errors. We use this data to understand how the app is used and to fix bugs.
- Feedback and support messages: anything you send us via the in-app feedback form or by email.
Device location. If you use the "nearby venues" feature and grant permission, the app reads your device location while the app is open to sort venues by distance. Your location stays on your device for that session only โ it is never sent to our servers, never stored, and never shared. You can refuse the permission and pick your area from a list instead; nothing else in the app changes. You can withdraw the permission at any time in iOS Settings.
We do not collect: contacts, microphone, camera (the app has no camera access at all โ photos are chosen from your photo library), health data, or any advertising identifier.
3. How we use it
- To operate the Service: matching captains and players, processing bookings and payments, sending push notifications you ask for, and showing in-app notifications about your games.
- To secure your account and prevent fraud or abuse (App Check + reCAPTCHA Enterprise).
- To analyze usage in aggregate so we can improve features and fix bugs.
- To respond to support requests.
- To comply with legal obligations.
We do not sell your personal data to third parties. We do not use your data for behavioural advertising.
4. Notification preferences
You control which categories of notifications you receive (Games, Payments, Social, Venues, System) from โฐ (top right) โ Settings โ Notifications in the mobile app. You can also disable push notifications entirely from your device's system settings.
5. Service providers
We rely on the following processors. Each is bound by their own privacy terms and processes data only on our instructions:
- Google Firebase (Authentication, Firestore database, Cloud Storage, Analytics, Cloud Functions, App Check, Cloud Messaging) โ hosting and core infrastructure.
- Google reCAPTCHA Enterprise โ bot / abuse protection on the websites and admin portals.
- Sentry โ error and crash reporting.
- Expo โ over-the-air updates and push notification delivery.
- Apple / Google โ sign-in providers if you use them.
- Zoho Mail โ handles the
@captain-pass.comsupport inbox. - Cloudflare โ DNS and edge network for captain-pass.com.
- Firebase Performance Monitoring โ app performance and network timing diagnostics.
- Apple App Attest / DeviceCheck and Google Play Integrity โ confirming requests come from a genuine, untampered copy of the app.
- AmwalPay โ Oman-based payment processor for card transactions. We never see or store your card number.
Each of these third parties is required to provide the same or equal protection of your data as is stated in this Privacy Policy. We do not permit them to use your data for their own purposes, and we do not share your data with anyone for advertising.
6. Storage and security
Your data is stored on Google Cloud servers and protected by industry-standard encryption in transit (TLS 1.2+) and at rest. Access is restricted to authorised personnel. We use Firebase Security Rules, App Check, and reCAPTCHA Enterprise to limit what the app and its users can read or modify.
7. Retention
We keep your account data for as long as your account is active. If you delete your account from the mobile app, we delete your profile, friends, and wallet history within 30 days; reviews and replies you posted โ and your seat in games already played โ are anonymised (your name and account link removed) rather than deleted, so other players' records stay intact. In-app notifications older than 90 days are automatically removed, including any left after an account is deleted. Usage-analytics events are recorded against your account identifier and are retained for product analysis; they are not deleted when you delete your account, and we do not use them to re-identify you or to build a profile for advertising. Records required for legal, accounting, or anti-fraud purposes (e.g. payment receipts) are kept for the period required by Omani law.
8. Your rights
You can:
- View and edit your profile inside the app.
- Delete your account from โฐ (top right) โ Settings โ Delete account, or request it via how to delete your account. The data deletion is permanent and cannot be undone.
- Download a JSON export of your data from โฐ (top right) โ Settings โ Download my data.
- Request correction of inaccurate data, or withdraw consent for analytics, by emailing support@captain-pass.com. We respond within 30 days.
- Disable push notifications from your device's system settings, or per-category from โฐ (top right) โ Settings โ Notifications.
9. Children
CaptainPass is intended for users aged 13 and older. If you are under 13, please do not use the Service. If we learn we have collected data from a child under 13 we will delete it.
10. International transfers
Our infrastructure is hosted by Google Cloud, which means your data may be processed on servers outside Oman, including in the European Union and the United States. We rely on industry-standard contractual safeguards (Google Cloud DPA + Standard Contractual Clauses) for these transfers.
11. Changes to this policy
We may update this policy. The date at the top reflects the latest version. Material changes will be communicated in-app or by email.
12. Contact
Questions or complaints: support@captain-pass.com.