Privacy policy
Effective 31 October 2026
The short version. Big Shot keeps as little about you as it can. We don't store your sign-in email address in readable form (the one exception is an address you give us for the print waitlist), we don't keep your date of birth, we show no ads and we never sell or rent your data. We use what we do keep only to run the app.
Who we are
Big Shot ("we", "us") is an app for cricket fans, and BigShotCricket is our website at bigshotcricket.com, both made by Mrova Solutions Private Limited, a company registered in India. We are the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023. Write to us at support@bigshotcricket.com about anything in this policy.
Big Shot is for adults
You must be 18 or older to use Big Shot. When you first sign in we ask for your date of birth, check that you are 18 or over, and keep only the answer (yes or no). We do not store the date. If we learn that an account belongs to someone under 18, we delete it.
What we collect, and why
When you sign in
| Sign-in method | What we receive | What we keep |
|---|---|---|
| Email code | Your email address, so we can send you a 6-digit code. | A keyed, one-way hash of your address and of the code. The code expires after 10 minutes. We do not keep your address in readable form. |
| From Google: your Google account ID, your email address and whether Google has verified it. Google's sign-in also passes along your name and profile picture. | Keyed, one-way hashes of your Google account ID and verified email address. We don't keep your name or picture, and we don't use them. | |
| Apple | From Apple: your Apple account ID and, if you choose to share it, your email address (or Apple's private relay address). | Keyed, one-way hashes of the account ID and email address. |
A hash lets us recognise you when you sign in again, and connect a Google or Apple sign-in to the email-code account with the same address. It cannot be turned back into your email address. Because we keep no readable sign-in address, we don't send you marketing email.
Your account
- Your Big Shot account: an account ID, the public handle you choose (if any), your coin balance, your daily streak and when you joined.
- What you do in the app: the posters you collect, unlock or claim, the players you follow, trades with other fans, Trumps games, posters you restyle in the Studio, and who invited you, if you joined through a friend's link.
- Sign-in sessions: a hash of each session token, with when it was created and last used, so you stay signed in.
Your device
- A random device ID the app creates on first launch, the platform (iPhone, Android or web), and when the device was last used.
- If you allow notifications: your device's push token, so we can tell you about the day's drop and the players you follow. You can turn notifications off in your phone's settings at any time.
How the app is used
The app records events such as opening the app, collecting a poster, sharing one and signing in, with your device ID, your account ID if signed in, and a few details about the event (for example, which poster). We use these to fix problems and decide what to improve. They are stored in our own database. We use no third-party analytics, advertising or tracking services.
Share links
When you share a poster we create a link for it. When someone opens that link we record that it was opened and when, and whether it led to a new account, so the friend who invited them can earn their coins. We don't record who opened it.
My XI, on the website
My XI needs no account. When you make an XI we keep the name you type, your eleven players, a random ID your browser creates so you can change your XI, and how many times your link was opened. Anyone with your link can see your name and your XI, so use a first name or a nickname. Your browser also remembers your picks on your own device.
I Was There posters
Your I Was There poster is drawn in your own browser. The name and stand you type stay on your device and aren't sent to us.
The print waitlist
If you join the waitlist on our I Was There page, we keep your email address in readable form, with the match you asked for if you named one, so we can write to you about these prints. We use it for nothing else, and we delete the list within 12 months of your joining. Nothing is on sale and we take no payment.
Network data
Like every website and app, our servers see your IP address when the app talks to them. Our hosting provider uses it to limit abuse (for example, too many sign-in attempts) and keeps request logs for a short time for security and fixing errors. We don't store IP addresses in our database.
Google user data
If you sign in with Google, we use the data Google shares only to sign you in and to keep your account secure, as described above. We don't use it for advertising, we don't sell it, we don't transfer it to anyone except as needed to run the sign-in, and no person at Big Shot reads it. Big Shot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share data with
We don't sell, rent or trade your personal data, and we don't share it with advertisers. These service providers process data on our behalf to run Big Shot:
- Cloudflare hosts our website, servers, database and poster images, and sends sign-in code emails.
- Expo, with Apple and Google, delivers push notifications to your device if you allow them.
- Google and Apple handle sign-in when you choose them.
Other fans can see your public handle and the posters you own when you trade or play Trumps with them. We may also disclose data if the law requires it.
Where your data is kept
Our service providers may process data in data centres outside India. We use providers that protect it to standards at least as strong as this policy.
How long we keep it
- Email codes: until they expire or are used.
- Sign-in sessions: until they expire or you sign out.
- My XI: for as long as the page is up. Write to us with your link and we'll remove it.
- The print waitlist: until you ask to come off it, and no more than 12 months.
- Your account and what you do in the app: for as long as you keep your account. When you delete it, we delete your account, sign-in hashes, sessions, devices and events within 30 days. Aggregate figures that identify nobody (for example, how many fans collected a poster) may remain.
Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or update it;
- delete your account and its data;
- withdraw your consent, which ends your use of the app;
- nominate someone to exercise these rights for you if you die or become unable to.
Write to support@bigshotcricket.com from the email address on your account, or tell us your handle, your My XI link or your waitlist address. We reply within 30 days. If you're not happy with our answer you can complain to the Data Protection Board of India.
Security
Data travels over encrypted connections (HTTPS). Email addresses, sign-in identities and session tokens are stored only as keyed hashes, so a copy of our database would not reveal them. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.
Changes to this policy
If we change this policy we'll update the date at the top. For important changes we'll also tell you in the app before they take effect.
Contact
Mrova Solutions Private Limited · support@bigshotcricket.com