PRIVACY POLICY

Maylay Sports Inc. · Last Updated: August 23, 2026

1. Introduction

Maylay ("the App," "we," "us," or "our") is operated by Maylay Sports Inc. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the Maylay mobile application. By creating an account, you agree to this Privacy Policy and our Terms of Service, into which this Privacy Policy is incorporated by reference.

This policy complies with the California Consumer Privacy Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), and Apple's App Store privacy requirements.

2. Information We Collect

Account & Identity

• Full name, email address, username, and password (hashed — never stored in plain text)

• Date of birth (used to verify age eligibility and, where you choose to set age preferences, to match you with players in your preferred age range)

• Profile photo and bio

• Biological sex (optional — used only for profile display and matchmaking)

Precise Location Data

GPS location is collected only with your explicit permission, used to find nearby games and players, calculate distances, and share your location with other users as described below. You may revoke location permission at any time in your device settings.

Player Map — Location & Availability Shared with Other Users

If you have granted location permission, your exact location is shared with other signed-in users and your profile appears as a pin on the in-app player map. Your pin is drawn at an approximate position offset by up to 0.1 miles, but your exact coordinates are shared to power the map and distance calculations. You should treat your location on Maylay as visible to other users, and only update your location from places you are comfortable sharing.

Alongside your pin, other users can see: your location, as described above; your profile (name, photo, bio, and sports/skill information); your play availability status (Open to play / Maybe / Not available) and the sports it applies to; any status note you choose to write; your distance from them; roughly how recently your location was last updated (e.g., "2h ago").

Map visibility is on by default, and your availability defaults to "Open to play" for your favorite sports. You can hide yourself from the player map at any time with the "Show me on the player map" switch in the status sheet on your Profile tab — your pin is removed immediately. Your pin also stops appearing automatically if your location has not been updated in the last 14 days, and revoking location permission in your device settings prevents further location updates.

• Your location, as described above

• Your profile (name, photo, bio, and sports/skill information)

• Your play availability status (Open to play / Maybe / Not available) and the sports it applies to

• Any status note you choose to write

• Your distance from them

• Roughly how recently your location was last updated (e.g., "2h ago")

Map visibility is on by default, and your availability defaults to "Open to play" for your favorite sports. You can hide yourself from the player map at any time with the "Show me on the player map" switch in the status sheet on your Profile tab — your pin is removed immediately. Your pin also stops appearing automatically if your location has not been updated in the last 14 days, and revoking location permission in your device settings prevents further location updates.

Camera & Microphone

• Camera: profile photos, post media, and video calls

• Microphone: audio during in-app video and audio calls

We do not access your camera or microphone in the background.

Contacts — Inviting Friends

When you choose to invite friends, the App asks permission to read your contacts so you can pick several people at once. This is optional — decline and the invite still works through your device's normal share sheet — and you can change it any time in your device settings.

• Only names and phone numbers are read — not emails, addresses, birthdays, or photos

• They are used only to show you the invite list, and stay in your device's memory for that session

• Your contacts are never uploaded to our servers, never stored, and never shared with anyone

• We never use them to suggest friends or to contact anyone on your behalf

• Invites are sent by your own messaging app, from your number, only to the people you pick

Video & Audio Calls

Real-time calls are powered by Agora. Calls are not recorded or stored by Maylay Sports Inc. Streams are transmitted in real time and not retained after a call ends.

User-Generated Content

• Posts, photos, videos, and media you upload

• Chat messages and group conversations

• Game listings and event descriptions

Sports & Skill Data

• Favorite sports, skill levels, availability, and preferences

Usage & Diagnostics

• App interaction data and session timestamps

• Crash reports and error logs via Sentry

• Device type, OS version, and app version

3. How We Use Your Information

• Match you with nearby athletes, games, and events

• Display your profile and availability to other verified users

• Share your location with other users and display your pin and availability status on the player map, unless you opt out

• Enable messaging, group chats, and video calls

• Send push notifications about nearby games and activity

• Verify your identity and maintain account security

• Detect and prevent fraudulent or prohibited activity

• Comply with legal obligations and enforce our Terms of Service

• Analyze crash reports and usage patterns to improve the performance and stability of the Service

We do not use your data for behavioral advertising or ad targeting.

4. Data Sharing & Third Parties

We Do Not Sell Your Data

Maylay Sports Inc. will never sell, rent, trade, or auction your personal data, location history, communications, or any other information to third parties.

Your phone's contacts are never shared with anyone, including the providers below — they never leave your device at all.

Trusted Infrastructure Providers

• Supabase — Database & auth — Account data, messages

• Agora — Video & audio calls — Streams (not recorded)

• Sentry — Crash reporting — Device info, error logs

• DeepL — Translation — Message and post text only

• Apple APNs — Push notifications — Device push token

Legal Disclosures

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of Maylay Sports Inc., our users, or the public.

Business Transfers

If Maylay Sports Inc. undergoes a merger or acquisition, we will provide at least 14 days' notice before your data becomes subject to a materially different privacy policy.

5. Data Retention & Deletion

Delete your account anytime via Settings → Account → Delete Account.

• Your profile, personal data, location records, and media uploads are deleted within 30 days

• Messages you sent to other users remain in their chat threads, permanently stripped of your identifying information and attributed to "Deleted User"

• Residual encrypted backups deleted within 90 days

• Accounts inactive 24+ months are automatically purged

6. Data Security

• Encryption of data in transit (TLS/HTTPS)

• Passwords hashed — never stored in plain text

• Role-based access controls on internal data access

• Row-level security policies on our database infrastructure

No electronic transmission is 100% secure. In the event of a data breach, we will notify you as required by applicable law.

7. Children's Privacy

Maylay is for users 18 years of age or older. We do not knowingly collect data from anyone under 18. If we discover data from a minor, we will delete it immediately. Contact: support@maylay.org

8. Your Privacy Rights

California Residents (CCPA/CPRA)

• Know what personal data we collect, use, and disclose

• Request a copy of the personal data we hold about you

• Request deletion of your personal data

• Correct inaccurate personal data

• Opt out of the sale of personal data (we do not sell your data)

• Non-discrimination for exercising your privacy rights

All Users

• Access and review the personal data we hold about you

• Correct inaccurate data through your in-app profile settings

• Withdraw consent for location/camera/mic via device settings

• Hide yourself from the player map at any time via the "Show me on the player map" switch on your Profile tab

• Delete your account and all associated data via in-app Settings

9. Push Notifications

You may opt out of push notifications at any time through your device's notification settings or within the App's alert preferences.

10. SMS & Text Messaging

Maylay sends one-time verification codes by SMS to confirm ownership of a phone number when you sign up, add or change your number, or reset your password. We send a text only in direct response to a request you make in the App.

We do not send marketing or promotional text messages. Message frequency depends on your activity — most accounts receive one message. Message and data rates may apply.

Mobile information will not be shared with or sold to third parties or affiliates for marketing or promotional purposes.

Reply STOP to any message to opt out, START to opt back in, or HELP for assistance. You can also remove your number in the App under Settings → Phone & Email.

11. In-App Messaging & Chat

Maylay includes direct messages, group chats, and chats attached to games, teams, and tournaments. This section explains what we collect when you use them. It is separate from Section 10, which covers SMS verification codes sent to your phone.

What We Collect

• Message content — text, photos, videos, other attachments, polls, and emoji reactions

• Conversation metadata — who is in a chat, chat names, timestamps, edits, and deletions

• Delivery signals — typing indicators, unread counts, and when you last opened a chat

• Chat settings you choose, such as a chat background or muted notifications

How Messages Are Stored

Messages and attachments are sent over encrypted connections (TLS) and stored on our Supabase infrastructure in the United States so you can read them across devices. In-app messages are not end-to-end encrypted. Row-level security policies restrict database access to the participants of a conversation.

We do not read private conversations in the ordinary course of business, and we never scan messages to build advertising or marketing profiles — Maylay does not serve ads. Authorized staff may access message content only to investigate a report of abuse, enforce our Terms of Service, protect the security of the Service, fix a technical problem, or comply with a legal obligation.

Who Can See Your Messages

• The other participants, who can copy, screenshot, or forward anything you send

• Members added to a group chat later, who can read the conversation from the point they joined forward

• Supabase, as our database and storage provider, and Apple or Google push services, as described in Section 4

We never sell your messages, and we do not share them with advertisers or data brokers.

Automatic Translation

When a message is written in a language other than the one you selected in the App, the message text may be sent to DeepL SE, our machine-translation provider, so it can be shown to you in your language. Only the text is sent — not your name, account identifiers, or contact details — and translations are cached on your device to avoid repeat requests. Translations are automated and may be inaccurate; the original message is always what was sent.

Message Notifications

Push notifications for new messages may show the sender's name and a preview of the message on your lock screen. You can hide previews or turn message notifications off in your device settings, or mute an individual chat in the App.

Your Controls

• Block a user to stop them from sending you direct messages

• Leave or delete a conversation to remove it from your view of the App

• Delete messages you have sent

• Mute notifications for any chat

• Report abusive messages by emailing support@maylay.org

Retention

Messages are kept until you or another participant deletes them, or until your account is deleted. Deleting your account removes your profile and personal data within 30 days; messages you already sent remain in the recipients' threads, permanently stripped of your identifying information and attributed to "Deleted User," as described in Section 5. Residual encrypted backups are purged within 90 days.

12. Governing Law

This Privacy Policy is governed by the laws of the State of California. Disputes will be resolved through binding individual arbitration administered by JAMS under its Streamlined Arbitration Rules and Procedures.

13. Changes to This Policy

We will notify you via in-app notification or email at least 14 days before material changes take effect.

Contact Us

Maylay Sports Inc. — Data Privacy Team

Email: support@maylay.org