Privacy Policy

Last updated: September 18, 2026 · Effective: September 18, 2026 · Maylay Sports Inc.

Maylay (the "App," "we," "us," or "our") is operated by Maylay Sports Inc. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use the Maylay mobile application and related services (collectively, the "Service"). Maylay is a sports matchmaking platform that helps players find pickup games and organized matches, connect with other players, chat, and share content.

By creating an account or using the Service, you agree to this Privacy Policy and to our Terms of Service, into which this Privacy Policy is incorporated by reference. If you do not agree, please do not use the Service.

This policy is written to meet the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Children's Online Privacy Protection Act ("COPPA"), other U.S. state privacy laws, and Apple's App Store privacy requirements.

The short version. Maylay is for users 13 and older. We do not sell or rent your data, we do not serve ads, and we do not build advertising profiles. We do collect precise location, and if you grant location permission your location and availability are shared with other signed-in users on the player map by default. You can switch that off at any time, and you can delete your account and all of your data from inside the App.

Contents

Information We Collect
Location and the Player Map
How We Use Your Information
Automated Processing, AI Features, and Translation
How We Share Information
Service Providers
Your Choices and Controls
Your Privacy Rights
Data Retention and Deletion
Security
Children's Privacy and Minors
Push Notifications
SMS and Text Messaging
In-App Messaging and Chat
Payments Between Users
Contests, Promotions, and Referrals
Our Website
International Users
Governing Law
Changes to This Policy
Contact Us

1. Information We Collect

Account and identity

Name, username, email address, and password. Passwords are hashed and never stored in plain text.
Phone number, if you sign up with one or add one to your account.
Date of birth, used to confirm you meet the minimum age and, where you choose to set age preferences, to match you with players in your preferred age range.
Age assurance signals. Where your device supports it, we request the age range associated with your Apple Account or Google Play account (Apple's Declared Age Range API and Google Play's Age Signals API). We receive an age range only — never your date of birth from Apple or Google, and never your account identity with them.
Profile photo and bio, and an optional college or school affiliation.
Biological sex, optional.
Records of which version of the Terms of Service and this Privacy Policy you accepted, and when.
Your referral code, and invitations you send or accept.

Private by design. Your date of birth, biological sex, email address, phone number, and saved payment handles are private to your account. They are never displayed to other users, are not searchable, and other users cannot filter by them. Your date of birth and biological sex may be used behind the scenes to order suggestions, but the underlying values are never revealed to anyone else. A payment handle is shown to another user only when you attach it to a chat message yourself.

Sports, skill, and availability data

Favorite sports, sport preferences, skill levels, and your skill-quiz answers.
Availability schedule, time zone, play status (Open to play / Maybe / Not available), the sports it applies to, and any status note you write.
Games, classes, teams, and tournaments you create, join, or request to join, along with attendance and any feedback you give afterward.
Peer skill ratings. Other users can rate your skill level in a sport. We store who rated whom, the sport, and the rating. A rating informs skill matching and is never shown to the person who was rated — you are told that a rating happened, not what it was or who gave it.

Precise location data

GPS location is collected only with your explicit device permission. It is used to find nearby games, players, and venues, to calculate distances, to order what you see, to send you notifications about nearby activity, and to share your location with other users as described in Section 2. You may revoke location permission at any time in your device settings.

Camera, photos, and microphone

Camera and photo library — profile photos, post and story media, chat attachments, and video calls. We access your photo library only for the items you choose to upload.
Microphone — audio during in-app video and audio calls, and any audio in video you record.

We do not access your camera or microphone in the background.

Video and audio calls

Real-time calls are powered by Agora, Inc. Calls are not recorded or stored by Maylay Sports Inc. Streams are transmitted in real time and are not retained after a call ends. We do keep call metadata — who called whom, when, and for how long.

Content you create

Posts, Persona stories, Locker media, comments on posts and profiles, poll responses, and reactions.
Photos, videos, and audio you upload, together with captions and any people you tag.
Game, class, team, tournament, and venue listings and descriptions.
Chat messages, attachments, and group conversations (see Section 15).

Media files are stored with technical metadata such as file type, size, and dimensions. We do not require or deliberately collect GPS coordinates embedded in the images you upload.

Safety, moderation, and enforcement data

Reports you file about other users or content, and reports other users file about you, including the reason selected and any description given.
Users you block, and users who have blocked you.
The results of automated content scanning, and any moderation action taken on your account — content removal, suspension, or termination — with the reason and timestamp.

Reports are confidential: the person reported is never told who reported them.

Usage and diagnostics

App interaction data, screens viewed, feature usage, and session timestamps.
Crash reports, stack traces, and error logs via Sentry, Inc., which may include your user identifier and the state of the App at the time of the error.
Device type, operating system version, app version, language, and time zone.
Push notification tokens issued by Apple or Google, and your notification preferences.
IP address and standard server log data, used for security, abuse prevention, and debugging.
Your last-active timestamp, used to show recency and to identify dormant accounts.

Information we receive from other people

Other users may provide information about you: by tagging you in a post or photo, inviting you to a game or chat, rating your skill in a sport, commenting on your profile, adding you as a friend, or reporting your account.

What we do not collect

We do not collect card numbers, bank account numbers, or any payment credentials. Maylay never receives, holds, transmits, or processes money.
We do not collect biometric identifiers, health or fitness records, or government identification numbers.
We do not upload your contact list or address book.
We do not collect advertising identifiers, and we do not track you across other companies' apps or websites. We do not respond to browser Do Not Track signals, because the Service is a mobile app that does not perform cross-site tracking.

2. Location and the Player Map

If you have granted location permission, your exact location is shared with other signed-in users and your profile appears as a pin on the in-app player map. Your pin is drawn at an approximate position offset by up to 0.1 miles, but your exact coordinates are shared to power the map and distance calculations. Treat your location on Maylay as visible to other users, and only update it from places you are comfortable sharing.

Alongside your pin, other signed-in users can see:

Your location, as described above
Your profile — name, photo, bio, and sports and skill information
Your play availability status and the sports it applies to
Any status note you choose to write
Your distance from them
Roughly how recently your location was last updated, for example "2h ago"

Map visibility is on by default, and your availability defaults to "Open to play" for your favorite sports. You can hide yourself from the player map at any time using the "Show me on the player map" switch in the status sheet on your Profile tab — your pin is removed immediately. Your pin also stops appearing automatically if your location has not been updated in the last 14 days, and revoking location permission in your device settings prevents further location updates.

Location text you type when searching for a venue or place is sent to our mapping and geocoding providers to return matching results, as described in Section 7.

3. How We Use Your Information

Match you with nearby athletes, games, classes, and events
Display your profile and availability to other signed-in users
Share your location and show your pin and availability on the player map, unless you opt out
Rank and order the posts, players, and suggestions you see
Enable messaging, group chats, polls, and video and audio calls
Send push notifications about nearby games, invitations, messages, and other activity
Verify your email address or phone number and maintain account security
Confirm you meet the minimum age and apply age-based safety rules
Detect, investigate, and prevent fraud, abuse, spam, and prohibited activity, and enforce our Terms of Service
Scan content automatically for objectionable material before it is shown to other users
Provide customer support and respond to your requests
Analyze crash reports and usage patterns to improve the performance, stability, and features of the Service
Comply with legal obligations and protect the rights and safety of our users and the public

We do not use your data for behavioral advertising or ad targeting, and we do not serve ads.

4. Automated Processing, AI Features, and Translation

Parts of the Service use automated systems, including third-party AI models operated by OpenAI, L.L.C. Where AI is used, only the specific content needed for that feature is sent — never your account credentials, contact details, or location history.

Content moderation. Text you post is filtered automatically before it is published. Photos, video thumbnails, and profile images are sent to OpenAI's moderation service and scanned before they are shown to other users. Media that violates our standards is removed, and the account may be suspended or permanently terminated.
Post descriptions and labels. When you create or edit a post, the text of that post may be sent to OpenAI to generate or keep in sync a short description and category labels for it.
Help assistant. If you use the in-app help assistant, the questions you type and the conversation are sent to OpenAI to generate a response, and — if you ask to contact support — a transcript is emailed to our support team through Resend.
Automatic translation. If a message or post is written in a language other than the one you have selected in the App, the text may be sent to DeepL SE so a translation can be shown to you. Only the text is sent — not your name, account identifiers, or contact details. Translations are cached on your device to avoid repeat requests.
Matching and ranking. We use your sports, skill levels, availability, location, and activity — and, behind the scenes, your age and biological sex where you have provided them — to order the players, games, and posts you are shown.

Our AI providers process this content to deliver the feature and are contractually prohibited from using it to train their models. Automated systems are not perfect. If an automated decision removes your content or restricts your account and you believe it is wrong, write to support@maylay.org and a person will review it.

5. How We Share Information

We do not sell your data

Maylay Sports Inc. will never sell, rent, trade, or auction your personal data, location history, communications, or any other information to third parties. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months, and we do not do so now.

With other users

Your profile, posts, sports and skill information, availability, and — unless you opt out — your location and player-map pin are visible to other signed-in users, as described in Sections 1 and 2. Anything you post or send can be saved, screenshotted, copied, or forwarded by the people who can see it, and we cannot prevent that.

With service providers

We share the minimum data each provider needs to perform its function, listed in Section 7. Each provider is bound by contract to protect your data to at least the standard described in this policy and to use it only to provide services to us.

Legal disclosures

We may disclose your information if required by law, subpoena, or court order, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Maylay Sports Inc., our users, or the public; to investigate suspected fraud or violations of our Terms; or in an emergency involving a risk of death or serious physical injury. Content involving the sexual exploitation of a minor is preserved and reported to the National Center for Missing & Exploited Children and to law enforcement as required by law.

Business transfers

If Maylay Sports Inc. undergoes a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will give at least 14 days' notice before your data becomes subject to a materially different privacy policy.

6. Service Providers

Each provider receives only the data listed next to it:

Supabase, Inc. — database, authentication, and file storage. Receives account data, profile, content, messages, and uploaded media.
Agora, Inc. — video and audio calls. Receives real-time streams, which are not recorded, and call metadata.
OpenAI, L.L.C. — image and text moderation, AI post descriptions, and the in-app help assistant. Receives uploaded images and video thumbnails, post text, and help-assistant messages.
DeepL SE — automatic translation. Receives message and post text only.
Sentry, Inc. — crash and error reporting. Receives device information, app version, error logs, and your user identifier.
Expo, with Apple Push Notification service and Firebase Cloud Messaging — push notification delivery. Receives your device push token and the notification content.
Twilio Inc. — SMS verification codes. Receives your phone number and the code only.
Resend, Inc. — transactional email such as verification, password reset, and support replies. Receives your email address and the message content.
Mapbox, Inc. — maps and location search. Receives search text and coordinates only.
OpenStreetMap Foundation (Nominatim) — converting venue and place names into coordinates. Receives venue or place text and coordinates only.
Brave Software, Inc. — image search. Receives your search terms only.
Apple Inc. and Google LLC — app distribution, age range signals, and any in-app purchases. Receive purchase and subscription status, and provide an age range for your account.

Our infrastructure and the data it holds are located in the United States. We may add, remove, or change providers as the Service evolves, and will keep this list current.

7. Your Choices and Controls

Player map — hide yourself at any time with the "Show me on the player map" switch on your Profile tab.
Location, camera, microphone, photos, and notifications — grant or revoke permission at any time in your device settings.
Availability and status — change or clear your play status, status note, and schedule at any time.
Profile fields — edit or remove your photo, bio, college, sports, skill levels, and biological sex in the App.
Payment handles — add, change, or remove them under Settings > Preferences > Payment Info. Removing one stops it being attached to new messages, though cards you already sent remain in those chats like any other message.
Phone number and email — update or remove under Settings > Phone & Email.
Blocking — block any user to remove their content and messages from your experience and stop them contacting you.
Notifications — mute individual chats, adjust alert preferences in the App, or turn notifications off at the device level.
Account deletion — delete your account and data at any time via Profile > Menu > Settings > Delete Account.

8. Your Privacy Rights

Categories of personal information we collect

Under the CCPA we collect the following categories, for the business purposes described in Section 3, and disclose them to the service providers listed in Section 6. We do not sell or share any of them.

Identifiers — name, username, email address, phone number, account and device identifiers, IP address, push token.
Customer records — account credentials in hashed form, and profile details.
Protected classifications — age or date of birth, and biological sex where you provide it. Both are kept private.
Commercial information — any in-app purchase or subscription status, and payment handles you choose to save.
Internet or network activity — app interaction data, feature usage, session timestamps, and crash and error logs.
Geolocation data — precise GPS location, saved venues, and location history tied to your account.
Audio, visual, and similar information — profile photos, uploaded photos and video, and real-time call streams, which are not recorded.
Inferences — skill and matching signals derived from your activity, preferences, and peer ratings.

Sensitive personal information. Precise geolocation and the contents of your private messages are treated as sensitive personal information. We use them only to provide the Service, keep it secure, and meet legal obligations — never to infer characteristics about you for advertising. Because that use is already limited to those purposes, there is no separate "limit the use of my sensitive personal information" right to exercise.

California residents (CCPA/CPRA)

Know what personal information we collect, use, and disclose, and why
Request a copy of the personal information we hold about you, in a portable format
Request deletion of your personal information
Correct inaccurate personal information
Opt out of the sale or sharing of personal information — we do not sell or share your data
Limit the use of sensitive personal information — our use is already limited as described above
Non-discrimination for exercising any of these rights

Residents of other U.S. states

If you live in a state with a comprehensive privacy law — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others — you have comparable rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects, none of which we do. You may also appeal a decision we make about your request: reply to our response, or write to support@maylay.org with "Privacy Appeal" in the subject line.

How to exercise your rights

Most rights can be exercised directly in the App: edit your profile to correct information, and use Profile > Menu > Settings > Delete Account to delete it. For a copy of your data or any other request, email support@maylay.org from the address on your account. We verify your identity by confirming control of that email address or phone number, and we respond within 45 days, extendable once by a further 45 days where reasonably necessary. An authorized agent may submit a request on your behalf with written proof of authorization. Exercising these rights is free, and we will not discriminate against you for doing so.

9. Data Retention and Deletion

You can delete your account at any time via Profile > Menu > Settings > Delete Account, or by emailing support@maylay.org. When you do:

Your profile, personal data, location records, and media uploads are deleted within 30 days
Messages you sent to other users remain in their chat threads, permanently stripped of your identifying information and attributed to "Deleted User"
Residual encrypted backups are purged within 90 days
Accounts inactive for 24 months or more are automatically purged

While your account is open we keep your information for as long as it is needed to provide the Service. Some records are kept on their own schedule: location is overwritten as it updates and your pin drops off the map after 14 days without an update; crash and diagnostic logs are kept for up to 90 days; and SMS verification codes expire within minutes.

We may retain a limited record where the law requires it, or where it is necessary to resolve a dispute, enforce our Terms, prevent a permanently banned user from returning, or keep the Service secure. Content preserved for a law-enforcement or child-safety report is retained as the law requires.

10. Security

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest on our database and storage infrastructure
Passwords hashed — never stored in plain text
Row-level security policies on our database, so users can only reach data they are entitled to
Role-based access controls limiting internal access to authorized staff

No electronic transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law. You are responsible for keeping your password confidential — tell us immediately at support@maylay.org if you believe your account has been compromised.

11. Children's Privacy and Minors

Maylay is for users 13 years of age or older. We do not knowingly collect personal information from anyone under 13, and the Service is not directed to children under 13. Users aged 13 to 17 may use Maylay only with a parent or guardian's permission.

To confirm age we collect a date of birth at sign-up and, where the device supports it, request the age range associated with the user's Apple Account or Google Play account (Apple's Declared Age Range API and Google Play's Age Signals API). That age range is stored on the account, used only for age eligibility and age-based safety rules, and never shown to other users.

For users under 18 we apply additional protections: adult and minor accounts are restricted from contacting one another outside the contexts the App allows, and content filtering is applied more strictly. Instruction or paid classes for anyone under 18 require parent or guardian consent, and the Service must not be used to arrange instruction for anyone under 13.

If we learn that we have collected personal information from a child under 13, we delete the account and its data immediately. A parent or guardian who believes we hold information about a child under 13, or who wants to review or delete their teen's information, should contact support@maylay.org.

12. Push Notifications

With your permission we send push notifications about games, invitations, messages, friend activity, and nearby games matching your interests. Notifications are delivered using a device push token issued by Apple or Google. You may opt out at any time through your device's notification settings or the App's alert preferences, and you can set how far away a game must be before we notify you about it.

13. SMS and Text Messaging

Maylay sends one-time verification codes by SMS to confirm ownership of a phone number when you sign up, add or change your number, or reset your password. We send a text only in direct response to a request you make in the App.

We do not send marketing or promotional text messages. Message frequency depends on your activity — most accounts receive one message. Message and data rates may apply.

Mobile information will not be shared with or sold to third parties or affiliates for marketing or promotional purposes.

Reply STOP to any message to opt out, START to opt back in, or HELP for assistance. You can also remove your number in the App under Settings > Phone & Email.

14. In-App Messaging and Chat

Maylay includes direct messages, group chats, and chats attached to games, teams, and tournaments. This section explains what we collect when you use them. It is separate from Section 13, which covers SMS verification codes sent to your phone.

What we collect

Message content — text, photos, videos, other attachments, polls, and emoji reactions
Conversation metadata — who is in a chat, chat names, timestamps, edits, and deletions
Delivery signals — typing indicators, unread counts, and when you last opened a chat
Chat settings you choose, such as a chat background or muted notifications

How messages are stored

Messages and attachments are sent over encrypted connections (TLS) and stored on our Supabase infrastructure in the United States so you can read them across devices. In-app messages are not end-to-end encrypted. Row-level security policies restrict database access to the participants of a conversation.

We do not read private conversations in the ordinary course of business, and we never scan messages to build advertising or marketing profiles — Maylay does not serve ads. Authorized staff may access message content only to investigate a report of abuse, enforce our Terms of Service, protect the security of the Service, fix a technical problem, or comply with a legal obligation.

Who can see your messages

The other participants, who can copy, screenshot, or forward anything you send
Members added to a group chat later, who can read the conversation from the point they joined forward
Supabase, as our database and storage provider, and Apple or Google push services, as described in Section 6
DeepL, where automatic translation is applied to the text, as described in Section 4

We never sell your messages, and we do not share them with advertisers or data brokers.

Message notifications

Push notifications for new messages may show the sender's name and a preview of the message on your lock screen. You can hide previews or turn message notifications off in your device settings, or mute an individual chat in the App.

Your controls

Block a user to stop them sending you direct messages
Leave or delete a conversation to remove it from your view of the App
Delete messages you have sent
Mute notifications for any chat
Report a message by pressing and holding it and choosing Report, or by emailing support@maylay.org

Retention

Messages are kept until you or another participant deletes them, or until your account is deleted. Deleting your account removes your profile and personal data within 30 days; messages you already sent remain in the recipients' threads, permanently stripped of your identifying information and attributed to "Deleted User," as described in Section 9. Residual encrypted backups are purged within 90 days.

15. Payments Between Users

The Service lets you save payment handles — such as a Venmo, Cash App, Zelle, Apple Cash, PayPal, or Chime username, which for some platforms is a phone number or email address — and attach them to a chat message so another user can pay you, for example to split a court or field fee.

Handles are stored on your profile as private data and are shown to another user only when you attach one to a message yourself. Payments happen entirely inside those third-party apps under their own terms and privacy policies. Maylay never receives, holds, or processes money, does not collect card or bank account numbers, and never sees your transactions or balances.

If the Service offers paid features, purchases are processed by Apple or Google. We receive purchase and subscription status from them, never your payment card details.

16. Contests, Promotions, and Referrals

If you enter a contest or promotion in the App, we process your entry and the content you submit with it, such as a photo, together with your username and profile so winners can be selected and announced. Each promotion has its own official rules, which say what is collected and how winners are contacted. We use your referral code to attribute invitations you send. We do not use contest entries for advertising, and entering is always optional.

17. Our Website

This policy also covers www.maylay.org. The website exists to describe the App and host these legal documents. It does not require an account, and we do not use advertising or cross-site tracking cookies on it. Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting. If we later add analytics or cookies to the website, we will say so here first.

18. International Users

The Service is intended for use in the United States, and our infrastructure and the data it holds are located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your country.

19. Governing Law

This Privacy Policy is governed by the laws of the State of California. Disputes will be resolved through binding individual arbitration administered by JAMS under its Streamlined Arbitration Rules and Procedures, as set out in Section 24 of our Terms of Service.

20. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via in-app notification or email at least 14 days before material changes take effect, and we will update the "Last Updated" date above. Continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you may delete your account before that date.

21. Contact Us

Maylay Sports Inc. — Data Privacy Team

Email: support@maylay.org

Website: www.maylay.org

Privacy requests are answered from this address. Please include the email address or phone number on your Maylay account so we can verify your identity.

Page updated

Google Sites

Report abuse