Privacy policy

This Policy explains what personal data Emvipi collects, why, where it is kept, who gets it and what your rights are. It is the written notice required by Article 23 of the Law "On Personal Data".

1. Who we are

Owner and operator of your data: [Company legal name], [legal form], TIN [INN], address [address], Tashkent, Uzbekistan ("Emvipi", "we"). Person responsible for personal data (Law, art. 31): [name / role], [email], in the app (Profile → Help & support → Contact us).

2. Data we collect

Your location is not sent to us. If you allow location access, your phone uses it on the phone only, to show the distance to games ("x km") and your position on the map. Emvipi's servers never receive or store your location. The only map points we store are those of venues that organisers save (places, not people).

Extra data for organisers

Admins only: the Telegram user id of Emvipi admins, so the admin bot accepts their actions.

What we do not collect: your location (see above), passport data, biometric data (we do not use face or fingerprint login), genetic data, health data, home address, contacts list. No analytics or advertising tools are in the app (no Firebase Analytics, Crashlytics, AppMetrica, Amplitude or Mixpanel). Firebase is used only to deliver push notifications.

Friends you book for: if you type a friend's name, make sure they agree. We store only the name, nothing else.

3. Legal basis

We process your data with your consent, which you give when you sign up by ticking [the consent box] after reading this Policy (Law, art. 18, 21), and to perform the agreement with you (the Terms of Use). You may withdraw consent at any time by deleting your account (section 8). [LAWYER: art. 21 requires consent in a form that can be proven; confirm a tick box with stored time + Policy version is enough, and whether a separate consent for cross-border transfer is needed, see section 5.]

4. Who can see your data

• Other users see: first name + initial, photo, levels, games played; your reliability % only you and the organisers of games you book; for organisers: games hosted, cancellation rate, average rating, venue details, Telegram/Instagram links. Guests (not logged in) see games but not player lists.
• The organiser of a game you booked also sees your booking, friends' names and level, so they can form teams and mark attendance. Organisers do not see your phone number.
• Emvipi admins see what is needed to review applications, reports, restriction requests and photos. For a restriction request they may contact the player (by phone or in the app) before deciding. Admin notices go to a private Telegram group; they contain display names, the last 4 digits of a phone at most, and profile ids, never full phone numbers or locations.
• Service providers (processors), only for the purposes above:

We have no third-party crash or analytics service. Crash reports and problem reports are stored in our own database (Supabase, Frankfurt).

• Authorities, when the law requires it.
• We do not sell your data and do not use it for advertising.

5. Where your data is stored ⚠

Our main database is hosted in Frankfurt, Germany, so your data is transferred outside Uzbekistan.

What the law says today (our reading, to be confirmed by a lawyer):

• Since 27.03.2026 (ZRU-1125), Article 27¹ part 2 requires storage inside Uzbekistan only for: biometric data, genetic data, and data of users of telecommunications operators working in Uzbekistan. Emvipi does not collect biometric or genetic data.
• Other personal data may be stored and processed abroad if one of these is met (art. 27¹ part 3): (a) the country is on the government's list of countries with equal protection; (b) we adopt standard contract terms or binding corporate rules approved by the authorised body; or (c) we follow international data-management standards from a list approved by that body.
• Article 15 also allows transfer to a country without equal protection with your consent.

⚠ Open points before launch (see the lawyer checklist):

1. As of our research (16.10.2026) we found no published country list, approved contract terms or standards list, so conditions (a)–(c) may not be usable yet. One review (itts.uz, 30.03.2026) calls cross-border storage a "grey zone" and says consent under art. 15 is the working basis.
2. Whether phone numbers we store count as "data of users of telecom operators" (which must stay in Uzbekistan). We think that rule aims at the operators' own subscriber data, but this is not settled.
3. If a lawyer says localisation applies, options are: keep phone numbers (or everything) on a server in Uzbekistan, or move the database to a Uzbek data centre, plus registration in the State Register of personal data databases (art. 20).

Draft wording until resolved: "By accepting this Policy you agree that your data is transferred to and stored in Germany (EU) and processed by the providers listed in section 4."

6. How long we keep data

7. Security

Access to the database is limited by row-level rules: each user can read and change only their own data through the app. Phone numbers are kept only in the login system and are not in any table other users can query. Connections are encrypted (HTTPS). Secrets and keys are not stored in the app. Only you can log in to your account, and only on one device at a time.

8. Your rights

You have the right to (Law, art. 22, 23, 30):

• know whether we process your data, what data, why, from where, how long, and to whom it goes (including abroad);
• correct your data (most of it you can edit in the app; other corrections within 3 days of your request, art. 11);
• withdraw consent and delete your account: in the app, Profile → Edit profile → Account → Delete account, or on our website [emvipi.uz/delete], or by writing to us. You cannot delete while you have an active game you organise; cancel or finish it first;
• object to processing;
• complain to the authorised state body for personal data [name: State Personalisation Centre / as designated] or to a court.

We answer requests within [10] days. A refusal is given in writing with reasons (art. 22).

9. Age

Emvipi is for people aged 16 and over. If you are 16 or 17, Uzbek law (Law "On Personal Data", art. 21) requires the written consent of your parent or guardian to process your data: you may sign up only with that consent, and you confirm it at sign-up. We do not knowingly allow anyone under 16; if we learn that a user is under 16, we delete the account. [LAWYER: how the parent's written consent is collected and proven, e.g. an in-app confirmation by the parent.]

10. Notifications

Notifications about your bookings, cancellations, game changes, no-shows and bans are always sent, because they are part of the service. Reminders, nearby games and photo reminders can be turned off in Settings. You can turn off all notifications in your phone settings.

11. Changes

We will tell you in the app before an important change to this Policy takes effect. If a change needs new consent, we will ask for it.

12. Contact

[Company], [address], [email], in the app (Profile → Help & support → Contact us).