This policy applies to the ARENA mobile application and services. The data controller is ARENA, Andijan, Uzbekistan. Privacy contact: [email protected].
Account and profile: name, email, phone number, protected password hash, profile photo, bio, playing position, and optional onboarding answers.
Activity: bookings, matches, club membership, chat messages, reviews, notifications, and service-use records.
Payments: order amount and status, provider, and transaction identifier. For Humo/UzCard payments, card number and expiry are sent directly from the device to Payme over an encrypted connection; ARENA does not store full card numbers or CVV codes.
Device and technical data: Android/iOS platform, Firebase installation/push token, IP address, app version, technical device/operating-system details, and server security or diagnostic logs. We do not use the Firebase Crashlytics or Firebase Performance Monitoring SDKs.
Location: with permission, the app uses precise GPS location to find nearby stadiums. A selected region and permission response may be stored in your profile. Precise coordinates are stored on the device and sent to Open-Meteo for weather requests, but are not retained as a permanent profile field on ARENA servers.
Photos/camera are used only when you choose or take a supported profile, club, or other image.
We use data to create and secure accounts, complete bookings and payments, provide match and club features, verify by SMS, send essential and permitted push notifications, provide support, prevent fraud and abuse, and comply with legal duties.
Firebase Cloud Messaging (Google) processes the Firebase installation ID and device push token to deliver notifications. While providing Firebase, Google may also process the IP address, app/package identifier, and technical or operational diagnostic data. Our SMS provider receives the phone number and data needed for a one-time code. Click, Payme, and Paynet process payment information, orders, and transactions. Open-Meteo receives precise or selected coordinates only to return weather information. Hosting and infrastructure providers may store or transmit data on our behalf. We do not sell personal data, share it for advertising, or track users across other companies' apps or websites.
An active account profile is kept while the account exists. Location selection and coordinates may remain locally until changed, app data is cleared, or the app is removed. ARENA does not retain card numbers or CVV codes. OTP codes are replaced when a new code is issued and expire quickly. Push tokens are removed from ARENA servers when a device disconnects or the account is deleted. A Firebase installation ID may be retained by Google until a deletion API call is made and may then take up to 180 days to be removed from Google's live and backup systems. When an account is deleted, profile identifiers and content are immediately anonymized and active sessions are revoked. Anonymized booking, match, and payment records may be retained for up to 3 years for disputes, accounting, and legal duties. Deleted data in security backups expires through normal rotation within 30 days.
In the app: Profile → Settings → Delete account. Outside the app, use the public /legal/account-deletion page or email [email protected] with your registered email/phone. We may verify your identity. Deletion is irreversible; minimum records may be retained for the period above where required by law or fraud prevention.
You may view and edit your profile, revoke location/camera/photos/notification permissions in device settings, request a copy or correction of data, and delete your account. Contact [email protected].
We use transport encryption, password hashing, access controls, and session revocation, but no system is completely secure. ARENA is not intended for children under 13, and we do not knowingly collect their data.
For material changes we will update the date and notify users in-app when appropriate. Contact: [email protected], +998 77 205 99 59, Andijan, Uzbekistan.