Privacy Policy
1. Introduction
This Privacy Policy explains what personal data Goatza collects, why we collect it, who we share it with, and what rights you have over it.
It applies to the Goatza website and mobile applications, and should be read alongside our Terms of Service.
We are the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
Data Fiduciary: Shabeeb TK Based in: Kannur, Kerala, India Postal address: Available on written request to goatza.official@gmail.com Contact for data matters: goatza.official@gmail.com
2. What we collect
2.1 Information you give us
| Category | What it includes | Why we need it |
|---|---|---|
| Account | Email address, phone number, password (stored hashed), Google account identifier if you use Google Sign-In | To create and secure your account, and to sign you in |
| Profile | Name, username, headline, about text, profile photo, cover photo | To build your public sporting identity |
| Sporting attributes | Date of birth, gender, height, weight, sport, positions | To build your profile and to determine eligibility for age-banded recruitments |
| Location | City, country, place name, and approximate coordinates | To show you nearby opportunities and to display your location on your profile |
| Career and achievements | Clubs, roles, dates, honours, statistics, CV entries | To display your sporting history |
| Content | Posts, images, videos, highlights, comments, likes | To publish what you choose to share |
| Messages | Message content and conversation participants | To deliver your messages |
| Applications | Name, email and phone you submit with an application, attached media, and your answers to the Organization's questions | To pass your application to the Organization |
| Organization data | Organization name, description, logo, location, member roles | To operate Organization pages |
| Reports and blocks | The report you submit and the account it concerns | To investigate and enforce our rules |
2.2 Information we collect automatically
| Category | What it includes |
|---|---|
| Device and push | Device identifier and push notification token, device name |
| Technical | IP address, browser or app version, timestamps |
| Usage | Which recruitments have been shown to you, so we do not repeat them |
| Security | Login events, failed attempts, rate-limit records |
We do not use third-party advertising trackers, and we do not sell your data.
2.3 Information from others
- Google, if you sign in with a Google account: your name, email address and profile picture.
- Google Places, when you search for a location: the place details you select.
- Other users, if they report or block you, or mention you in content.
3. How we use your data
We use your data to:
- Create and operate your account, and authenticate you.
- Display your profile and content to the audience you choose.
- Deliver messages, notifications and emails.
- Show you relevant recruitments and let you apply to them.
- Pass your applications to the Organizations you apply to.
- Detect, investigate and prevent abuse, fraud, impersonation and harm to minors.
- Comply with legal obligations and respond to lawful requests.
- Fix problems, monitor performance and improve the Platform.
Our lawful basis is your consent, given when you create an account and when you take specific actions such as submitting an application, and, where applicable, legitimate uses permitted under the DPDP Act, such as complying with law and preventing fraud.
You may withdraw consent at any time by closing your account. Withdrawal does not affect processing already carried out.
4. If you are under 18
Under the DPDP Act, anyone under 18 is a child. Different rules apply.
What we require
- The minimum age to hold a Goatza account is 13.
- If you are under 18, you must have your parent or legal guardian's permission to use Goatza.
- Before you apply to any recruitment, you must give us your parent or guardian's name and contact number, and confirm they consent.
- We may contact your guardian to confirm.
What we do not do
- We do not track, monitor or profile children.
- We do not use behavioural targeting on children.
- We do not serve advertising to children.
Additional protections
- New posts by users under 18 default to a followers-only audience.
- We apply extra scrutiny to reports involving accounts belonging to minors.
Full details are in our Youth Safety Policy.
Parents and guardians: you may ask us to access, correct or delete your child's data, or to close their account, by writing to goatza.official@gmail.com. We will ask you to verify your identity and your relationship to the child before we act.
We are working towards the verifiable parental consent mechanism required by the DPDP Rules, 2025, ahead of the compliance date of 13 May 2027.
5. Who we share your data with
5.1 Other users
What you post is visible according to the visibility setting you choose. Your profile, username and public content may be visible to anyone with the link, unless you have restricted it.
5.2 Organizations you apply to
When you apply to a recruitment, the Organization receives the name, email and phone number you submitted, your profile information, any media you attached, your answers, and, if you are under 18, your guardian's contact details.
We require Organizations to use this only to assess your application. We cannot control what they do once they have it.
5.3 Service providers
| Provider | What they do | Where |
|---|---|---|
| Render Services, Inc. | Hosts our application servers and database | Singapore |
| Vercel Inc. | Hosts and delivers our website | Global CDN |
| Cloudflare R2 | Stores and delivers your images and videos | Global |
| Google LLC | Google Sign-In, and Google Places for location search | Global |
| Google Firebase (FCM) | Delivers push notifications to your device | Global |
| Resend, Inc. | Sends transactional email such as verification codes | Global |
These providers process data on our instructions. We do not permit them to use it for their own purposes.
5.4 Legal and safety
We may disclose data where required by law, a court order or a lawful government request, or where necessary to investigate a serious breach of our Terms or to protect someone from harm. Where we identify content involving the sexual exploitation of a child, we will remove it and report it to the appropriate authorities.
6. Where your data is stored
Your data is stored on servers operated by our providers, which may be located outside India. Media files are distributed via a global content delivery network so they load quickly.
Cross-border transfer is permitted under the DPDP Act except to countries the Government of India specifically restricts. We monitor for any such restriction.
7. How long we keep it, and what deletion means
We want to be precise here, because "delete" means different things in different systems.
| Action | What happens |
|---|---|
| You delete a post, comment or message | It is immediately hidden from all users and removed from feeds. The record is retained internally in a deleted state and is permanently erased during periodic cleanup. |
| You close your account | Your profile stops being visible immediately. Your personal data is permanently erased within 30 days. |
| Backups | Encrypted database backups are retained for a limited period and then overwritten. Data you have deleted may persist in a backup until it expires. |
| Content others hold | Messages you sent remain visible to the recipient. Applications already delivered remain with the Organization. |
| Legal holds | Where we are required to retain data for a legal claim, investigation or statutory obligation, we retain only what is necessary, for as long as necessary. |
Reports, blocks and enforcement records are retained after account closure in a minimised form, so that a banned user cannot simply re-register.
8. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and how we process it.
- Correct data that is inaccurate, and complete data that is incomplete.
- Erase your data where it is no longer needed for the purpose it was collected for.
- Nominate another person to exercise your rights if you die or become incapacitated.
- Grieve — to raise a complaint with us, and to escalate to the Data Protection Board of India if unsatisfied.
To exercise any of these, write to goatza.official@gmail.com. We will respond within 90 days, and usually much sooner. We may need to verify your identity first.
9. Cookies and similar technologies
We use cookies and local storage only for essential purposes: keeping you signed in, maintaining your session and protecting against abuse.
We do not use analytics or advertising cookies.
We do not use advertising or cross-site tracking cookies.
10. Security
We protect your data using access controls, encryption in transit (HTTPS), hashed passwords, short-lived access tokens, rate limiting and restricted administrative access.
No system is perfectly secure. If you believe your account has been compromised, contact goatza.official@gmail.com immediately.
Data breaches. If a personal data breach occurs, we will notify affected users and report it to the Data Protection Board of India within the timelines required by the DPDP Rules.
11. Changes to this Policy
We may update this Policy. The version number and date at the top will change. For material changes we will notify you in the app or by email before they take effect.
12. Contact and grievances
For any question about this Policy or your data:
If you are not satisfied with our response, you may contact our Grievance Officer:
Grievance Officer: Shabeeb TK Email: goatza.official@gmail.com Postal address: Available on written request to goatza.official@gmail.com
We acknowledge complaints within 24 hours and resolve them within 15 days.
If you remain dissatisfied, you may complain to the Data Protection Board of India.