Marketplace Privacy Policy

1. Scope and controller

This Marketplace Privacy Policy explains how Lineup Labs (OPC) Private Limited ("Court Cobra", "we", "us", or "our") collects, uses, discloses, and retains personal information when you use the Court Cobra marketplace website and related marketplace services (the "Marketplace").

Lineup Labs (OPC) Private Limited is the controller of the personal information described here. Your use of the Marketplace is also governed by our Marketplace Terms of Service. Where applicable law requires consent for a particular use, we request it separately.

2. Information we collect

2.1 Account and profile information

• Verified mobile number and email address. Both are checked with one-time codes and used for account authentication, recovery, security, and communications you enable.
• Display name. This appears on your public profile, listings, ratings, and Marketplace interactions.
• Optional Aadhaar identity verification. If you choose this feature, DigiLocker and Meon process your authentication, OTP, consent, and Aadhaar record. Court Cobra keeps the verification method, legal name, verification date, and a server-keyed one-way fingerprint used to detect the same Aadhaar identity on another account. The fingerprint is calculated from the returned Aadhaar details without retaining those details. We do not retain the Aadhaar number, date of birth, address, gender, photograph, XML, or document file returned in that response.
• Account records. We record your account identifier, account creation date, confirmation that you are at least 18, Terms acceptance, and relevant consent timestamps and versions.
• Preferences. These can include timezone, time format, distance unit, theme, mobile-number-sharing policy, and Marketplace email, browser notification, and active verified-status choices.

Email and mobile verification does not verify your name, identity, age, background, authority, or any Marketplace claim. Aadhaar verification is separate and optional.

2.2 Listings and content you provide

Depending on what you post, we collect sport, venue name and address, map location, date, time, timezone, price or budget, currency, skill level, number of spots, search radius, notes, public or private visibility, whether the listing is limited to ID Verified members, listing status, and related details for:

• public games;
• court offers;
• player-availability listings; and
• court requests.

We also collect Marketplace chat messages and the content you submit in ratings, mobile-number-sharing requests, feedback, and communications with us. Do not include unnecessary identity documents, payment credentials, medical information, or another person's private or sensitive information.

2.3 Marketplace activity

We generate records of how the Marketplace is used, including listings created, viewed, made public or private, withdrawn, sold, expired, or deleted; games joined or left; inquiries and interest; chat participation and message read state; mobile-number-sharing requests and decisions; connections; ratings and rating changes; notification state; and the date and time of these actions.

2.4 Location and venue information

• Browse location. When you choose an area or use your device location to find nearby results, the Marketplace uses the selected coordinates and timezone for search and distance calculation. Coordinates sent to Court Cobra for a browse request are rounded to two decimal places.
• Approximate search origin. Player-availability and court-request listings accept an address, landmark, or one-time device location. Court Cobra rounds the coordinate to two decimal places before storing it and does not store the entered address text with the listing. The stored origin and your maximum search radius are not shown publicly.
• Game and court venue. A marketplace game or court offer includes a venue selected through Google Maps. Venue name, address, map link, place identifier, coordinate, and timezone are stored and are available to signed-in members who can open the listing, including through a private listing URL.
• Device location. Device location is requested only when you choose the location action or have already granted the browser permission used by the nearby search. The Marketplace does not perform continuous or background location tracking.

Google Maps receives place searches and location requests used for autocomplete, geocoding, place details, and maps. If you use device location, precise coordinates may be sent to Google Maps to resolve a place before Court Cobra stores or queries with a rounded coordinate.

2.5 Technical and security information

• IP address, user agent, request date and time, request path, response status, request identifier, approximate request size, and diagnostic or error information;
• access and refresh tokens, token expiry, session activity, and security or abuse-prevention records; and
• browser language, locale, timezone, and related settings used to choose display and regional defaults.
• browser push subscription endpoint and encryption keys when you enable browser notifications.

Standard API request logs are designed not to include authorization headers or request and response bodies.

2.6 Information we do not retain for the Marketplace

The Marketplace does not retain passwords, payment card or bank details, your address book, advertising identifiers, biometric data, continuous location history, native mobile push tokens, Aadhaar numbers, Aadhaar copies, Aadhaar photographs, or Aadhaar addresses. Payments are arranged directly between members and are not processed by Court Cobra.

3. Cookies and browser storage

3.1 Essential session cookies

The Marketplace uses first-party, HttpOnly cookies for access tokens, refresh tokens, your Court Cobra user identifier, and your display name. These cookies keep you signed in, rotate sessions securely, and show the correct account state. They use SameSite protections and, in production, secure transport. They expire with the relevant session or are cleared when you sign out.

3.2 Local browser storage

The Marketplace may store the following on your device:

• theme, distance, time, filter, browse-section, and search preferences;
• your selected browse area, including its label, coordinate, and timezone;
• unsent game or court drafts, which can include venue details, prices, spot counts, and notes; and
• the last realtime event cursor used to keep Marketplace information current; and
• a temporary opaque verification-session identifier while you leave Court Cobra to complete DigiLocker consent.

Local storage remains until the Marketplace replaces it, a successful action clears the relevant draft, or you clear site data in your browser. Information is not sent to Court Cobra merely because it is in local storage, but relevant fields are sent when you perform a search or submit a listing.

3.3 No advertising trackers

We do not use advertising cookies, cross-site behavioural advertising trackers, Google Analytics, or similar audience analytics services. Third-party services described below may receive ordinary technical information when their features are used.

4. How we use information

We use Marketplace information to:

• create, authenticate, secure, and support your account;
• publish, search, sort, match, display, withdraw, and delete Marketplace listings;
• calculate nearby results and show only a bounded distance range where the underlying origin is private;
• enable chat, game participation, inquiries, connections, mobile-number sharing, and ratings;
• provide public profile activity and experience summaries;
• perform optional, consent-based Aadhaar legal-name verification and display the resulting identity status;
• maintain the in-site notification centre, send Marketplace email notifications unless you turn them off, and send browser notifications you enable;
• moderate content, investigate complaints, detect fraud or abuse, enforce our Terms, and protect members and the service;
• diagnose errors, maintain reliability, and secure systems;
• respond to requests, legal process, disputes, and regulatory obligations; and
• establish, exercise, or defend legal rights and prevent harm.

We do not use Marketplace information for advertising, data brokerage, or cross-context behavioural profiling.

5. What is visible and what is shared

5.1 Member-visible Marketplace information

Active public Marketplace listings may be discovered in Browse by signed-in members. Member-visible information can include:

• sport, date, time, price or budget, currency, skill level, spots, notes, and listing status;
• public game and court venue name, address, map link, and location;
• your display name, optional Aadhaar-verified legal name and verification date while the verification remains on your account, account creation period, active court listing count, positive experience count, number of people who rated you, and up to a bounded set of your active listings; and
• your role in a listing, such as host, listing member, player, or requester.

Member-visible information can be copied, screenshotted, saved, or redistributed by other members. Court Cobra cannot remove copies held outside its systems.

5.2 Private Marketplace listings

A private listing is omitted from Browse, public profile listing collections, and potential-match recommendations. A signed-in member who receives its URL can open it and may reshare that URL. Changing listing visibility does not remove existing game participants, interest, or chats.

5.3 Approximate listing origins and distance ranges

Player-availability and court-request listings do not publicly show the member's entered address, stored coordinate, or maximum search radius. When a viewer supplies a browse area, Court Cobra may show only an upper distance in 5-kilometre or 5-mile steps between the rounded locations. This distance is approximate and must not be used to infer an exact address. A viewer could theoretically repeat searches with different browse areas or search radii to narrow the approximate origin further, potentially to less than 1 kilometre. Court Cobra considers this residual triangulation risk minimal and acceptable because the stored origin is rounded to two decimal places, roughly 1 kilometre, and neither the exact coordinate nor the entered address is retained or displayed.

5.4 Chats and Marketplace relationships

Chat messages and related activity are shared with the members of the relevant Marketplace conversation. Game participation, interest, listing status, mobile-sharing state, connections, and ratings are shared with people who need them for the relevant feature. A recipient may copy, save, screenshot, or disclose information you send.

5.5 Mobile-number sharing

Your mobile number is not public. You choose whether an eligible member can reveal it without approval or must request approval. When sharing is completed, each member receives the other's mobile number. The number may then be stored in the recipient's device or address book. A later revocation in Court Cobra does not erase copies already obtained by that person.

5.6 Limits of public trust signals

Court Cobra does not verify public profiles, listings, ratings, venue bookings, transfer rights, payment claims, prices, skill levels, availability, or member-provided content. The Aadhaar identity badge has one narrow meaning: DigiLocker returned an Aadhaar-backed legal name for that account after authentication and consent. The legal name and verification date are shown on the public profile only while the verification remains on the account. The display name may differ, and the badge is not an age, background, safety, ownership, booking, payment, or endorsement check.

6. How we disclose information

We disclose information only as described below:

• To the public and other members. We disclose listings, profiles, messages, activity, ratings, and mobile numbers according to the visibility and interaction rules above.
• To service providers. Vendors process information for hosting, authentication, optional identity verification, maps, communication delivery, content moderation, security, support, and infrastructure under contractual or equivalent restrictions.
• For safety, legal, and enforcement purposes. We may disclose information when reasonably necessary to comply with law or valid legal process; respond to emergencies; prevent fraud, abuse, or harm; enforce our Terms; or protect the rights, safety, and property of Court Cobra, members, or others.
• In a business transaction. Information may be transferred as part of a merger, financing, reorganization, sale of assets, insolvency, or acquisition, subject to applicable law and continued protection.
• At your direction. We disclose information when you request or authorize it, such as when you share your mobile number or a public listing link.

We do not sell personal information or share it for cross-context behavioural advertising.

7. Service providers used by the Marketplace

7.1 MSG91

MSG91 processes your mobile number or email address only to send and verify account one-time codes and provide associated delivery status.

7.2 Resend

When Marketplace email is enabled for your account, Resend processes your registered email address, the approved notification content and template variables, and delivery identifiers and status to send those messages for Court Cobra. New accounts start with Marketplace email enabled, and you can turn it off in your profile.

7.3 Meon and DigiLocker

By starting Aadhaar identity verification, you request DigiLocker to share the Aadhaar record you select with Meon, Court Cobra's identity verification provider. Meon processes the OTP, DigiLocker authentication, consent, and selected Aadhaar record, then returns the verification result to Lineup Labs (OPC) Private Limited. Court Cobra uses the returned information to verify your legal name and create a server-keyed one-way fingerprint that prevents the same Aadhaar identity from being verified on multiple accounts. Court Cobra does not retain your Aadhaar number, date of birth, address, gender, photograph, or Aadhaar document. Court Cobra requests only Aadhaar for this flow and does not request a selfie, face match, device verification, PAN, or another document.

7.4 Google Maps Platform

Google Maps Platform processes place searches, coordinates, place identifiers, map requests, and ordinary request information to provide autocomplete, geocoding, venue details, timezone data, and map links. Google's processing is also governed by its own terms and privacy policy.

7.5 OpenAI

Display names and Marketplace chat text are checked with automated moderation. Court Cobra first applies local checks and may send text to OpenAI's moderation service for classification. Chat messages are also reviewed through the moderation service after posting and may be removed under Court Cobra's content rules.

7.6 Hosting and operations providers

Cloud hosting, database, network, logging, security, and operational providers process the information necessary to run and protect the Marketplace. We require providers to use information only for the contracted service and to protect it appropriately.

8. Legal bases

Where data protection law requires a legal basis, we rely on the following:

• Performance of a contract. We process account, listing, profile, chat, activity, contact-sharing, rating, session, and preference information to provide the Marketplace you request.
• Consent. We rely on consent for browser device location and browser notifications where required, Marketplace email enabled at account creation, and the optional DigiLocker Aadhaar verification flow. You can withdraw consent before completing the relevant flow or through your browser or Marketplace settings where applicable.
• Legitimate interests. We process limited information to secure and improve reliability, prevent fraud and abuse, moderate content, support members, enforce the Terms, and establish or defend legal claims, provided those interests are not overridden by your rights.
• Legal obligations and vital interests. We may process information to comply with law, valid legal process, and safety or emergency obligations.

In jurisdictions that do not recognize every basis above, we process information under the basis permitted by applicable law, including consent or necessity to provide the requested service.

9. Data retention

We retain information only for as long as needed for the purposes described here, including to operate the Marketplace, preserve shared context, meet legal obligations, resolve disputes, enforce agreements, and protect the service.

• Account and profile. Retained while your account is active, then deleted or de-identified when you delete your account, subject to the exceptions below. After account deletion, we preserve minimum registration information—your former account identifier, registered mobile number and email address, account creation date, Terms acceptance record, and deletion date—for 180 days as required by applicable intermediary law, then delete it unless a longer legal hold applies. An Aadhaar-verified legal name, method, date, status, and keyed duplicate-detection fingerprint are deleted earlier if you delete identity verification.
• Identity verification sessions. Meon client credentials for an attempt are encrypted while it is pending and erased when the attempt succeeds, fails, expires, or is replaced. The remaining attempt record may be retained as an account and security audit record.
• Listings and Marketplace history. Active, withdrawn, sold, expired, or deleted listings and their rounded origins are retained as account history until you delete the account or the content is deleted where deletion is available. Shared games may continue under another administrator after your account is removed.
• Chats.Messages are retained for the life of the relevant conversation or resource. If you delete your account, messages needed to preserve another member's conversation or shared game context may remain with your sender identity removed.
• Ratings, mobile sharing, and connections. Retained until removed, revoked, superseded, or your account is deleted, subject to limited abuse-prevention and legal records.
• Browser storage. Search preferences, selected area, drafts, theme, and realtime cursor remain on your device until replaced or cleared as described in Section 3.
• Marketplace notifications. In-site notification records are generally retained for 30 to 365 days depending on importance. Your email preference remains until changed or the account is deleted. Browser push subscriptions remain until you disable them, the push service expires them, or you delete your account.
• Authentication and security records. Expired OTP challenges are deleted after a short expiry grace period. OTP audit and terminal provider-delivery records are generally retained for up to 90 days. Realtime invalidation records are generally retained for 24 hours. Security or activity records may be retained for up to 365 days.
• Reports, removed content, and evidence. A report, its complaint ID, status and moderation history, a snapshot of the reported content and available associated records, and content removed or disabled through moderation are preserved for at least 180 days after resolution or removal. Open matters and legal holds are kept longer as needed.
• Production system logs. Logs needed for security, incident response, and legal compliance are retained on a rolling basis for at least 180 days in India. Access is restricted and logs may be kept longer for an active incident or legal hold.
• Legal holds and backups. Information may be kept longer where required by law, a valid legal hold, fraud prevention, safety, dispute resolution, or backup rotation. We restrict use of retained information to those purposes.

Account deletion is permanent. It cannot delete information another member copied, saved, screenshotted, added to an address book, or disclosed outside Court Cobra.

10. Your choices and rights

10.1 Marketplace controls

You can:

• update your display name, verified email, verified mobile number, timezone, time format, and distance preference from your profile;
• require approval before an eligible member receives your mobile number;
• disable Marketplace email or browser notifications independently from your profile;
• deny or revoke device-location permission in your browser and enter an area or landmark instead;
• clear Marketplace cookies and local storage through your browser; and
• permanently delete your Court Cobra account from your Marketplace profile.

10.2 Privacy rights

Depending on where you live, you may have the right to access, know, correct, delete, restrict, object to, or receive a portable copy of your personal information; withdraw consent; nominate another person where local law provides; and complain to a data protection authority. You will not be discriminated against for exercising a privacy right.

Send a request to developer@courtcobra.com. We may verify your identity and request details needed to locate the relevant information. We will respond within the period required by applicable law. If we cannot fulfil a request, we will explain why where legally required.

11. Security

We use safeguards designed to protect Marketplace information, including HTTPS/TLS in transit, OTP-based authentication rather than stored passwords, short-lived access tokens, rotating refresh sessions, HttpOnly and SameSite cookie protections, token hashing where applicable, access controls, rate limits, redaction from standard request logs, and restricted production access.

No system, transmission, or storage method is completely secure. You are responsible for protecting access to your email, mobile number, devices, browser session, and copies of information you receive. Contact us immediately if you suspect unauthorized access.

12. Automated processing and moderation

The Marketplace automatically filters and sorts listings based on criteria such as sport, time, skill level, price, availability, and approximate distance. It also aggregates experience ratings and suggests relevant Marketplace results. These functions do not verify a member or listing and do not make decisions with legal or similarly significant effects.

Automated content checks may reject or remove display names and chat messages under Court Cobra's content rules. You may contact developer@courtcobra.com if you believe an automated restriction was incorrect.

When you report a profile, listing, chat, or message, we collect the target, reason, optional details, a snapshot of the reported content and available context, the complaint ID, status, moderation history, and our response. This information is used to investigate, communicate the outcome, enforce the Terms, prevent abuse, and meet record preservation obligations. The reported person is not told the reporter's identity unless disclosure is required by law.

13. Children

The Marketplace is intended only for people aged 18 or older. Age is self-declared and is not independently verified by Court Cobra. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact developer@courtcobra.com so we can investigate and delete the account where appropriate.

14. International processing

Court Cobra is operated from India. Personal information may be processed in India and in other countries where our service providers operate. Those countries may have different data protection laws. Where required, we use contractual, consent-based, adequacy, or other lawful safeguards for international transfers.

15. Changes to this Policy

We may update this Policy to reflect changes in the Marketplace, law, providers, or our practices. We will update the date above and provide notice through the Marketplace or your registered email before a material change takes effect, unless an earlier change is reasonably necessary for security, legal, or abuse-prevention reasons.

16. Contact