Effective date: 2026-05-31 · Last updated: 2026-10-16
This Privacy Policy is for the xfield application and website at https://xfield.app. It explains how xfield (“we”, “us”, “our”) collects, uses, shares, and protects information when you use our website, mobile apps, and related services (the “Service”), including Google user data obtained through Google Sign-In.
xfield is a sports venue booking platform. Payments you make are for booking a real sports facility (and related booking services), not for buying digital goods inside the app.
Contact for privacy requests: support at xfield.app.
Depending on how you use the Service, we may collect:
xfield uses Google Sign-In only for the stadium owner portal. Players who book or join matches sign in with phone number and WhatsApp OTP, not Google.
Our Google OAuth client requests only these scopes: https://www.googleapis.com/auth/userinfo.email (see your primary Google Account email address) and https://www.googleapis.com/auth/userinfo.profile (see your personal info, including any personal info you have made publicly available).
When an approved stadium owner chooses “Continue with Google”, our application will access the Google user data Google returns for those scopes, including: primary email address, email verification status, Google account identifier (sub), name, and profile photo URL. We do not request or access Gmail, Google Drive, Calendar, Contacts, Google Workspace content, or any other Google API scopes.
We will use Google user data only to provide and improve user-facing owner features in the Service: linking a Google account to an existing xfield account, checking that the email is allowed for owner access, signing the owner into the owner dashboard, and displaying the owner’s name and profile photo in the owner portal and related stadium-management screens.
We do not use Google user data for targeted advertising, personalized or interest-based ads, retargeting, selling to data brokers, providing data to information resellers, determining credit-worthiness, lending, creating unrelated databases, or training non-personalized AI/ML models.
We store the Google account identifier, name, email, and profile photo URL in our database as part of the owner account record, linked to the owner’s xfield user id. Session cookies keep the owner signed in while using the Service.
We do not sell Google user data. We do not transfer or disclose Google user data to third parties for purposes other than providing or improving the Service (for example hosting/infrastructure providers that process data solely to operate the Service), or when required by law, or to protect rights, safety, and security.
Security procedures are in place to protect the confidentiality of Google user data. We use HTTPS/TLS encryption to protect Google user data in transit between your device, Google, and our servers, and we restrict access to owner account records to authorized systems and personnel needed to operate the owner portal.
We retain Google-linked owner profile data for the length of time needed to provide owner access and fulfill the purposes in this Privacy Policy, unless a longer period is required or permitted by law.
You may request deletion of your Google-linked data by deleting your xfield account in Settings or on the delete-account page, or by contacting support at xfield.app. When deletion is completed under our process, we delete or destroy the Google account identifier, name, email, and profile photo from the owner profile. You can also revoke xfield’s access to your Google Account in your Google Account permissions settings.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. xfield uses Google user data only to provide or improve user-facing stadium-owner authentication and account features that are prominent in the Service.
xfield does not use Google APIs or Google user data to create, generate, improve, distribute, or train systems that produce AI-generated non-consensual intimate imagery (AI NCII), deepfakes, or any intimate or sexually explicit imagery of real people.
We do not use Google user data or Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. We do not transfer Google user data to third parties for AI/ML training.
We use WhatsApp OTP to help secure accounts, reduce fraud, and confirm that the person logging in controls the phone number on the account. Message and data rates may apply depending on your plan and carrier.
Never share your OTP with anyone. Our support will never ask you for your OTP.
If GDPR applies to you, our legal bases may include contractual necessity (to provide login, bookings, and payments), legitimate interests (security and fraud prevention), and consent where required (for example device location or push notifications).
We may share information with:
We request location only when a feature needs it (for example finding nearby stadiums on the map), not solely to open the app.
On supported devices we may request precise location so the map can place you accurately. If you grant only approximate location, we use what your device allows.
You can refuse permission and still browse venues and book without sharing your live location.
If you enable notifications, we store a device push token and may send alerts about bookings, matches, payments, or account activity.
Notification content is kept as limited as practical. You can disable notifications in your device or app settings; we remove device tokens when you delete your account or unregister the device.
Map imagery and some location text come from OpenStreetMap and Nominatim. OpenStreetMap data is available under the Open Database License (ODbL). Attribution: © OpenStreetMap contributors. See https://www.openstreetmap.org/copyright.
We use industry-standard measures to protect data in transit, including HTTPS/TLS for our website, API, and app traffic.
No method of transmission or storage is completely secure. Please protect your device, WhatsApp account, and OTP codes.
We retain personal data as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary by data type.
When you delete your account, we remove your name, phone number, saved cards, device notification tokens, and chat messages. Upcoming bookings, including shared bookings, must be cancelled or finished first. Payment records, invoices, refunds, and bookings stay so we can meet tax, refund, and dispute obligations. Those records are no longer tied to your name or phone number.
Depending on your location (for example GDPR or CCPA), you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can delete your account from Settings in the app, or on the web from the delete-account page. For other privacy requests, contact support at xfield.app.
We use essential cookies and local storage (for example language, currency, and theme) to make the site work. See our Cookie Policy.
The Service is not intended for children. If you believe a minor has provided personal data without appropriate consent, contact us.
We may update this Privacy Policy from time to time. Updates are effective when posted on this page. If we change how we use Google user data, we will update this policy and, where required, notify users before using that data in a new way.
Effective date: 2026-05-31 · Last updated: 2026-10-16
This Privacy Policy is for the xfield application and website at https://xfield.app. It explains how xfield (“we”, “us”, “our”) collects, uses, shares, and protects information when you use our website, mobile apps, and related services (the “Service”), including Google user data obtained through Google Sign-In.
xfield is a sports venue booking platform. Payments you make are for booking a real sports facility (and related booking services), not for buying digital goods inside the app.
Contact for privacy requests: support at xfield.app.
Depending on how you use the Service, we may collect:
xfield uses Google Sign-In only for the stadium owner portal. Players who book or join matches sign in with phone number and WhatsApp OTP, not Google.
Our Google OAuth client requests only these scopes: https://www.googleapis.com/auth/userinfo.email (see your primary Google Account email address) and https://www.googleapis.com/auth/userinfo.profile (see your personal info, including any personal info you have made publicly available).
When an approved stadium owner chooses “Continue with Google”, our application will access the Google user data Google returns for those scopes, including: primary email address, email verification status, Google account identifier (sub), name, and profile photo URL. We do not request or access Gmail, Google Drive, Calendar, Contacts, Google Workspace content, or any other Google API scopes.
We will use Google user data only to provide and improve user-facing owner features in the Service: linking a Google account to an existing xfield account, checking that the email is allowed for owner access, signing the owner into the owner dashboard, and displaying the owner’s name and profile photo in the owner portal and related stadium-management screens.
We do not use Google user data for targeted advertising, personalized or interest-based ads, retargeting, selling to data brokers, providing data to information resellers, determining credit-worthiness, lending, creating unrelated databases, or training non-personalized AI/ML models.
We store the Google account identifier, name, email, and profile photo URL in our database as part of the owner account record, linked to the owner’s xfield user id. Session cookies keep the owner signed in while using the Service.
We do not sell Google user data. We do not transfer or disclose Google user data to third parties for purposes other than providing or improving the Service (for example hosting/infrastructure providers that process data solely to operate the Service), or when required by law, or to protect rights, safety, and security.
Security procedures are in place to protect the confidentiality of Google user data. We use HTTPS/TLS encryption to protect Google user data in transit between your device, Google, and our servers, and we restrict access to owner account records to authorized systems and personnel needed to operate the owner portal.
We retain Google-linked owner profile data for the length of time needed to provide owner access and fulfill the purposes in this Privacy Policy, unless a longer period is required or permitted by law.
You may request deletion of your Google-linked data by deleting your xfield account in Settings or on the delete-account page, or by contacting support at xfield.app. When deletion is completed under our process, we delete or destroy the Google account identifier, name, email, and profile photo from the owner profile. You can also revoke xfield’s access to your Google Account in your Google Account permissions settings.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. xfield uses Google user data only to provide or improve user-facing stadium-owner authentication and account features that are prominent in the Service.
xfield does not use Google APIs or Google user data to create, generate, improve, distribute, or train systems that produce AI-generated non-consensual intimate imagery (AI NCII), deepfakes, or any intimate or sexually explicit imagery of real people.
We do not use Google user data or Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. We do not transfer Google user data to third parties for AI/ML training.
We use WhatsApp OTP to help secure accounts, reduce fraud, and confirm that the person logging in controls the phone number on the account. Message and data rates may apply depending on your plan and carrier.
Never share your OTP with anyone. Our support will never ask you for your OTP.
If GDPR applies to you, our legal bases may include contractual necessity (to provide login, bookings, and payments), legitimate interests (security and fraud prevention), and consent where required (for example device location or push notifications).
We may share information with:
We request location only when a feature needs it (for example finding nearby stadiums on the map), not solely to open the app.
On supported devices we may request precise location so the map can place you accurately. If you grant only approximate location, we use what your device allows.
You can refuse permission and still browse venues and book without sharing your live location.
If you enable notifications, we store a device push token and may send alerts about bookings, matches, payments, or account activity.
Notification content is kept as limited as practical. You can disable notifications in your device or app settings; we remove device tokens when you delete your account or unregister the device.
Map imagery and some location text come from OpenStreetMap and Nominatim. OpenStreetMap data is available under the Open Database License (ODbL). Attribution: © OpenStreetMap contributors. See https://www.openstreetmap.org/copyright.
We use industry-standard measures to protect data in transit, including HTTPS/TLS for our website, API, and app traffic.
No method of transmission or storage is completely secure. Please protect your device, WhatsApp account, and OTP codes.
We retain personal data as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary by data type.
When you delete your account, we remove your name, phone number, saved cards, device notification tokens, and chat messages. Upcoming bookings, including shared bookings, must be cancelled or finished first. Payment records, invoices, refunds, and bookings stay so we can meet tax, refund, and dispute obligations. Those records are no longer tied to your name or phone number.
Depending on your location (for example GDPR or CCPA), you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can delete your account from Settings in the app, or on the web from the delete-account page. For other privacy requests, contact support at xfield.app.
We use essential cookies and local storage (for example language, currency, and theme) to make the site work. See our Cookie Policy.
The Service is not intended for children. If you believe a minor has provided personal data without appropriate consent, contact us.
We may update this Privacy Policy from time to time. Updates are effective when posted on this page. If we change how we use Google user data, we will update this policy and, where required, notify users before using that data in a new way.