SG BADDYSG Baddy ("we", "us") is a Singapore-based mobile app for hosting and joining badminton games. This policy explains what personal data we collect, why, and the choices you have. We handle personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA).
1. What we collect
- Account details — your display name, email address and password (stored as a secure hash). If you sign in with Google or Apple, we receive your name and email from them instead of a password; we never see your Google or Apple password.
- Badminton profile — the skill level you declare, the region you select, and the anonymous ratings other players give you after games (used only in aggregate — see section 4).
- Game activity — games you host or join, waitlists, join requests, and cancellations.
- Payment records — when you pay for a game, payment is processed by Stripe. We store the transaction outcome (amount, game, paid/refunded status) but never your card or bank details — those go directly to Stripe. Hosts who receive payouts complete Stripe's identity verification with Stripe directly.
- Device push token — if you allow notifications, a token that lets us send them (game reminders, alerts you set up). You can withdraw this anytime in your device settings.
- Support messages — anything you email us.
We do not collect your precise location, contacts, or photos, and we do not use advertising or cross-app tracking of any kind.
2. How we use it
- Run the core service: show you games at your level, process joins and payments, pay hosts, send the notifications you've enabled.
- Keep levels honest: turn anonymous post-game ratings into your aggregate skill index and verified level.
- Keep the community safe: track late cancellations (shown as aggregate "strikes"), prevent abuse, and enforce our Terms.
- Comply with legal obligations, including payment and tax rules.
We do not sell personal data, and we do not use it for third-party advertising.
3. Who we share it with
- Stripe (payment processing and host payouts) — Stripe's privacy policy.
- Supabase (our database and authentication infrastructure) — Supabase's privacy policy.
- Expo (delivery of push notifications) — Expo's privacy policy.
- Authorities, where the law requires it.
These providers process data on our behalf and may store it outside Singapore; we choose providers that protect data to standards comparable with the PDPA.
4. What other players can see
- Your display name, level badge, region and aggregate stats (games played, games hosted, completion rate, average friendliness, recent late cancellations).
- Ratings are anonymous and aggregate-only. No one — including the rated player — can ever see an individual rating or who gave it. This is enforced in our database, not just the app.
- Hosts of games you request to join see your name and level badge.
5. How long we keep it
We keep your data while your account is active. Game and payment records are kept as long as needed for disputes, refunds and legal obligations, then deleted or anonymised.
6. Your rights
Under the PDPA you may ask us to access, correct, or delete your personal data, or withdraw consent (which may mean closing your account). Email kenrickts97@gmail.com and we'll respond within 30 days. Ratings you have received remain in anonymised, aggregated form.
7. Security
Data is encrypted in transit, access is restricted by row-level database security, and payment credentials never touch our servers. No system is perfectly secure, but if a breach affects you we will notify you and the PDPC as the PDPA requires.
8. Children
SG Baddy is not intended for children under 13, and we do not knowingly collect their data.
9. Changes
If this policy changes materially we'll notify you in the app before the change takes effect. The latest version always lives at this page.
10. Contact
Data protection contact: kenrickts97@gmail.com