Privacy Policy

In short

• We collect only what booking cannot work without.
• We do not sell data and do not hand it to ad networks.
• We do not store bank card details — payments do not go through us.
• Your account and all related data are deleted on request.

1. Who processes the data

The operator is the Stadion.tj site administration. Contacts for personal data questions are on the “Company details” page.

2. What we collect

Only what a specific feature needs:

• Sign-up: email and name are required; the password is stored as an irreversible hash. When signing in with Google — the Google account id and profile picture.
• Profile: phone and photo are optional. The phone lets the venue owner reach you about a booking.
• Deposit refund: a phone or wallet number and a bank name — you enter these yourself so the owner knows where to send the money back. These are not card details and cannot be charged.
• Booking: the chosen venue, date and hours, deposit amount, booking status, transfer screenshot.
• Communication: chat messages with the owner and support, complaint text.
• Notifications: your interface language and notification settings; the app push token and Telegram chat id — only if you connected those channels yourself.
• Technical: the address you reach the site from and service records of sign-ins — to protect the account from password guessing.

We do not collect health data, background location or phone contacts, and we do not read the contents of your device.

3. Why we do it

• To create and run your booking and show it to the venue owner.
• To let you sign in and recover your password.
• To send notifications about bookings, games and messages — through the channels you enabled.
• To handle complaints and disputes between a player and an owner.
• To protect the service from abuse: lockout after repeated failed sign-ins, fighting fake bookings.

4. Who we share it with

The venue owner — only for your booking and only what is needed to meet: name, phone, the chosen hours and the payment screenshot. The owner sees neither your email nor your other bookings.

Providers the service cannot run without, in the minimum necessary scope. The full list with the purpose of each is on the “Cookie Policy” page.

Government authorities — only on a lawful request.

We do not sell or rent personal data and do not pass it to ad networks or data brokers.

5. How long we keep it

• Account data — for as long as the account exists.
• Booking and review history — for as long as the account exists: it is needed for settlements with venues and for resolving disputes.
• Payment screenshots — available only to you, the venue owner and the administration; they sit in private storage that cannot be reached by a direct link.
• Read notifications are deleted automatically after 60 days.

6. Your rights

You can view and change your data in the profile, turn off any notification channel, delete your photo, and request full account deletion — write to support from the address the account is registered to.

After deletion some records may remain in anonymised form in accounting and statistical reports — without your name or contacts.

7. Security

• The site runs over HTTPS.
• Passwords are stored hashed — even we cannot recover the original password.
• Sign-in tokens live in protected cookies that JavaScript cannot read; state-changing requests are additionally protected by a CSRF token.
• After several failed sign-in attempts the account is temporarily locked.

8. Children

The service is not intended for unsupervised use by children under 14. If you are younger — book together with your parents.