GetMySlot Privacy Policy

Effective 12 October 2026. Last updated 12 October 2026. Drafted from the GetMySlot repository as of 12 October 2026. This page is not legal advice and does not claim Google Play approval.

Who this policy covers

GetMySlot is a mobile application for discovering sports turfs, viewing availability, and booking slots. The Android package name in the project is com.getmyslot.app. The same codebase also includes owner and admin screens for venue onboarding, listings, and operations.

The legal developer or operator name that should appear on the Google Play listing has not been published on this site yet. This policy currently identifies the product as GetMySlot and the Android package com.getmyslot.app.

Privacy questions: getmyslott@gmail.com.

Accounts and authentication

People create an account by verifying an Indian mobile number with a one-time password. There is no email-and-password sign-in, social login, or password in the current app flow.

MSG91 delivers and verifies the OTP. The app then calls a Supabase Edge Function that checks the MSG91 access token.
On success, Supabase Auth stores a user record. The implementation attaches a synthetic email of the form 91XXXXXXXXXX@phone.getmyslot.invalid so a session can be minted. That address is not a mailbox you can write to.
A matching row is created or updated in profiles with the national phone number. Users can later add a full name from onboarding and view name plus phone on Profile.
Session tokens are stored on the device with Expo SecureStore, not AsyncStorage.

Roles are stored in user_roles as user, owner, or admin. After sign-in the app routes players, owners, and admins to different screens.

The live profiles table also has a date_of_birth column. The current app UI does not collect date of birth. Seed scripts may write that column for development users.

Player data

Phone number used to sign in.
Full name, when the user provides it.
Bookings the player creates, including date, times, amounts stored on the booking row, payment_status, and guest name/phone copied from the player profile at booking time.
Approximate device location, only if the player allows location permission. The app uses coordinates on the device to sort nearby turfs. The discovery code does not insert those coordinates into a location table.

Turf-owner and listing data

Owners can apply to list a turf. Applications store owner name, turf name, turf phone, address, map coordinates, rates, and an onboarding payload (hours, court count, and pricing windows). Approved venues store similar listing fields on turfs.

Turf photos are uploaded to Cloudinary. GetMySlot stores the image URL and Cloudinary public ID in turf_photos. Photo library permission is requested so owners or admins can pick those images. The app does not collect player profile photos.

Owner tools also store staff invitations (phone number of the invitee) and venue memberships.

Bookings

Booking rows include turf, date, start and end time, amounts, status, optional playing-area identifiers, booking source, and guest name/phone. Public occupancy views used for player calendars omit guest name, phone, amount, user, and source.

Online card or UPI checkout is not implemented in the current application code. Product documents mention Razorpay; that processor is not present in the app dependencies or source reviewed for this policy.

Device permissions

Location while using the app: find nearby turfs; owner/admin map picking and reverse geocoding of a pin.
Photo library: upload turf listing images.

Camera and microphone permissions are not requested in the current Expo config.

Diagnostics and crash reporting

Sentry is wired in the app root. The configuration enables default PII sending, mobile session replay on 10% of sessions, and replay on every error. Those reports can include information the Sentry SDK attaches in that mode, such as device and session context. This policy does not claim what Sentry retains after a report is sent.

Processors that the app actually uses

Supabase

Authentication, PostgreSQL database, Row Level Security, and Edge Functions. Installed in the project: yes. Used by application code: yes.

The mobile app talks to Supabase Auth and Postgres. Phone OTP is bridged into a Supabase session. Account deletion runs as a JWT-authenticated Edge Function using the service role only on the server.

MSG91

SMS one-time passwords for Indian mobile numbers. Installed in the project: yes. Used by application code: yes.

The app uses the MSG91 OTP widget. An Edge Function verifies the MSG91 access token, then creates or finds a Supabase user. Sign-in is limited in code to Indian numbers matching 91 + a 10-digit mobile starting 6–9. A synthetic email on phone.getmyslot.invalid is stored on the Auth user so Supabase can mint a session.

Cloudinary

Unsigned upload and CDN delivery of turf listing photos. Installed in the project: yes. Used by application code: yes.

Admins (and turf listing flows) upload images with an unsigned preset. Only the resulting URL and public ID are stored in turf_photos. This is not used for player profile photos. Account deletion does not delete Cloudinary assets.

Google Maps (react-native-maps + Expo location geocoding)

Map pins for venue location picking and reverse-geocoded addresses. Installed in the project: yes. Used by application code: yes.

Owner and admin screens use a native map to set turf coordinates. Player GPS is requested on the home screen to sort nearby turfs on the device. Player coordinates are not written to a location table in the code reviewed.

Sentry

Crash reporting and mobile session replay. Installed in the project: yes. Used by application code: yes.

Sentry is initialized in the app root with sendDefaultPii: true, 10% session replay sampling, and 100% replay on error. A DSN is read from EXPO_PUBLIC_SENTRY_DSN. Whether that DSN is set in a given build is an environment fact, not a code fact.

Services named in documents but not used in the current app

Razorpay. Named in product docs as the planned payment processor. No Razorpay package, API call, or payments table usage exists in the current application code. The booking-engine migration states it does not add Razorpay.

AiSensy / WhatsApp. Named in product docs for booking notifications. No AiSensy or WhatsApp integration exists in the current application code.

How data is used

Verified uses in the current product are:

Create and restore a signed-in session.
Show the player's profile and route by role.
List active turfs, photos, maps, and available times.
Create, display, and cancel bookings for players, owners, and admins.
Let owners and admins manage venues, hours, staff, and applications.
Record crashes and sampled session replays in Sentry.

The repository does not describe selling personal data. This policy does not invent advertising, analytics, or marketing uses that are not in the code.

Storage and protection

Application data lives in the configured Supabase project (PostgreSQL, Auth, and Edge Functions). Media files live on Cloudinary. Device session tokens use SecureStore. The repository does not independently certify encryption, certifications, or subprocessors beyond what those vendors publish themselves.

Row Level Security is used on Supabase tables in this project. Account deletion uses a server-side service-role key that is not shipped in the mobile app.

Sharing

Personal data is shared with the processors listed above as needed to run those features. In addition:

Owners and staff of a venue can see guest name and phone on bookings for that venue.
Admins can review owner applications and venue records, which include owner and turf contact details.
Other players see occupied times, not the booker's name or phone, through the occupancy view.

Retention and account deletion

If you still have the app, you can request deletion from Profile. Details, limits, and the web request path are on the Delete account page.

Booking rows are kept so venue occupancy stays accurate. The implementation clears guest_name and guest_phone, then detaches user_id when the column allows it. Amounts, times, turf, and status remain on the row. No maximum retention period is defined in the repository.

Turf listings, photos, coordinates, and related venue records are not cascade-deleted when an account is deleted. Accounts that still own a turf cannot complete in-app deletion.

The deletion function does not send deletion requests to MSG91, Cloudinary, Sentry, Google Maps, or other processors. Whether those vendors retain copies is not verified in this repository.

Staff invitation rows that store a phone number but were not invited_by the deleted user are not removed by the current function. Crash reports and session replays already sent to Sentry are not deleted by this flow.

There is no verified maximum retention period for anonymized booking rows in this repository.

Children

The app does not implement an age gate or a children's mode. This repository does not state a minimum age. If you believe a child has an account, use the contact method on this site once a support email is published, or delete the account from the device if you can sign in.

Your choices

Decline location permission. Nearby sorting will not use GPS.
Decline photo-library permission. Turf photo upload will not work.
View name and phone on the Profile screen.
Sign out on the device.
Delete the account using the in-app control, subject to the limits on the delete-account page.

Self-serve data export, correction beyond editing your name, or regional privacy request workflows are not implemented in the current app.

International processing

Sign-in is implemented for Indian mobile numbers. Hosting regions for Supabase, Cloudinary, Sentry, MSG91, and Google are not recorded in this repository. Those vendors may process data outside India. This policy does not claim a specific transfer mechanism.

Policy updates

When practices in the product change, this page should be updated and the last-updated date changed. Continued use of the app after an update means the updated policy applies going forward. Material changes should be reviewed by the operator before publication.

Contact

Email getmyslott@gmail.com.