Privacy Policy — Jawla 2v2
Last updated:
Jawla 2v2 organises casual two-against-two sessions for a group of friends — padel, tennis, baloot, console games and more. It deals rotating teams, records scores, and keeps a history. It shows no adverts, contains no third-party analytics, no crash reporting and no tracking, sells nothing to anyone, and makes no automated decisions about you.
The short version
You can use Jawla 2v2 without an account: everything then stays on your phone and nothing is sent anywhere. An account is only for playing with friends who have the app too — adding them by handle, and seeing the same session and score on everybody’s phone. If you create one, the sessions you are part of are shared with the other people in them, and with nobody else.
Who is responsible
This policy covers the Jawla 2v2 app on the App Store and Google Play. Jawla 2v2 is operated by Mali Fund, which decides what is collected and why — the “controller”, in the language of most privacy laws, and the “developer”, in the language of both stores.
Questions, requests about your data, and complaints go to one address: info@malifund.com. That address reaches the people who run the app.
What is collected, and why
Without an account, nothing below leaves your phone. With an account, it is collected because the app cannot do what you asked of it otherwise — nothing is collected just in case.
| What | Why | Basis |
|---|---|---|
| Email and password | To sign you in, and to let you reset a forgotten password. The password is stored only as a cryptographic hash. | Necessary to provide the service (GDPR Art. 6(1)(b)) |
| Display name and @handle | So the people you play with can find you and recognise you on a team sheet. | Necessary to provide the service |
| Profile photo (optional) | Shown beside your name. The app opens your photo library only at the moment you choose one. | Your consent, withdrawn by removing it (Art. 6(1)(a)) |
| Your list of players | So you can add people to a session without typing their names each time. Your address book is never read. | Necessary to provide the service |
| Sessions, teams and scores | The point of the app: who played, in which round, on which court or table, and every point as it was scored. | Necessary to provide the service |
| Whether you said you were coming | So the organiser knows whether there are enough players. | Necessary to provide the service |
| A notification token per device | To tell you about a session you were added to, and to remind you before it starts. It is not an advertising identifier. | Your consent, withdrawn in your device settings |
Under the Saudi Personal Data Protection Law the same processing rests on the performance of a contract with you, and on your consent for the two rows that name it. None of it is sensitive personal data.
What is never collected
- No location, at any precision. A session carries a court name somebody typed, not a place your phone has been.
- No contacts. Your address book is never read.
- No advertising identifier and no tracking: nothing about you is joined to data from other companies’ apps or sites, which is why the app never shows Apple’s tracking prompt.
- No analytics and no crash reporting. If that ever changes, this policy changes first and names the company.
- No payments and no financial data. The app books no courts and moves no money.
- No microphone, and no health or fitness data. Only the one photo you pick is read.
Who can see it
- Your name, handle and photo are visible to the people you play with, and to anyone who looks you up by your exact handle to add you. There is no directory to browse.
- A session and its scores are visible to the people in that session and to nobody else. There is no public link, no way to browse other people’s sessions, and no feed.
- Your email address is never shown to another player.
Nothing is sold, rented, or handed to anyone for their own purposes.
Who processes it for us
| Who | What they get | Where |
|---|---|---|
| Supabase | The database, sign-in and photo storage — everything in the table above, apart from delivering notifications. | Servers in Mumbai, India |
| Apple | On iPhone, the device token and the text of a notification, to deliver it. | Apple’s infrastructure |
| On Android, the device token and the text of a notification, to deliver it. | Google’s infrastructure |
Where it is kept, and where it goes
A copy lives on your own device, which is why the app keeps working on a court with no signal. With an account, the shared copy is held by Supabase on servers in Mumbai, India.
If you are in Saudi Arabia, that is a transfer outside the Kingdom. It rests on the safeguards in our agreement with Supabase, on being limited to what the service needs, and on an assessment of its risk — the route the PDPL and its data transfer regulations provide. If you are in the EEA or the UK, it relies on the Standard Contractual Clauses in that agreement, with the UK Addendum alongside them.
How long it is kept
- Your account and everything attached to it — until you delete the account. A season of results is the thing the app exists to keep.
- Your notification token — while the app is installed and notifications are on.
- The copy on your device — until you delete the app. That does not delete an account.
- Backups held by our hosting provider are overwritten within 30 days, so a deletion reaches them at the end of that cycle.
Deleting your account
In the app: Friends → the gear → Settings → Delete account, then enter your password. It takes effect immediately and cannot be undone. You can also ask from the account deletion page without installing anything.
Deleting removes your sign-in permanently, strips your name, handle, email and photo, and takes you off everybody’s player list. The matches you played are kept, under a label that names nobody: they are equally the record of the three other people on court. Once your name, handle, email and photo are gone, what remains cannot be attributed to you.
How it is protected
- Everything travels over an encrypted connection, and the shared database is encrypted at rest.
- Passwords are stored as hashes, never as text.
- The database itself refuses to return a row to somebody not entitled to it — enforced below the app, so a bug in the app cannot hand out another group’s sessions.
If a breach puts your data at risk we will notify SDAIA and, where the law requires it, the relevant EEA or UK authority within 72 hours of becoming aware of it, and tell you directly where the risk to you is serious.
Your rights
Wherever you are, you can see and correct your name, handle and photo in Settings; delete your account; withdraw consent for notifications or your photo; ask what is held about you and for a copy in a portable form; object to, or ask us to restrict, a particular use; and complain — to us, and to a regulator, without asking us first.
Write to info@malifund.com. We answer within 30 days and it costs nothing. We will ask you to write from the email address on the account.
In Saudi Arabia, you may complain to the Saudi Data & AI Authority (SDAIA). In the EEA or the UK, to your national supervisory authority — in the UK, the Information Commissioner’s Office. There is no automated decision-making and no profiling in the app.
Children
Jawla 2v2 is not directed at children and accounts are not knowingly created for anyone under 16. If you believe a child has an account, write to us and it will be removed without delay.
Changes
If this policy changes in a way that affects what is collected, who can see it, or who processes it, the date at the top changes and the app says so before the change takes effect. Where the law requires your consent for a change, it will be asked for.
Contact
info@malifund.com — for questions about this policy, to ask what is held about you, or to have an account deleted.