Effective date: 10 October 2026
Version: BD-privacy-2026-10-10

Privacy Policy — Bangladesh

Scope and contact

This policy concerns Gridline Soccer Bangladesh (Android package piotr_gorczynski.soccer2.bd), operated by Piotr Górczyński in Poland. It explains how we use personal information to provide the app and its organizer-funded tournament prizes. The Bangladesh edition is for adults aged 18 or older. Contact support@piotr-gorczynski.com about this policy or your information. If you believe a person under 18 is using this edition, please contact us.

Account, authentication and shared profiles

We use Firebase Authentication for email/password, Google, Facebook and anonymous sign-in. Depending on your sign-in method, we process an internal account identifier, email address, nickname and profile information supplied by your sign-in provider, such as a name and profile picture. An anonymous account still has an internal identifier. Authentication information supports sign-in, account recovery and account security.

Global and Bangladesh use the same account and shared profile. We record the app variants used, first and most recent recorded use, and whether use of Bangladesh followed Global. These records describe account usage; they do not establish your physical location or Google Play country. Our app also checks whether the other Gridline Soccer package is installed to enforce the restriction on using both editions on one device.

Gameplay and tournaments

We store friend connections, invitations, online/offline presence, matches, scores, rankings, tournament participation and results in Cloud Firestore and Firebase Realtime Database. These support multiplayer gameplay, invitations, leaderboards and tournament administration. Nicknames and gameplay results are visible to other players through those features. Private payout details are not part of public tournament results.

For prize-tournament registration we record your acceptance of the assigned tournament rules, minimum-age confirmation and confirmation that you have a supported payout account, with timestamps and the relevant requirements. This is a declaration, not an identity-document or location check. Tournament amounts and conditions depend on the assigned rules. Participation does not require an entry fee, stake, wager, deposit, purchase or payment.

Prize recipient information

If you win a prize, we request your first name and last name as separate fields, selected wallet provider (bKash or Rocket) and full mobile wallet number. We use these details to identify the recipient, arrange the prize payment and resolve incorrect, failed or delayed transfers. Your first and last names must match the recipient identity registered with the payout account used to receive your prize. Remitly requires separate recipient first and last names. We do not request your wallet PIN, password or one-time codes; never include them in a support request.

Prizes are funded by the organizer and processed manually and may be sent through Remitly. Submitting details does not initiate an automatic transfer. The administrator supplies necessary recipient and transaction information to Remitly and, as necessary to complete the payment, the receiving mobile-money provider, bKash or Rocket. These providers process information under their own notices and may keep their own transaction records.

Payment evidence and support

We distinguish the recipient details needed to execute a transfer from the limited record needed to document a prize. Payment records contain an internal winner identifier, tournament identifier, amount, currency, payout status, processing dates, transfer provider and transaction reference where recorded. Status changes and administrator actions are recorded for accountability and resolving disputes.

Support requests contain your category, message, replies, app context, timestamps and handling history. Please describe the problem without repeating your full wallet number or recipient names when these have already been submitted in the payout form. Support messages and administrator notes can become part of the handling history.

Player reporting, blocking and moderation

You can block or unblock individual players. We store a per-user block list containing the blocked players’ internal account identifiers (UIDs) and creation timestamps to enforce restrictions on direct invitations and friend additions. Access to your block list is limited to you and authorized administrators.

When you report a player or nickname, the moderation report contains your internal account identifier (reporter UID), the reported player’s internal account identifier (reported UID), a snapshot of the reported nickname, your reason, the app context, handling status and timestamps. We use block lists and moderation reports for abuse prevention, moderation and dispute handling.

Access to a moderation report is limited to its reporter and authorized administrators; reports are not public or made available to the reported player. Authorized administrators review reports. Submitting a report does not automatically ban or punish the reported player.

Notifications, analytics, diagnostics and advertising

Firebase Cloud Messaging uses installation and messaging identifiers to deliver invitations, tournament, prize and support notifications. Payment and support notifications use general status messages rather than your full wallet number or the text of your support conversation.

Google Analytics for Firebase processes usage events, app variant, environment, build/version and app/device information to help us understand navigation, sign-in and tournament use and improve the service. Firebase Crashlytics processes crash reports, device/operating-system information and diagnostic breadcrumbs to help find defects. The payout form does not send the entered names or wallet number as analytics event parameters.

Google AdMob displays advertising and may process device information and advertising identifiers. The app uses Google's User Messaging Platform consent flow where applicable. Advertising, analytics and crash diagnostics are distinct forms of processing; an advertising choice does not necessarily disable crash reporting. Use the app's consent/privacy options where available, Android advertising and notification settings, or contact us about your choices.

Recipients and international processing

We use Google Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Cloud Messaging, Analytics and Crashlytics, and Google AdMob. Google or Meta also processes information when you select its sign-in service. Authorized administrators handle payout and support information. Necessary information may also be disclosed to comply with an applicable legal obligation or handle a legal claim. We do not sell personal information.

The operator is in Poland and provider infrastructure may process information outside Bangladesh. Applicable data-protection requirements govern that processing. A provider's own data collection is not the same as the information requested by our payout form.

Retention: recipient details and limited records

Operational recipient details: we retain the separate first name, last name, full wallet number and selected wallet provider while a payout is active and for up to 180 days after it reaches Completed or Cancelled, subject to the holds described below. Sent means in progress and does not start this period. After that deadline, automatic daily deletion removes the recipient details and keeps only limited payment evidence. Deletion occurs on a successful cleanup run, not necessarily at the exact expiry time.

Limited payment and audit records: the minimized payment record and its handling history are retained for five calendar years from the same terminal-status date, then deleted by the automatic cleanup. This record contains internal winner and tournament identifiers, amount, currency, wallet provider, status, relevant dates and transfer provider/reference where safe to retain. It does not retain recipient first or last names or the full wallet number. Internal identifiers and references remain personal data where they can be linked to a person.

Disputes and legal holds: deletion of both categories may be suspended while a payout support request or dispute is unresolved, or where a legal obligation requires retention. Resolving the request does not override a separate legal hold. Once all holds are released, the original deadlines still apply; overdue information is eligible for the next successful cleanup. Information already deleted cannot be recovered by opening a dispute later.

Older payment history may contain recipient information and is not covered by this automatic deletion process. Support conversations, other account and game records, and backup copies are also outside this payout deletion process. You may contact us to request review and deletion of information that is no longer needed. We do not claim that all associated information is automatically erased.

Account deletion and your rights

Open the account screen and choose Remove Account. This deletes the Firebase Authentication user and removes direct profile and authentication identifiers from the user profile, including email, Facebook identifiers, names and photos, Google or other provider profile data, notification tokens and other profile fields no longer needed. Because the sign-in account is shared, removal affects both editions. Uninstalling an app does not delete the account.

The user document is kept as a minimal deleted-account record under the same internal identifier (UID), with a deletion marker, deletion timestamp and the display name “(Account removed)”. Historical matches, tournament participation, results, rankings and other gameplay records may retain references to this UID so that records remain consistent. We do not replace historical UID references with a new identifier. These records are pseudonymous, not automatically anonymous, because an identifier may still be linked to a person. Screens resolve the deleted profile to the removed-account name rather than its former nickname or provider identity; devices that are offline cannot receive the update until they reconnect.

We deactivate active presence, remove pending invitations involving the deleted account, and remove its active friend relationships in both directions. A minimal offline/deleted marker prevents an old session from recreating presence. Completed or otherwise historical game records are preserved. Cleanup is designed to retry if a processing step temporarily fails; it is not a promise of simultaneous deletion across all services.

Payout recipient details and minimized payment/audit records keep their existing 180-day and five-calendar-year periods from Completed or Cancelled, including unresolved-dispute and legal holds. Account deletion does not reset or accelerate those deadlines. Terms acceptance and tournament-rule acceptance records are retained separately for legal/accountability purposes under their applicable retention policies; they are not automatically assigned the payout five-year period or erased with the sign-in profile. Limited legal/audit records may remain for their defined retention periods and any applicable hold.

Contact support@piotr-gorczynski.com to request review of other remaining data, including support conversations and information no longer needed. We do not interpret account deletion as requiring every historical document containing the UID to be erased. This is not a blanket reason to retain unnecessary profile or recipient information.

Subject to applicable law, you may request access to your information, correction, deletion, portability, or object to or seek restriction of processing, and withdraw consent for processing based on consent. Withdrawal does not undo prior lawful processing. We may need proportionate information to verify a request. Do not send passwords or wallet security codes. You may also raise a concern with the competent data-protection authority where that remedy is available.

Retention of moderation and legal acceptance data

Your per-user block list is kept until you unblock a player or delete your account. On account deletion, we remove your block list, your internal moderation state and references to your account in other users’ block lists.

Open moderation reports are kept until resolved or closed. We then retain them for 180 days from resolution or closure, after which scheduled cleanup deletes the report and its associated history and subcollections. A legal or security hold may postpone deletion. Releasing a hold does not reset the original deadline; overdue reports become eligible for the next successful cleanup. Payout retention periods do not apply to moderation reports.

General Terms acceptance records are preserved as compliance evidence for five calendar years from account deletion. Scheduled cleanup then deletes these records and their subcollections. The acceptance records themselves are not modified to set an expiry date. This does not remove historical internal identifiers from matches, tournaments, rankings or gameplay history, or change the retention of tournament-rule acceptance evidence in participant records.

Security

Authenticated access and database rules restrict payout details to their owner through the app; authorized backend/admin access is used for administration. Other players cannot access your private payout details through the app. No system can guarantee absolute security. We aim to limit access and avoid copying payout information into public results, notifications and diagnostics.

Changes to this policy

This Bangladesh notice has its own version and can be updated independently of the Global notice. It is information about data processing, not a replacement for the Bangladesh Terms of Service or the tournament rules you accept when joining. Material changes will be communicated as required by applicable law.