Privacy Policy

This policy applies to 11auction.com, the related web app and Android app experiences, and support communications controlled by Afsal.tech (“11auction,” “we,” “us,” or “our”). It does not govern a third party's own website, app, authentication, UPI, or sports-data service.

Account and identity data

• Google- or Apple-authenticated name (when supplied), email address, profile image (when supplied), provider, and account creation date;
• Supabase authentication identifiers, session information, and security tokens; and
• feature-access and account-status records.

Gameplay and social data

• room names and codes, manager or team display names, room settings, membership, and administrator status;
• bids, virtual purse balances, player selections, squads, lineups, transfers, interest flags, rankings, and results;
• room visibility choices, private watch tokens, hidden-room choices, and presence or last-seen timestamps; and
• live chat messages and emoji reactions sent to other room participants.

Chat messages and reactions are designed as live Supabase Realtime broadcasts. The 11auction application does not intentionally write their content to its gameplay database; participating clients hold a limited recent message window in memory. Supabase and network infrastructure still process broadcasts to deliver them, and recipients can copy or capture what they receive.

Usage, device, and diagnostics data

• pages and features used, event timestamps, broad tournament family, and pseudonymous room-event data;
• browser, device type, operating system, approximate country, referrer, and network/performance metrics;
• IP address and request metadata processed by hosting, security, authentication, and logging providers; and
• application errors and exception details when optional PostHog error capture is configured.

Support and donation data

If you contact us, we receive the information in your message and attachments. If you voluntarily send a UPI donation, your UPI and banking providers process the payment, and the recipient may receive the payer name, UPI identifier, amount, time, and transaction reference made available with that transfer. Donation information is not used to change gameplay access or outcomes.

• directly from you when you sign in, create or join a room, play, or contact us;
• from Google or Apple when you authorise the corresponding sign-in method;
• automatically from your browser, app, device, and interactions with the service;
• from other room participants or administrators when they invite, remove, or interact with you; and
• from service providers that help authenticate, host, secure, monitor, and deliver the service.

• authenticate users, maintain sessions, and provide account and profile features;
• create, join, administer, watch, synchronise, score, and display fantasy auction rooms;
• deliver live bids, presence, chat, reactions, results, and share features;
• prevent abuse, cheating, unauthorised access, fraud, and service disruption;
• debug incidents, measure reliability and performance, and improve product flows;
• respond to support requests, grievances, privacy requests, and account-deletion requests;
• enforce the Terms of Service and protect users, the operator, and others; and
• comply with legal duties and valid legal process.

Depending on the law that applies, we rely on your consent, performance of our agreement with you, legitimate interests in operating and securing the service, and compliance with legal obligations. Where processing is based on consent, you may withdraw it, but that does not affect earlier lawful processing.

Other users and viewers

Manager or team display names, room details, bids, squads, rankings, results, chat, and reactions are shown to the participants needed for the feature. Public rooms may expose limited room details to signed-in users. Supported watch and results pages may show manager names, squads, and outcomes according to the room's public, private-link, or off setting. Stable authentication IDs and private watch tokens are not intended for spectator payloads.

Service providers

• Supabase for authentication, Postgres data, Realtime, and storage infrastructure;
• Vercel for hosting, delivery, Web Analytics, Speed Insights, logs, and security;
• PostHog, when configured, for product analytics and error capture;
• Google and Apple for OAuth sign-in; and
• sports-data providers for fixtures, squads, statistics, and results; user identity is not intentionally sent to those data providers for ordinary sync.

Other limited disclosures

We may disclose data when reasonably necessary to comply with law or valid process, investigate abuse, protect rights and safety, obtain professional advice, or complete a reorganisation or transfer of the service subject to appropriate safeguards. We do not sell personal data.

Our providers may process data in India, the United States, the European Economic Area, or other locations where they or their subprocessors operate. Those locations may have different data-protection laws. Where required, we and our providers use recognised contractual or legal safeguards for cross-border processing.

We keep data only as long as reasonably needed for the purposes above, including providing active and past room history, maintaining scoring and room integrity, resolving disputes, preventing abuse, and meeting legal obligations. Retention varies by record:

• authentication and account data is generally kept while the account is active;
• room, bid, squad, transfer, and result records may remain after a tournament so room history and results stay coherent;
• live chat and reactions are not intentionally persisted in the gameplay database by the application;
• support and grievance records are kept while the matter is active and for a reasonable follow-up period;
• security, hosting, analytics, and performance data follows operational needs and provider retention settings; and
• backups may retain residual copies for a limited period before they are overwritten.

When an account is deleted, the sign-in account and supported account-linked records are removed or anonymised. Some gameplay records may remain in pseudonymised or de-identified form to preserve the room's integrity, other users' results, security records, or legal compliance. Data already received or captured by another participant cannot be recalled from that person.

Depending on applicable law, you may have rights to:

• ask whether we process your personal data and request access to it;
• ask us to correct incomplete or inaccurate personal data;
• request deletion or restriction of certain data;
• withdraw consent or object to certain processing;
• request a portable copy where the law provides that right;
• nominate another person to exercise applicable rights in the event of death or incapacity; and
• make a complaint to the relevant privacy or data-protection authority.

You can begin account deletion at /account/delete. For another request, email us from the address linked to your account. We may need to verify identity and may retain information where an exception or legal obligation applies.

We use authentication cookies and limited browser storage to keep you signed in, remember interface state, prevent duplicate analytics events, and understand use and performance. See the Cookie Policy for categories and controls.

We use access controls, authenticated requests, row-level security, private service credentials, and other technical and organisational measures designed to protect data. No internet transmission or storage system is completely secure. Protect your Google or Apple account and report suspected account misuse promptly.

The service is intended for users aged 18 or older. We do not knowingly seek personal data from a child using the service without the involvement of a parent or legal guardian. If you believe a child has provided personal data without appropriate permission, contact us so we can review and take suitable action.

We may update this policy when the product, providers, or law changes. The “Last updated” date identifies the current version. We will provide reasonable additional notice for material changes where appropriate.

11auction.com is operated by Afsal.tech. Email privacy questions, rights requests, or grievances to afsal@ringon.ai. For the grievance process and expected response times, see the Legal & safety page.