Privacy Policy
Version 2026-10-26 · Effective 26 October 2026
This policy explains what personal data Vukron collects, why, who we share it with, how long we keep it and the rights you have. It applies to the Vukron app, website and admin services.
1. Who is responsible
Vukron ("we") is run by Ayesh Abu Al Haj in Amman, Jordan, who is the controller of your personal data.
- Privacy questions and requests: support@vukron.com
- Vukron is offered only in Jordan for now, so we have not appointed a data protection officer or a representative in the EU or the UK. If that changes, we will name them here.
Venue Partners who receive your booking details use them to run your booking. For their own uses beyond that (for example their own marketing lists) they are separate controllers and their own privacy notices apply.
2. Your consent and your choices
When you create an account we ask you to:
- agree to the Terms of Use, and
- agree to Vukron collecting and using your data as this policy describes.
Both boxes start unticked, and we record which version you accepted and when. Optional uses, such as news and offers by email, have their own separate switch, off by default, which you can change at any time in Me › Settings › Privacy and data. Your device asks separately before Vukron can use your precise location, camera or notifications, and you can turn these off in your phone's settings.
If we change this policy in a way that matters, we will show you the new version and ask you to accept it before you continue.
3. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | name, email, phone (optional), password (stored only as a secure hash), country, time zone, date of birth, gender, interests, profile photo | you |
| Bookings and games | what you booked, where and when, who you played with, shares paid, check-ins, cancellations, no-shows | you, other players, venues |
| Payments and wallet | during the pilot: nothing, because you pay venues in cash and Vukron takes no money. If we add payments in the app: amounts, top-ups, refunds, withdrawals and subscription status; card details would go straight to the payment provider and we would never see full card numbers | you, a payment provider (none at present) |
| Ratings and conduct | skill level and rank per activity, ratings from co-players, reviews you write, strikes, reports about you and their outcome | you, other users, venues, our team |
| Family | family members you add and the family wallet | you (parent or guardian) |
| Messages | chat messages in a booking, notes to venues | you, other players |
| Device and app | app version, operating system, push notification token, crash and error reports | your device |
| Location | approximate country from your IP address when you sign up and book, looked up on our own servers; your precise location only if you allow it, to show nearby venues and distances | your device, our servers |
| Parent or guardian | for players under 18: the email of the parent or guardian who agreed to the account, and when | you |
| Support | what you tell us when you contact us, our notes on your case | you, our team |
We do not collect special categories of data (such as health data) on purpose. Please do not put them in reviews or messages.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR; similar bases apply elsewhere) |
|---|---|
| Creating and running your account; bookings, games, payments, refunds, memberships, Premium | performing our contract with you |
| Date of birth and gender: who may sign up, telling parents about children's visits, women-only times at venues, and age and rank groups | performing our contract with you |
| Telling a parent or guardian that a player under 18 has an account | legal obligation, and our legitimate interest in children's safety |
| Checking that a person, not a program, is signing up | our legitimate interest in stopping fake accounts |
| Sharing booking details with the venue you booked | performing our contract with you |
| Checking you are allowed to book in your country; preventing fraud and fake accounts; keeping Vukron secure | our legitimate interests, and legal obligations |
| Strikes and restrictions after no-shows; handling conduct reports | our legitimate interest in fair games for everyone (you can always ask a person to review) |
| Ranks, skill matching and public game eligibility | performing our contract with you |
| Notifications about your bookings and account | performing our contract with you |
| News and offers | your consent, which you can withdraw at any time |
| Crash reports to fix the app | our legitimate interest in a working app |
| Keeping financial and tax records | legal obligation |
| Dealing with legal claims | our legitimate interests |
Where we rely on legitimate interests you can object (section 8).
Automated decisions. No-show strikes and the booking restrictions that follow are applied automatically by the fixed rules in the Terms of Use. You can ask for a person to review any strike, and we will tell you the outcome.
5. Who we share it with
- Venues you book with: your name, booking details, check-in status, payment status for that booking, and any message you send them. Venue staff with access to the venue's account can see this.
- Other players in a game you join: your name, profile photo, rank in that activity, and whether you have paid your share. Your profile, which only signed-in users can see, shows your name, photo and ranks. If you are under 18, other users see only your first name, the initial of your family name and your ranks: no photo, no reviews about you and no game history.
- Service providers who process data for us under contract:
- hosting, databases, photo storage and error logs: Microsoft Azure (App Service, Azure Database for PostgreSQL, Blob Storage and Azure Monitor), UAE North region (Dubai, United Arab Emirates)
- payments: none at present. During the pilot you pay venues directly, in cash; if we add online payments we will name the provider here and ask you to accept the updated policy first
- email delivery: Microsoft Azure Communication Services
- push notifications: Apple Push Notification service and Google Firebase Cloud Messaging
- WhatsApp reminders, only if you turn them on in your profile: WhatsApp, run by Meta Platforms (receives your phone number and the reminder text). The setting appears only when the service is available
- the check that you are a person when you sign up on the website: Cloudflare Turnstile (receives your IP address and details of your browser)
- maps: OpenStreetMap, with map images served by OpenStreetMap France (receives the map area you are looking at and your IP address); address search uses your device's own geocoding service (Apple, Google or Microsoft, depending on your device)
- naming the country you are in from your location, when your device can't: OpenStreetMap's Nominatim service (receives your location rounded to about 1 km, never your name)
- weather for outdoor venues: the Norwegian Meteorological Institute, MET Norway (receives the venue's location, not yours)
Your country is worked out from your IP address on our own servers, using DB-IP's database; your IP address is not sent to anyone for this.
- Authorities, where the law requires it, or to protect someone's safety.
- A buyer or successor, if Vukron is sold or merged, who must keep this policy.
We do not sell your personal data and we do not share it for cross-context behavioural advertising. Vukron shows no third-party advertising and uses no advertising trackers.
6. International transfers
Your data may be processed outside your country, including in the United Arab Emirates, where our servers are. Where the law requires it, we use safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum), or transfer only to countries recognised as protecting personal data adequately. Ask us for a copy at support@vukron.com.
7. How long we keep it
- Account data: while your account is open. When you delete your account we remove or anonymise your personal details, including your coach profile, the text of messages you wrote in booking chats and your authenticator settings. We keep only what has a lasting purpose, in a form no longer linked to your name, such as anonymised game results so other players' rankings stay correct.
- Financial records (payments, refunds, withdrawals, fees): kept for as long as Vukron operates, which is at least as long as tax and accounting law requires.
- Read notifications: 90 days. Unread notifications are kept until read or until your account is deleted.
- Crash and error reports: 90 days.
- Strikes: 180 days from when they were given.
- Audit records of admin actions: kept for as long as Vukron operates.
8. Your rights
Wherever you live, you can:
- see and download your data: Me › Settings › Download my data gives you a complete copy in a common machine-readable format;
- correct it in your profile, or ask us;
- delete your account and data: Me › Settings › Delete account (some records are kept as section 7 explains);
- withdraw consent for optional uses at any time, without affecting what was done before;
- object to uses based on legitimate interests, and restrict our use while a complaint is looked at;
- take your data elsewhere (portability);
- not be discriminated against for using these rights.
Send other requests to support@vukron.com. We will answer within one month (45 days in California), and may ask you to confirm your identity.
Complaints. You can complain to your data protection authority, for example the authority in the EU or EEA country where you live, the UK Information Commissioner's Office, Brazil's ANPD, or Jordan's Personal Data Protection Council. We would like the chance to fix it first.
California residents (CCPA/CPRA): we collect the categories in section 3 for the purposes in section 4 and share them only as in section 5. We do not sell or share personal information, and do not use sensitive personal information to infer characteristics about you. You may use an authorised agent to make requests.
9. Children
- You must be at least 13 to have your own Vukron account. Younger children can only take part when a parent or guardian adds them to their Family account; the parent consents on their behalf and can see and manage their data.
- If you are under 18, a parent or guardian must agree to your account. When you sign up we ask for their email address and for you to confirm they agree, and we write to them straight away to explain what Vukron is, what we hold and how to have the account closed. We keep their email address with your account.
- Business accounts, coaching and working at a venue are for adults (18 or over) only.
- We protect under-18s' profiles as section 5 explains, and other players cannot find them by name in search. A date of birth that would move an account across 18 can only be changed by our support team.
- When a child is admitted at a venue, Vukron records it and tells the parent or guardian on the Family account.
- If you believe a child has given us data without the agreement required, write to support@vukron.com and we will delete it.
10. Security
We protect data with encryption in transit, hashed passwords, access limited to people who need it, two-factor sign-in for our administrators, and an audit log of administrative actions. No system is perfectly secure; if a breach puts you at risk we will tell you and the authorities as the law requires.
11. Cookies
Vukron uses no advertising or analytics cookies and no trackers, in the app or on the website. The website uses only what it needs to work: a cookie that keeps you signed in, one that protects forms from being sent on your behalf by another site, one that remembers which of your businesses you are managing, and your choice of light or dark theme, kept in your browser. The Cookie Policy lists each one and how long it lasts.
12. Changes
We will post any update here with a new version date. If a change materially affects how we use your data, we will ask you to accept the new version in the app.