Privacy policy

Last updated: 7 October 2026

Who runs Krubal

Krubal (operated by Yeng Sok, Phnom Penh, Cambodia). Cambodian law applies.

Contact: email support@camsport.asia or message @Krubal_bot on Telegram.

What we collect

• From Telegram (when you open Krubal inside Telegram): your account id, name, username, language and profile photo, as Telegram hands them to us.
• From Google (if you link a Google account to sign in on a computer): your email and name.
• What you type in yourself: your alias (generated automatically, never chosen), profile fields (Khmer name, position, city, preferred foot, date of birth, needed only to apply the under-18 rule below), and a profile photo.
• Teams, sessions and attendance: which teams you join, the sessions you RSVP to, and payment-status ticks (paid/unpaid) that you or your Team Admin record.
• Team money records: when a Team Admin enters income, expenses and receipt photos for their own team's treasury. Notes a Team Admin writes in their team's own records (a ledger note, who is holding a piece of kit) stay with the team, the same as the records themselves.
• Ratings and match history: match results, your rating, and your playing history.
• Chat messages: in-app direct messages between teammates or accepted friends.
• Messages to the bot: a private message you send the Krubal bot (for example /start, /help, or a reply) is stored so we can act on it. It is kept for 30 days and then removed or stripped of its content. A message posted in a team's Telegram group is never stored with its content, only the fact that one arrived.
• Technical logs: IP address, browser/app type and sign-in times, for security and troubleshooting.

Why we collect it

To run the service (teams, sessions, matches, team treasuries), to send Telegram bot notifications (session reminders, approvals, new messages), to keep the product safe from abuse, and to apply the under-18 protections described below.

Who sees what

Krubal shows only your alias and "Member of Krubal since {month, year}" to anyone who is not a teammate or an accepted friend. Your full card (real name, photo, foot, city, rating) is only visible to teammates and accepted friends, unless you explicitly set your own profile to "public". Players under 18 cannot choose "public".

Team money (income, expenses, balance, receipts) is visible only to that team's Team Admins. Krubal staff never see a team's treasury: not the income, not the expenses, not the balance, not a receipt photo. Staff can see, and set, the contribution amount asked for a single session, a smaller and different thing from the treasury itself, used only to help a team get a session set up. This promise is never weakened.

Guests: if you reply to a session's public share link without a Krubal account, we collect the name and optional contact you type in. That team's organisers (its Team Admins) and Krubal staff helping run that session can see it. To ask for it to be removed, use the contact details at the top of this page.

Direct messages between teammates or friends: staff do not read these messages, unless you or the person you're messaging reports that conversation. Messages to the bot or the support email are different: Krubal staff read messages sent to the bot or to the support email so they can help. The text of a support conversation is removed after 90 days with no reply.

Payments

Krubal never holds, moves or processes any payment. Money goes straight to the team's or facility's own KHQR. Krubal only records that a player said "I sent it" and an organiser said "I have it".

Processors and hosting

Our servers run on Hetzner (Germany). Telegram operates the Mini App and bot. Google operates sign-in, if you choose to link it. We run no ads, never sell your data, and use no third-party analytics (e.g. no Google Analytics). When you open a map (for example "Find a pitch"), the map images come from OpenStreetMap. Like any image loaded from the web, OpenStreetMap receives your IP address and which map area you are viewing. We send them nothing else.

Retention

• Chat message bodies are redacted after 90 days of silence on a conversation (who sent it and when stays; the words are removed).
• Private messages to the bot are kept for 30 days and then removed or stripped of their content.
• Our technical audit log records that an account setting changed and roughly when, for security and troubleshooting. It never stores the name, email address, IP address or message text involved.
• Backups are deleted automatically within 16 days. The database is backed up every night and before every update of Krubal; uploaded files (avatars, crests, receipts) are backed up once a week, with the day's new files added each night. If you delete your account, copies of your data may remain in backups until they are deleted.
• What happens when you delete your account is described below under "Account deletion".

Children

The minimum age to use Krubal is 13 (Telegram's own minimum to use it directly). Players under 18 cannot make their profile public, and chat between an adult and a minor is blocked by default (the "minors policy").

Account deletion

You can ask us to delete your account at any time from Delete account, or from Me → Privacy & account in the app. We complete every request within 30 days, and you can cancel it at any time before then. Deleting your account deactivates it, clears your name, Khmer name, photo, date of birth and other profile details, and replaces them with "Deleted player". Messages you sent are removed too. Match results, session attendance and team treasury records stay where they are, because other people's balances and playing history depend on them, but they show "Deleted player" instead of your name.

Your rights

You can ask to see your data, correct it, or delete your account. Edit your own profile from Me → Edit profile in the app. Ask for deletion from Delete account or Me → Privacy & account in the app.

Changes to this policy

We update the date above whenever something material changes.