MITI Privacy Policy

This Privacy Policy applies to the MITI ecosystem, including the main MITI consumer mobile app, MITI administrative mobile apps such as Padel Console, related backend APIs, QR services, push infrastructure, and the MITI website.

MITI uses one shared backend and one shared account system across multiple applications. If you use both a consumer MITI app and an administrative MITI app, your data is processed within the same platform, subject to role-based access controls and scope restrictions.

1. What products and scenarios this policy covers

This policy covers the consumer MITI app, user profiles, the social feed, stories, chats, matches, tournaments, bookings, notifications, QR flows, and supported sports or lifestyle categories inside MITI.

It also covers MITI administrative apps, including Padel Console, used by court owners, staff, top managers, and other authorized roles to manage courts, slots, bookings, invitations, staff access, and administrative activity history.

2. Data we collect

• Account data: email address, username, full name, city, app language, and password in hashed form.
• Phone number: used as a way to sign in. When you register or restore access we send a one-time code by SMS through our messaging provider, Infobip. The code itself is stored only as a short-lived hash, expires within minutes, and the number of attempts is limited. We do not use your phone number for marketing and do not show it to other users unless you send it yourself in a chat.
• Google and Apple sign-in data: if you use them, we receive the account identifier, name, and email address. Apple may issue a relay address instead of your real one, which is sufficient for us.
• Profile data: avatar, bio, public handle, social links, category profiles, achievements, rankings, MMR, profile frames, and gameplay statistics.
• User content: posts, stories, comments, likes, chat messages, uploaded media, and attachments.
• Sports and category data: matches, invitations, tournaments, bookings, clubs, courts, time slots, results, match history, category participation, and status data.
• Fitness data: group trainings you join or organize, attendance marks, and workout diary entries you add yourself: discipline, date, duration and, optionally, distance, sets, weights, repetitions and a note; personal records calculated from your diary. If you choose to train with a coach, also body measurements (weight, body fat percentage and body circumferences) entered by you or your coach, and the plans, goals and workouts your coach writes for you. Your diary and measurements are visible only to you and, while you train with a coach, to that coach: the coach gets access only after you accept their invitation or send a request yourself, and loses it as soon as either of you ends the coaching. Members of a challenge you join see only your total and your place in its leaderboard. If you take part in a club event, your name, result and place appear in the results table on the event page once the club publishes the results. We do not collect heart-rate data, do not read data from Apple Health or other health apps, and do not use fitness or measurement data for advertising.
• Administrative data: assigned roles, access to clubs and courts, staff memberships, booking queues, approval messages, court confirmations, audit history, and operational actions performed in admin tools.
• Technical data: device name, device id, push token, IP address, user-agent, safety logs, QR scan events, and basic crash/error telemetry.

3. App permissions that may be used

• Camera: only if you choose to use the QR scanner or create content that requires camera access.
• Photos and media library: only if you choose media for an avatar, post, story, or other user content.
• Notifications: only if you allow push notifications for messages, invitations, content activity, booking events, and important account or system updates.
• Location: only at the moment you choose to share it — for example when you attach your position to a chat message or look for nearby venues. We do not track location in the background, access can be revoked in system settings, and the rest of the app keeps working.
• Local device storage: for cache, session restore, startup performance, and stable UI behavior.

4. How we use data

• To create and maintain your account, authenticate you, and protect active sessions.
• To show your profile, social features, content, subscriptions, and interactions with other users.
• To run chats, push notifications, QR flows, and deep links to in-app content.
• To manage matches, invitations, tournaments, court bookings, confirmations, clubs, and admin workflows.
• To prevent fraud, abuse, spam, technical failures, and security incidents.
• To support category profiles, achievements, rankings, match history, and user progression.

5. Public data and restricted-access data

Some data is public or semi-public within MITI, such as your avatar, display name, handle, bio, public posts, stories, selected category profile elements, achievements, open matches, and interactions that you choose to create inside the platform.

Administrative access data, staff operations, booking queues, internal responses, audit entries, and operational fields are available only to users with the relevant role and only within the club, court, organization, or scope assigned to them.

6. Push notifications and device tokens

If you allow notifications, MITI may store a device push token and platform metadata to send notifications about messages, match invitations, content activity, reminders, and important account or system events.

Delivery is handled by Google Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification service. They receive a device token and the contents of the notification — for example the sender's name and the beginning of a message — solely in order to deliver it to your device. They act as processors on our instructions and may not use this data for their own purposes.

Notifications are optional: the app works fully without them. You can disable them in your device settings, and each category separately in app settings, including quiet hours. Related tokens are removed or disabled when you log out or delete your account.

Crash reports: if the app crashes or hits an error, it sends a technical report to Google Firebase Crashlytics — the stack trace, device model, operating system and app versions, and the numeric account identifier. Your phone number, email, name and message contents are not included. Reports are used only to find and fix bugs; Google processes them on our behalf.

7. QR codes and scan events

MITI may generate QR codes for user profiles, clubs, courts, and other supported objects. QR resolution is performed through MITI backend services.

When a QR code is scanned, MITI may log the scan event, the scanning user, time, entity type, and scan source so the correct object can be resolved, abuse can be prevented, and security history can be maintained.

8. Administrative apps, role-based access, and audit history

If you use a MITI administrative app or are assigned an administrative role, MITI may process the data necessary to manage courts, time slots, staff, bookings, invitations, confirmations, and related operational workflows.

Administrative actions may be logged, including who performed the action, when it was performed, what club, court, booking, or operational object it related to, and what result was recorded. This is used for security, operational control, and dispute handling.

9. Sharing of data

• With other MITI users only within the profile, content, match, chat, and interaction flows that you choose to use.
• With infrastructure providers that help operate MITI, such as hosting, storage, database, delivery, and push notification providers.
• When required by law or reasonably necessary to protect MITI, users, court owners, clubs, or sports facilities.

10. Where data is processed and how we protect it

MITI's primary server infrastructure is currently located in Dubai, United Arab Emirates. Some third-party service providers, such as push delivery providers or other technical vendors, may process limited technical data in other regions when necessary to operate the service.

MITI uses reasonable technical and organizational safeguards, including access control, session protection, role-based permissions, security logging, and separation of administrative scopes.

11. Data retention

MITI keeps data for as long as necessary to provide the service, comply with legal obligations, protect the platform, and maintain technical history.

Some technical, safety, booking, financial, or anti-abuse records may be retained longer when required for security, fraud prevention, legal compliance, accounting, or dispute handling.

12. Account deletion

You can initiate account deletion directly inside the MITI mobile app without sending an email request. After deletion is initiated, active sessions are revoked, the account is deactivated, and profile data and social links are anonymized or cleared.

If your account is also used in a MITI administrative app, deletion also ends access to your administrative roles and related workflows.

Certain records, including limited safety logs, booking records, tournament records, financial records, chat history context, and minimal technical history, may be retained in a reduced or anonymized form where required for legal, security, accounting, or anti-fraud purposes.

13. Your controls

• Edit your profile and social links.
• Manage posts, stories, comments, likes, and in-app visibility settings.
• Manage available public profile elements where a feature allows it.
• Control device notification permissions.
• Request account deletion from inside the app.

14. Sale of personal data

MITI does not sell or rent your personal data to third parties.

We do not use your data for advertising and do not track you across other apps or websites: we do not collect advertising identifiers and do not embed advertising or tracking networks for that purpose.

Contact