Privacy policy.

Who we are

SportX (sportx.impetus.network) is a platform for running sports tournaments, clubs and federations, operated by Impetus Network. In this policy, "we" means Impetus Network, the party responsible for processing personal data on SportX.

This policy covers the SportX website, the SportX Zalo Mini App, the mobile apps that share its accounts, and the MCP connector for AI assistants. We process personal data under Vietnam's Decree 13/2023/ND-CP on personal data protection.

Your account and signing in

SportX has no password of its own. You sign in with Impetus ID (id.impetus.network) over OpenID Connect. Impetus ID may in turn let you sign in with Google, Apple or Zalo; SportX never receives the passwords of those accounts.

When you first sign in, Impetus ID sends SportX, and we store:

• your Impetus ID account identifier;
• your display name, email address and whether the email is verified;
• your profile picture (if any);
• the language you chose (Vietnamese or English).

Your account's phone number stays with Impetus ID. SportX does not store it, including when you use the Zalo Mini App.

For each sign-in session we store the session token, its expiry, your IP address and your browser details (user agent), to keep you signed in and to spot unusual sessions.

Referee accounts

An organiser can create a referee account, a username and password that only works for one tournament and one match day. The password is stored as a one-way hash that nobody can read back. The account is only for scoring; the matches, scores and confirmation signatures a referee records belong to the tournament.

Data organisers enter

Most data on SportX is entered by tournament organisers, clubs and federations, not by the athletes themselves. It can include:

• athletes' names, gender, birth year (a federation may store a date of birth), and club or team;
• a phone number, only when an eligibility exception needs one; it is never shown on a public page;
• athlete card photos, tournament covers, logos and club post photos;
• teams, pairs, schedules, courts, scores, results, standings and rating points;
• signatures confirming a match result;
• club member lists, attendance and club fund records.

Organisers are responsible for having the consent of the people concerned before they enter and publish their data (see the Terms of use). If you find your data on SportX without your consent, contact the organiser or us.

Who can see a tournament

A public tournament can be seen by anyone, and appears in the tournament list, the sitemap and search engines. An unlisted tournament can still be opened by anyone who has the link, but SportX never lists it or lets it be found. A club profile can be public or not as well.

On public pages, viewers see athletes' names, clubs, schedules, scores and results. Phone numbers and athlete cards are never shown publicly; only the tournament's managers can see them.

What we use data for

• to run the service: creating tournaments, draws, scheduling, live scoring and showing results;
• to know who you are and which tournaments and clubs you may manage;
• to keep it safe: preventing abuse, rate limiting, investigating incidents;
• to fix bugs and improve the product from error reports and aggregate visit figures;
• to measure advertising, only with your consent (see cookies).

We do not sell your personal data.

AI assistant

The AI assistant is only open to some approved organiser accounts. When you use it, your messages and the tournament data needed to answer (event names, athletes, schedules, results) are sent to an AI model provider for processing. Today those are DeepSeek and Anthropic (Claude). Photos you send to extract a list are sent to an image-reading model provider.

Conversations are stored on SportX so you can come back to them. Inside SportX, the assistant only proposes; a change is only saved once you confirm it.

You can also connect SportX to ChatGPT or Claude over MCP. You grant access on SportX's consent page, and the tournament data the tools read then goes to the AI service you chose, under that service's own policy. You can disconnect in that app at any time.

Service providers we use

We use the following providers to run SportX. They only process data on our instructions:

• Cloudflare: servers (Workers), database (D1), storage for uploaded images (R2), content delivery and attack protection;
• Wasabi: storage for earlier uploads;
• Impetus ID: sign-in and account management;
• Sentry: technical error reports (no session cookies sent and no screen recording);
• Google Analytics: page view statistics, with invite links and other private codes removed from the addresses it sees;
• DeepSeek, Anthropic and an image-reading model provider: the AI assistant (only when you use it);
• Zalo: when you open SportX in the Zalo Mini App.

Some providers run servers outside Vietnam, so your data may be transferred to and stored in other countries.

We only give data to public authorities when the law requires it.

Cookies and browser storage

• sign-in session cookies (required): keep you signed in, including with several accounts at once;
• a language cookie (NEXT_LOCALE, one year): remembers whether you chose Vietnamese or English;
• Google Analytics cookies: count visits, not used to personalise ads;
• Meta Pixel and Google Ads advertising cookies: measure advertising, only set after you consent, and you can withdraw at any time;
• browser storage (localStorage): keeps drafts and referee scores that could not be sent while offline.

You can delete cookies in your browser settings. Deleting the session cookies signs you out.

How long we keep it

Account data is kept until you ask us to delete it. Sessions expire on their own or when you sign out. A referee account only works on its set match day.

Tournament results are a sporting record: we keep them so standings and match history stay correct, until the organiser deletes the tournament or a valid deletion request is made. Error reports and statistics are kept for Sentry's and Google Analytics' default periods.

Children

Athletes may be under 18. Their data is entered by organisers, not registered by the children themselves. For a child, the organiser must have the consent of a parent or guardian before entering and publishing the data, and from age 7 the child's consent as well, as Decree 13/2023/ND-CP requires.

People under 16 should not create an account themselves. A parent or guardian can ask us to correct or delete a child's data.

Your rights

Under Decree 13/2023/ND-CP, you have the right to:

• know what data about you is processed and why;
• see your data and get a copy of it;
• have wrong data corrected;
• have your data deleted, or its processing restricted;
• withdraw consent, for example to advertising cookies; withdrawing does not affect processing that came before;
• object to processing, complain and take legal action as the law provides.

Send a request using the details under Contact. We may need to check that the data is yours. For data an organiser entered, we handle the request together with that organiser.

Security

Every connection uses HTTPS. Sessions are signed, management rights are checked on the server for every action, and phone numbers and athlete cards are never shown on public pages. No system is perfectly secure; if a data breach happens, we will give notice as the law requires.

Changes to this policy

When the policy changes, we update the date at the top of the page. For a significant change, we will announce it on SportX before it takes effect.

Contact

For questions or requests about personal data, contact Impetus Network:

Email: developer@impetus.network. Or message SportX on Zalo (zalo.me/2041249429582106133).