Last updated: 12 July 2026 · Version: 1.0 · Effective date: 12 July 2026
This Privacy Policy explains how MMA Ward (Private) Limited ("MMA Ward", "we", "us", "our") collects, uses, shares, and protects personal data when you use the MMA Ward mobile application and related services (the "Service"). It forms part of, and should be read with, our Terms of Service.
Data controller: MMA Ward (Private) Limited, Gujranwala, Punjab, Pakistan. Privacy contact: abubaker6192@gmail.com. EU/UK representative / DPO: not appointed — not required at our current scale.
In plain terms: we collect the minimum needed to run an MMA fan game and community — your account basics, what you do in the app, your device's push token, and a coarse (~5 km) area only if you switch on "Near Me". We do not sell your personal data and we do not use it for advertising. You can delete your account and data at any time from inside the app.
This Policy applies to all Users of the Service worldwide. Additional rights for specific regions (EU/EEA/UK, California/USA, and Pakistan) are set out in Section 14. If you do not agree with this Policy, please do not use the Service.
We collect the following categories. We have designed the Service to avoid collecting sensitive data (we do not intentionally collect government IDs, precise GPS coordinates, biometrics, payment-card numbers, health data, or special-category data).
We collect data (a) directly from you (sign-up, profile, Content); (b) automatically through your use of the app and standard mobile SDKs; and (c) from third parties (sign-in providers). We do not buy personal data about you from data brokers.
Where the EU/UK GDPR applies, the "legal basis" for each purpose is shown in brackets: [Contract] = necessary to provide the Service you requested; [Legitimate Interests] = our or others' legitimate interests, balanced against your rights; [Consent] = your opt-in; [Legal Obligation] = required by law.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your Account; authenticate you | Account data, sign-in identifiers | [Contract] |
| Provide gameplay, scoring, duels, Wards, leaderboards, predictions, GOAT, Hot Takes | Usage/gameplay data, User Content | [Contract] |
| Show your profile, avatar, and rankings to other users | Profile data, scores, country | [Contract] |
| Deliver push notifications you opt into | FCM token, preferences | [Consent] (opt-in; withdrawable) |
| "Near Me" nearby-player ranking | Coarse/approximate location (geohash cell or IP-derived area) | [Consent] (only if enabled) |
| Moderate content, enforce rules, handle reports/appeals, prevent cheating, fraud, and abuse | Content, usage data, reports | [Legitimate Interests]; [Legal Obligation] where applicable |
| Diagnose crashes and errors; keep the Service stable and secure | Crash diagnostics (PII-scrubbed) | [Legitimate Interests] |
| Understand product usage to improve features | Analytics events (no email/name/precise location sent) | [Legitimate Interests] or [Consent] where required |
| Communicate service messages (verification codes, security, transactional) | Account/contact data | [Contract] / [Legal Obligation] |
| Comply with law and respond to lawful requests | As required | [Legal Obligation] |
| Operate Premium subscriptions (if/when launched) | Subscription/entitlement status (payment handled by the app store) | [Contract] |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not use it for advertising or ad-targeting.
We share personal data only as described here. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
Your username, display name, avatar, country, career stage, scores/rankings, and your public Content (posts, comments, votes, Ward activity) are visible to other users as part of the social features you use. Do not post anything you want to keep private.
Each provider is bound to use data only to provide services to us, under appropriate data-processing terms.
If you use Google or Apple sign-in, those providers process your authentication per their own privacy policies.
We may disclose data: (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms; (c) to protect the rights, safety, or property of users, the public, or us (e.g. fraud, security, or harm prevention); and (d) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this Policy or notify you of material changes.
We send them no personal data; we only read public fight data from them.
The Service uses standard mobile SDKs, including Firebase Cloud Messaging (push), Sentry (crash reporting), and PostHog (product analytics). These may process device identifiers and technical data. We configure analytics to minimise personal data (no email/name/precise location to PostHog; PII scrubbing on Sentry). We do not use third-party advertising SDKs, ad trackers, or ad IDs. Where your region requires consent for non-essential analytics, we will obtain it.
The Service is operated using infrastructure that stores and processes data in the AWS Asia-Pacific (Tokyo, Japan) region (via our Supabase project) and in other locations used by our providers (e.g. Google/Firebase, Sentry, PostHog). If you are in the EU/EEA/UK and your data is transferred to a country without an "adequacy" decision, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and our providers' transfer mechanisms. You may request more information at abubaker6192@gmail.com.
We keep personal data only as long as needed for the purposes above, then delete or de-identify it: - Account & profile data: retained while your Account is active; erased on deletion (Section 11). - User Content: retained while posted; deletion removes it, subject to Section 11 exceptions (e.g. copies others made, shared-record entries). - Diagnostics/analytics: retained for up to 90 days at the provider level, generally in de-identified or aggregated form. - "Near Me" location cell: overwritten on each refresh and cleared when you disable Near Me or delete your Account. - Records required by law (e.g. for tax, dispute, or safety): retained as long as legally required. - Backups: residual copies in encrypted backups are overwritten on our normal backup-rotation cycle (generally within 30 days).
We use reasonable technical and organisational measures appropriate to the risk, including: encryption in transit (TLS 1.2+); encryption at rest at the database layer; row-level security and least-privilege access policies so users can generally only reach their own data; server-side enforcement of sensitive actions (e.g. scoring); scoped file-storage permissions for avatars; audit logging of administrative actions; and periodic security review. No system is perfectly secure, and we cannot guarantee absolute security; you use the Service at your own risk and are responsible for safeguarding your credentials. If a data breach affects your rights, we will notify you and any regulator as required by law.
You can delete your Account at any time in Settings → Account → Delete Account, or by request at abubaker6192@gmail.com (see also our public deletion page at https://mmaward.app/delete-account). Self-service deletion is immediate (there is no grace period) and cannot be undone: - Your profile, scores, posts, comments, votes, predictions, and other personal data are erased or anonymised. - Records that are shared with other users (for example, a completed duel that also belongs to your opponent's history) are de-identified — your username and profile are removed so the record no longer identifies you — because deleting them would corrupt another user's data. - If you signed in with Google or Apple, that sign-in is unlinked so you may create a brand-new Account later; no prior data is restored. - Anonymised, aggregated statistics (e.g. how many players answered a question correctly) may be retained, as they no longer identify you. - Data may persist briefly in encrypted backups until they rotate out (generally within 30 days).
You can also request access, correction, or deletion by contacting abubaker6192@gmail.com; we will verify your identity and respond within the timeframe required by law (generally within 30 days).
The Service is intended for users 13 and older (or the higher minimum age in your country). We do not knowingly collect personal data from children under 13. If we learn that we have collected data from a child under 13 without required parental consent, we will delete it. If you believe a child under 13 has provided us data, contact abubaker6192@gmail.com and we will act promptly. The app's content rating and store age-gating are set accordingly; parents/guardians should supervise minors' use.
We use Firebase Cloud Messaging to send notifications you opt into (e.g. daily reminders, duel challenges, streak alerts, community and fight-week updates) and service messages required to run your Account (e.g. verification codes). You can disable optional notifications at any time; service messages may continue while you hold an Account.
Depending on where you live, you may have some or all of the following rights. To exercise them, contact abubaker6192@gmail.com; we will verify your request and will not discriminate against you for exercising your rights.
You have the rights to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent at any time (without affecting prior processing). You may also lodge a complaint with your local supervisory authority. Where processing relies on legitimate interests, you may object based on your particular situation.
You have the rights to know/access, delete, and correct your personal information, and to opt out of sale/sharing — though we do not sell or share personal information for cross-context behavioural advertising. We do not use personal information for targeted advertising and do not "sell" it as defined by these laws. You may exercise rights yourself or via an authorised agent, and we will not discriminate against you for doing so.
We handle personal data consistent with applicable local law, including the Prevention of Electronic Crimes Act, 2016 (PECA) and any Personal Data Protection legislation once in force in Pakistan. Where local law grants you rights of access, correction, or deletion, we will honour them.
The Service may reference or link to third-party content or services (e.g. sports sources). We are not responsible for their privacy practices. Review their policies before providing them any data.
We may update this Policy. For material changes we will provide reasonable notice (in-app notice, email, or an updated "Last updated" date) and, where required, obtain your consent. Your continued use after the effective date constitutes acceptance where permitted by law.
Privacy questions or requests: abubaker6192@gmail.com General support: abubaker6192@gmail.com Location: MMA Ward (Private) Limited, Gujranwala, Punjab, Pakistan (full postal address available on lawful request)
If you are in the EU/UK and are unsatisfied with our response, you may contact your local data-protection supervisory authority.
This Policy is written specifically for MMA Ward's real data flows. A final review by a qualified privacy professional is recommended before publication, and this Policy must remain consistent with your Google Play "Data safety" and Apple "App Privacy" declarations.