Privacy Policy

Last updated: July 30, 2026

This Privacy Policy describes how Athlits, operated by Orayzen ("Athlits", "we", "us", or "our"), handles personal data when you use the Athlits sports court booking app for Android and iOS (app id: com.orayzen.athlits). Athlits lets players discover venues and book courts, and lets venue managers manage courts, calendars, photos, payments, teams, and bookings.

For privacy questions or requests, contact athlits@orayzen.tech.

What Athlits does

Athlits is an account-based mobile marketplace for sports venues in Lebanon. Players can discover venues and request court bookings. Venue managers and authorized team members can manage venue listings, courts, availability, bookings, teams, and related operations.

Information we collect

We collect information needed to run the booking marketplace, secure accounts, support venue operations, process supported payment flows, and improve the app's reliability. Because Athlits is account-based, these categories may be linked to your account, user ID, or device identifier.

Account, profile, and preference information

• Name, email address, phone number, user ID, account role, language, gender, date of birth, country, sports interests, profile picture, and account or app preferences.
• We use this information for authentication, profile management, personalization, support, account security and deletion, and to route users to player or venue-manager features.

Information we do not collect or use

• Athlits does not request access to your contacts or address book, microphone, call history, or text messages.
• Athlits does not collect background location or use the advertising identifier for advertising, attribution, or cross-app tracking.
• Athlits does not store full card numbers, CVC codes, or payment passwords on Athlits servers. The current Whish transfer flow is completed by you in the external Whish app.
• Athlits does not use personal data to train generative AI models.

Location

• Approximate or precise device location when you grant permission, saved location preferences, and location provided during signup or profile setup.
• Location access is optional, used while the app is in use, and supports nearby venue discovery and relevant search results. Athlits does not use background location tracking.

Bookings and venue activity

• Selected venue, court, sport, booking date and time, status, cancellation status, price, currency, payment method and status, booking reference, recurrence settings, and booking notes where supported.
• Venue managers and authorized venue team members receive the booking details needed to provide the court, confirm attendance or payment, handle cancellations and support, manage venue-local restrictions, prevent conflicts, and operate the venue.

Payments and financial information

• Booking price, currency, selected payment method, payment status, venue Whish number where provided, transfer instructions, venue-confirmed payments, refunds, finance and payout context, and masked bank or payment-account details where shown.
• We use this information for manual Whish transfers, pay-at-venue and venue-confirmed payment flows, booking support, fraud prevention, reconciliation, partner finance, and disputes.
• Athlits does not keep full card numbers, CVC codes, or payment passwords on its servers or in logs, analytics, or crash reports.

Venue and partner information

• Venue profiles, courts, opening hours, availability, facilities, pricing, cancellation rules, team-member information, contracts, finance and payout context, and masked bank or payment-account details where shown.
• We use this information to operate venue listings, calendars, partner access, bookings, payments, finance views, promotions, announcements, reviews, player restrictions, and support.

Discovery, favorites, reviews, and promotions

We process search text and filters, venue and area browsing activity, saved venues or favorites, review ratings and text, promotion codes, discounts, and related timestamps or status values. This supports search results, saved venues, booking-verified reviews, eligible offers, venue trust, and discovery improvements. Venue managers may see reviews, ratings, promotion performance, and aggregated venue activity needed to operate their venue.

Photos and camera

We process profile, venue, and court photos that you choose to upload or capture. Uploading is optional. Photos are used to display profiles and venue or court listings, as applicable.

Device identifiers, notifications, and configuration

We process Firebase Cloud Messaging push tokens, Firebase installation IDs, device or app-instance identifiers, notification permission status, notification interactions, and remote configuration values. We use them to register devices, deliver and route service notifications, show update prompts, and manage operational app configuration.

Analytics, diagnostics, and crash data

We process product-interaction events, crash reports, performance data, request diagnostics, device and app metadata, and redacted error context. We use this information to understand feature usage, debug crashes, monitor reliability, improve performance, and protect the service.

We redact sensitive values before telemetry reaches analytics, logs, or Firebase Crashlytics. We do not intentionally send passwords, bearer tokens, one-time passwords, full phone numbers, full card numbers, CVC codes, full bank-account numbers, or precise raw coordinates in telemetry.

How we use information

• Create, secure, personalize, support, and manage Athlits accounts.
• Show venues, courts, availability, prices, and booking status.
• Create, confirm, change, cancel, display, and support bookings.
• Support venue, team, payment, finance, review, and promotion tools.
• Send booking, account, reminder, and operational notifications.
• Prevent misuse, diagnose problems, and improve reliability.

Cookies and similar technologies

The Athlits mobile app does not use browser cookies for its core operation. It uses app-instance, installation, session, and push identifiers for authentication, security, notifications, analytics, diagnostics, and configuration as described in this policy. External websites or apps that you choose to open may use cookies or similar technologies under their own policies.

How we share information

We do not sell personal data. We share information only as needed to operate Athlits, provide services you request, comply with law, enforce our Terms of Service, or protect Athlits, users, venues, or the public.

• Venues: venue managers and authorized team members receive booking and user information needed to provide and support the booked service and operate the venue.
• Service providers: providers processing data on our behalf include Firebase Analytics, Firebase Crashlytics, Firebase Messaging, Firebase Remote Config, Firebase App Installations, hosting and storage providers, OpenStreetMap tile services, device mapping and geocoding services, and email or support tools.
• Apps you select: email, WhatsApp, browsers, maps, or payment apps you choose to open handle information under their own terms and privacy policies.
• Legal disclosures: we may disclose information when required by law or reasonably necessary to protect rights, safety, security, users, venues, or the public.

The main service-provider privacy information is available from Google at policies.google.com/privacy and the OpenStreetMap Foundation at osmfoundation.org/wiki/Privacy_Policy. Whish, WhatsApp, email, map, browser, and other apps you deliberately open are independent services and apply their own terms and privacy policies.

No advertising, sale, or cross-company tracking

Athlits does not show third-party advertising, sell personal data, or use your activity to track you across other companies' apps or websites.

Security

We use HTTPS for data in transit, secure storage for session tokens, role-aware access controls, telemetry redaction, and privacy safeguards for sensitive authentication, profile, booking, and payment-method flows. No security measure can guarantee absolute protection.

Data retention

• Account and profile data is kept while the account is active. After an approved deletion takes effect, it is deleted or de-identified unless a limited record must be retained for a reason below.
• Booking, payment-status, finance, payout, contract, fraud-prevention, and dispute records are kept for the period needed to complete the service and meet applicable accounting, contractual, legal, security, and dispute-resolution requirements.
• Photos, reviews, venue content, support material, and other content are kept while needed for the account or venue feature, then removed or de-identified unless another valid retention reason applies.
• Session credentials and push registrations are removed, invalidated, or allowed to expire when you sign out, delete the account, remove the device, or when they are no longer operationally valid.
• Analytics, crash, performance, security, and diagnostic records are kept only for configured periods needed to measure, secure, debug, and improve Athlits, then deleted or de-identified.
• Local app caches are cleared on sign-out, account changes, or deletion flows where applicable.

Your rights and choices

• You can deny or revoke location, camera, photo, and notification permissions through device settings, though this may limit related features.
• You can edit supported profile fields in the app.
• Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent where processing relies on consent.
• Athlits does not sell personal data or share it for cross-context behavioral advertising. There is therefore no sale or targeted advertising opt-out to exercise for the current app.
• To request account deletion in the app, go to Profile > Delete account. You may also follow our web account-deletion instructions at athlits.app/delete-account. Account data is deleted or de-identified subject to the limited retention described above.

Email athlits@orayzen.tech to exercise a privacy right or ask a question. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law. Where applicable, you may also complain to your local data-protection authority.

International processing

Athlits and its service providers may process information in Lebanon and in other countries where they operate. Those countries may have different data-protection rules. Where applicable law requires it, we use an appropriate legal mechanism or safeguard for the transfer.

Children

Athlits is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data, contact athlits@orayzen.tech so we can review and delete it as appropriate.

Changes to this policy

We may update this policy. The "Last updated" date identifies the latest revision, and material changes may be communicated through the app or by email.

Contact us

Athlits is operated by Orayzen. Privacy inquiries: athlits@orayzen.tech.