Who sees your details

The Burhani Shield organisers run the Season 2 league in Pune and decide who gets a login and what each role can see. The app is built and looked after by one of them, under the name WhackyDev, which is why its address is cricbid.whackydev.com. Whoever looks after it can reach everything in the database. This page says what the app holds, who can see it, and how to ask for a change.

Player details are for league use only.

What the app holds about players

What you gave on the league's registration form:

Name, age, playing role, batting style and bowling style.
The team you played for in Season 1, if you played.
Your photo and the QR image you uploaded.
Your phone number.

The form never asked for your CricHeroes link. The app holds one anyway: your QR image is sent to a QR reading service to find it, or an organiser types it in when the QR cannot be read. From that link the app also keeps your CricHeroes profile number. Alongside all this it keeps the Google Drive file numbers of your photo and QR image and the row your answers sit on in the form's spreadsheet.

If you sent the form more than once, what the app shows is your latest one. It also keeps your earlier answers for age, playing role, batting style, bowling style and Season 1 team, in your own words, and whether an earlier form gave a CricHeroes profile. Where your latest QR could not be read, the link, profile number and QR image kept are the ones from an earlier form. The app also keeps how many times you sent the form and when the last one came in. Your answers stay in the form's spreadsheet either way.

Beside your registration the app holds which team has retained you before the auction, and last season's figures. Those figures come from the batting, bowling, fielding and MVP boards the organisers export from CricHeroes for the T10, T20 and T30 tournaments, and they cover whoever those boards list, with the name and team CricHeroes recorded. Some registered players have no figures at all. The averages, ranks and most of the milestones beside them are worked out by the app from those boards. A few are not: the organisers' end-of-season awards are written into the app by hand.

Who can see it

Everyone with a login sees your name, age, role, styles, Season 1 team, photo, retained team, last season's figures and any award beside them.
Team owners, co-owners, admins and super admins also see your phone number and a link through to your CricHeroes profile, for every player in the pool. Viewers are shown neither.
Admins are shown the note about your earlier answers.
Your CricHeroes profile number and that note travel with the player list to every signed-in device, so anyone with a login can read them even where the app does not show them.
Logins are made only by the organisers, so nobody can sign themselves up. Apart from this page and the sign-in page, the app opens only after signing in. A login is only as private as the person holding it.

Photos and QR images sit at addresses that are not password protected. Usually they are a web-sized copy that Google makes; where Google has not made one, the file you uploaded is held as it is. The addresses are not published and cannot be listed, but anyone who has an exact address can open that one image. The files you uploaded also stay in the organisers' Google Drive, and the form's spreadsheet links to each of them.

What the app holds about logins

A login is a mobile number with a password, made by the league. Against it sit your name, your role, your team and the time you last signed in.

Each sign-in is recorded as well, and kept after you sign out, so super admins can see on one screen who is signed in, when each login was last used, from which device and town, and every session of the last 30 days. It also shows when one login was used on two devices, or in two towns, at the same time, which can be a sign that it is being shared. Each record holds:

When you used the app: at your sign-in, and after that at most once every two minutes for that session. Opening a page counts, and so does saving something or your browser fetching a page ahead of your tap.
What the browser says about the device: the kind of device, the system version, the browser, and on most Android phones the phone's model code. Chrome, Edge and Samsung Internet answer that question; Safari and Firefox do not.
Where the connection appears to come from: town or city, state and country, worked out from your internet address. It is a guess. On mobile data it is often a nearby big city rather than where you are.

This record holds no internet address and does not say which pages you open. Only super admins can see it. Anything older than 90 days is cleared out, which happens the next time somebody signs in, so in a quiet spell a record can sit a little longer. Signing in itself is handled by Supabase, which does keep your internet address against your signed-in session; the town above is worked out from it.

Cookies

Only the ones the app needs, and nothing more:

Your sign-in, which your browser may hold in more than one piece.
When this device was last used, so a device left untouched for an hour is signed out.
When this device was last recorded, which keeps the record above down to one entry every two minutes.
If the league gave you a temporary password and you chose "Not now", that you set the reminder aside.

There is no advertising and no analytics.

Who else is involved

Nothing about you is sold, and nothing is sent anywhere for advertising. The league does use other companies to run the app: Supabase holds the database and the image copies, Vercel serves the site and works out the town from your internet address, and Google holds the registration form, its spreadsheet and the files you uploaded. When a QR image is read to find a CricHeroes profile, that image is sent to the QR reading service api.qrserver.com. The organiser who looks after the app, under the name WhackyDev, holds the keys to the database and keeps the private recovery copies.

Players under 18

Some registered players are under 18. The form did not ask about a parent's consent, so the app holds no record of one; the league's understanding is that these players registered with their parents' consent. A parent or guardian can ask us to check or correct a child's details, or to take the child out of the app.

How long details are kept

Registration details are kept for as long as the league needs them, with no fixed date. Ask us and we will take your entry out of the app, which removes your name, age, styles, phone number and CricHeroes link, and we will delete your photo and QR image copies as well.

Two things outlive that: the form answers and files in the organisers' Google spreadsheet and Drive, which they delete separately, and any private recovery copy already made, which keeps what it held until the organisers delete it.

Where it is kept

The database and the image copies are with Supabase, on servers in Mumbai. The site runs on Vercel. Your form answers and the files you uploaded stay with Google, in the organisers' spreadsheet and Drive. The organisers also keep private recovery copies of the database, including phone numbers, on their own computer. Those copies are not shared.

Questions, corrections and removal

Message Burhani Shield on Instagram (opens in a new tab) and the organisers will answer. Details are corrected by the league, not inside the app, so tell us what needs to change.

Last updated 23 September 2026.