Privacy Policy
WORLD X10 is a network for archers. This policy explains, in plain language, exactly what we collect, why, where it is stored, who else touches it, how long we keep it, and how you delete it. It applies to the WORLD X10 mobile applications, the website at worldx10.com and app.worldx10.com, and the WORLD X10 application programming interfaces.
1. Who we are
WORLD X10 is operated by Show Information Systems (SHOW SOFTWARE), a company established in Ajman, United Arab Emirates ("we", "us", "WORLD X10"). We are the controller of the personal data described in this policy: we decide what is collected and why.
For anything relating to your personal data — questions, requests, complaints — write to privacy@uaex10.com. This mailbox is monitored for data protection requests and is the address referenced throughout this policy.
2. Data we collect
We collect only what the product actually stores. The table below is the complete list.
| Category | What exactly | Required? | Why |
|---|---|---|---|
| Account identity | Mobile phone number (in international format), username, display name, account type (player, coach, scout, club, fan), date of birth, interface language. | Required to create an account | To create and secure your account, to sign you in, and to determine whether you are a minor. |
| Email address | Your email address. | Optional | Account recovery and service notices where you choose to provide it. |
| Verification codes | The phone number a one-time code was sent to, the code, its expiry, and the number of attempts. | Required to sign in | Sign-in and phone verification. WORLD X10 has no passwords for athletes: a one-time code sent to your phone is how we confirm it is you. |
| Profile | Profile photo, biography, sport, discipline attributes and personal-best metrics, city, country, current club, height and weight where you enter them, verification level. | Optional | To build your athlete card and let clubs, coaches and scouts find you according to your privacy settings. |
| Archery activity | Rounds you record (name, date, bow type, round type, distance, target face size, total score, X count, handicap, status) and each arrow within them (end number, position in the end, score, tag, and the arrow's plotted coordinates on the target face). | Optional | This is the core of the product: your scoring history, your handicap, your progress, and the leaderboard. |
| Content you publish | Posts (caption, media, tags), stories, highlights, comments, likes, achievements, follows, and club endorsements. | Optional | To operate the social feed, your profile and the discovery features. |
| Direct messages | Messages you send and receive inside the app, and who they are between. | Optional | To deliver your conversations. We do not use the content of your private messages for advertising or profiling. |
| Safety and moderation | Reports you submit (target, reason, your description), and the blocks, mutes, restrictions and hidden-word lists you configure. | Optional | To keep the network safe and to act on abuse, particularly where minors are involved. |
| Device and notifications | Push notification token and platform (iOS or Android). | Optional | To send the notifications you have enabled. Disabling notifications stops this. |
| Sign-in security log | Date and time of each successful sign-in, a device label, and the IP address the sign-in came from. | Automatic | So you can see who signed in to your account, and so we can detect account takeover. Your last sign-ins are visible to you in the app. |
| Server logs | Standard web server records: IP address, date and time, requested address, response code, browser or app identifier. | Automatic | Security, abuse prevention, rate limiting, and diagnosing faults. |
| Subscriptions | Which plan is active for you or for your club, its source and its expiry. | Where applicable | To unlock paid features for clubs and scouts. Subscriptions are sold outside the apps by invoice. |
| Identity verification documents | Where you request a verified badge, the identity document image you upload and the record of its review. | Optional | Only to verify that you are who you say you are, and only where you ask for verification. The document is visible to our review staff only, is never shown to other users, and is deleted when your account is deleted. |
We do not require a WORLD X10 account to read public pages such as the public leaderboard, public club pages and public athlete cards.
3. Data we do not collect
Stating this plainly is part of the policy, and it is enforced by the product, not only by intent:
- No device location. We never request or read your device's GPS or precise location. Your city and country are text you type into your profile, and you may leave them empty.
- No advertising identifiers and no advertising networks. There is no advertising in WORLD X10.
- No third-party analytics or tracking software development kits. We do not embed Google Analytics, Meta Pixel, or comparable trackers.
- No access to your contacts, calendar, call logs, SMS inbox, browsing history, microphone or health sensors.
- No payment card data. Subscriptions are invoiced outside the apps; we never see or store card numbers.
- No biometric data and no facial recognition.
- We never sell your personal data, and we never rent, trade or otherwise transfer it to data brokers.
4. How we use your data
- To run your account: create it, sign you in by one-time code, let you change your username or phone number, and show you your own sign-in history.
- To provide the product: record your rounds, calculate your handicap, build your athlete card, run the leaderboard, deliver the feed, stories, follows, comments and direct messages.
- To keep people safe: apply your privacy settings, act on reports, block abuse, enforce rate limits, and protect minors.
- To communicate with you: send verification codes and the notifications you have enabled, and answer you when you write to us.
- To meet legal obligations and to establish, exercise or defend legal claims.
We do not use your data to build advertising profiles, and we do not take automated decisions that produce legal effects concerning you.
5. Legal bases
Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we rely on your consent and on the other permitted bases in that law, including performance of a contract with you and our legitimate interests in security and abuse prevention.
Where the European Union General Data Protection Regulation applies to you, our legal bases are:
| Purpose | Legal basis |
|---|---|
| Creating and operating your account; delivering the features you use | Performance of a contract — Article 6(1)(b) |
| Security, sign-in logging, rate limiting, abuse prevention, moderation | Legitimate interests — Article 6(1)(f) |
| Push notifications; optional profile fields; publishing content publicly | Consent — Article 6(1)(a), withdrawable at any time |
| Identity verification documents you choose to upload | Consent — Article 6(1)(a), and Article 9(2)(a) where the document reveals a special category of data |
| Responding to lawful requests and defending claims | Legal obligation and legitimate interests — Articles 6(1)(c) and 6(1)(f) |
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
6. What is public
WORLD X10 is a social network, so some information is visible to others by design. You control most of it.
- Public by default for adult accounts: your username, display name, profile photo, biography, sport and discipline details, city and country if you entered them, your club, your achievements, your verification badge, your published posts and stories, and your position on the leaderboard.
- Never public: your phone number, your email address, your date of birth, your direct messages, your sign-in history, your reports and blocks, and any identity document you upload.
- Your controls: you may switch your account to private at any time, in which case following you becomes a request and your content is limited to your approved followers. You may also choose who can send you direct messages and who can comment on your posts.
- Minors: accounts belonging to users under 18 are set to private automatically when they register, and are excluded from public discovery surfaces. See section 12.
Content you have made public may be seen, copied or shared by others, and may be indexed by search engines. Deleting it removes it from WORLD X10 but cannot recall copies other people have already made.
7. Service providers
We use a small number of providers to operate the service. They process data on our instructions only; none of them is permitted to use your data for their own purposes.
| Provider | What it does for us | What it sees | Where |
|---|---|---|---|
| Amazon Web Services (Amazon S3) | Stores uploaded media: profile photos, post and story media, identity verification documents. | The stored files. | Frankfurt, Germany (eu-central-1) |
| Amazon Web Services (Amazon CloudFront) | Delivers that media quickly worldwide. | The media requested, and the requesting IP address. | Global edge network |
| Google (Firebase Cloud Messaging) | Delivers push notifications to your device. | Your push token and the notification content. | Google infrastructure |
| Meta Platforms (WhatsApp Business Platform) | Delivers one-time verification codes over WhatsApp, where that channel is used. | Your phone number and the code. | Meta infrastructure |
| Unifonic | Delivers one-time verification codes by SMS, where that channel is used. | Your phone number and the code. | Unifonic infrastructure |
| Google Fonts | Serves the typefaces used on our public web pages, including this one. | Your IP address and browser information when the page loads. | Google infrastructure |
| Our hosting provider | Runs the WORLD X10 servers and database. | All service data, at rest and in transit. | See section 8 |
We may also disclose data where we are legally required to do so by a competent authority, or where it is necessary to protect the safety of a person — in particular a child.
If we ever transfer the service to another company, we will tell you before your data moves, and the receiving company will be bound by this policy or a policy at least as protective.
8. International transfers
WORLD X10 serves archers worldwide, and your data crosses borders.
- Athlete media and files are stored in Frankfurt, Germany (Amazon Web Services region
eu-central-1), which is inside the European Economic Area. - Content delivery, push notifications and one-time code delivery are performed by the providers listed in section 7, whose infrastructure spans multiple countries.
- We are established in the United Arab Emirates, so our staff access data from the UAE.
Where personal data leaves the European Economic Area or the United Arab Emirates, we rely on the transfer mechanisms permitted by the applicable law — including the European Commission's Standard Contractual Clauses with our providers where those apply, and the conditions for cross-border transfer set out in the UAE personal data protection law. We keep transfers to the minimum the service needs.
9. How long we keep data
| Data | Retention |
|---|---|
| Your account, profile, rounds, arrows, posts, achievements, follows and messages | For as long as your account exists. Deleting your account erases them — see section 10. |
| Stories | A story stops being shown 24 hours after it is posted. The underlying record remains stored so that any highlight you pinned continues to work, and is erased when you delete the story or your account. |
| One-time verification codes | Valid for 10 minutes and locked after 5 failed attempts. Code records tied to your phone number are erased when your account is deleted. |
| Sign-in security log | For as long as your account exists; erased with the account. |
| Server logs | For a limited period determined by what security monitoring and abuse investigation require, and then deleted or aggregated so that they no longer identify you. |
| Moderation reports | Kept for as long as needed to handle the report and to detect repeat abuse, and to defend against legal claims where one has been raised. |
| Identity verification documents | Kept only while your verification request is being reviewed and for as long as the badge is relied upon; erased when your account is deleted. |
| Encrypted database backups | Kept on a rolling schedule for disaster recovery. Data you delete disappears from live systems immediately and works its way out of backups as older backups are replaced. We do not restore a backup in order to bring deleted data back. |
10. Deleting your account
You can delete your WORLD X10 account yourself, at any time, without asking us and without reinstalling the app:
- In the app: Settings, then Delete account.
- On the web: app.worldx10.com/account/delete. Enter your registered phone number, confirm with the one-time code we send you, and the deletion runs immediately.
What deletion removes: your account record and everything attached to it — profile, rounds and arrows, posts, stories, comments, likes, follows, achievements, direct messages, notification tokens, sign-in history, privacy settings, and the outstanding verification codes tied to your phone number. Your uploaded media is deleted from our storage, including any identity verification document, and our content delivery cache is cleared so the deleted files stop being served.
Deletion is immediate and irreversible. There is no grace period and no recovery. Export your data first if you want to keep it (section 11).
What may remain: messages you sent may still be visible in the recipient's conversation; content other people copied or re-shared before your deletion is outside our control; anonymised or aggregated statistics that can no longer identify you may be retained; and records we are legally required to keep, or that are needed for an open safety or legal matter, are retained for that purpose only. You will receive a reference number when the deletion completes — keep it if you need to write to us about that request.
If a minor's account was created without an independent phone number, a parent or guardian can write to privacy@uaex10.com from their own address and we will carry out the deletion.
11. Your rights
You have the following rights over your personal data. Some are built into the product so that you never have to ask:
| Right | How to use it |
|---|---|
| Access — know what we hold about you | This policy tells you, and the app hands you the full record: Settings → Help & support → Download your data. |
| Portability — take your data elsewhere | That same export is a machine-readable file containing your account details, profile, rounds and arrows, posts, stories, follows and achievements. |
| Rectification — correct what is wrong | Edit your profile in the app. To change your username or phone number, go to Settings → Account center. Anything you cannot edit yourself, we will correct on request. |
| Erasure — delete your data | Delete individual items in the app, or delete the whole account as described in section 10. |
| Restriction and objection | Write to us and we will stop the processing you object to unless we have compelling legitimate grounds to continue, in which case we will explain them. |
| Withdraw consent | Turn off notifications, clear optional profile fields, make your account private, or delete your account. Any of these withdraws the relevant consent. |
| Complain | See section 16. |
To exercise a right that is not already in the app, email privacy@uaex10.com from the email address on your account, or from the phone number's registered contact. We respond within one month of receiving your request. If your request is unusually complex we may extend that period, and we will tell you why before the first month is over. We do not charge for this. We may ask you for information to confirm your identity — only so that no one else can obtain or destroy your data.
12. Children and young athletes
Archery is a sport with young competitors, so WORLD X10 is built with minors in mind rather than pretending they are not present.
- Date of birth is required at registration and determines whether an account belongs to a minor. We treat anyone under 18 as a minor.
- A minor's account is private from the moment it is created. The account holder or their guardian can change this later; it is never public by default.
- Guardian consent is required before a minor can publish. A minor account cannot publish posts or stories, apply to tryouts, or use direct messages until a parent or guardian has given consent.
- How consent is verified: the minor supplies the guardian's name and phone number; we send a one-time code to the guardian's phone, and the consent is only approved when that code is entered. The guardian's number cannot be the minor's own number, and cannot belong to another minor's account.
- A guardian may withdraw consent, ask to see what we hold about the child, ask us to correct it, or ask us to delete the account entirely, by writing to privacy@uaex10.com.
- We do not show advertising to anyone, and we do not profile minors.
Where the European Union General Data Protection Regulation applies, Article 8 sets the age of consent for information society services at 16 unless the member state has set it lower, and requires consent to be given or authorised by the holder of parental responsibility below that age. Our guardian consent mechanism is designed to meet that requirement, and we apply it up to 18 rather than 16 because that is the safer line for a sport with junior categories.
If you believe a child has given us personal data without the consent required in your country, write to privacy@uaex10.com and we will act on it.
13. Security
- All traffic between your device and WORLD X10 is encrypted in transit using HTTPS.
- Athletes sign in with a one-time code sent to their phone. There is no athlete password to leak, and codes expire in 10 minutes and lock after 5 wrong attempts.
- Sensitive actions — changing your phone number, deleting your account, approving guardian consent — always require a fresh one-time code.
- Requests that could be abused are rate limited, both per phone number and per network address.
- Database backups are encrypted and access to them is restricted.
- Access to production data by our staff is limited to the people who need it to run the service.
No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the competent authority and, where the law requires it, notify you directly.
14. Cookies
Our website uses strictly necessary cookies only. We set a session cookie and a cross-site request forgery token so that pages such as account deletion work securely. These are essential to deliver a service you have asked for, so they do not require consent, and we do not use them to track you.
We do not use advertising cookies, analytics cookies, or any cross-site tracking. Our mobile applications store a sign-in token on your device so you stay signed in; deleting the app or signing out removes it.
The public web pages load typefaces from Google Fonts, which means your browser contacts Google's servers and Google receives your IP address for that request. This is disclosed in section 7.
15. Changes to this policy
When we change this policy we update the version number and the "last updated" date at the top of the page. If a change materially affects your rights or how we use your data, we will tell you in the app or by a message to the contact details on your account before the change takes effect, and — where the law requires consent — we will ask for it rather than assume it.
16. Contact and complaints
Show Information Systems (SHOW SOFTWARE)
Ajman, United Arab Emirates
Data protection contact: privacy@uaex10.com
Please write to us first — most matters are resolved quickly. If you are not satisfied, you may complain to the competent data protection authority: in the United Arab Emirates, the authority responsible for personal data protection; in the European Economic Area or the United Kingdom, the supervisory authority in your country of residence, workplace, or where you believe the problem occurred.