LekaPong Pingpong · Coffee · Chill
BM EN
Menu
Privacy Policy

Privacy Policy

What we collect, why we need it, who can see it, and how to delete it.

Last updated: 30 September 2026

1. Who we are, and what this policy covers

  • LekaPong is a table-tennis centre, café and hangout operated by AF TTC & Gadget Enterprise in Salak Tinggi, Sepang, Selangor, Malaysia.
  • We also operate the LekaPong Game System — tournament management software that table-tennis clubs use to run competitions and maintain player ratings.
  • This policy covers lekapong.com, games.lekapong.com (public tournament boards), order.lekapong.com (café QR ordering), shop.lekapong.com (merchandise), pos.lekapong.com (staff terminal) and app.lekapong.com (the club administrator portal).
  • We are the data user under Malaysia's Personal Data Protection Act 2010 (PDPA).
  • Contact us: support@lekapong.com or +60 11-1193 6770.

2. What we collect, and why

  • Membership registration form (app.lekapong.com/join): your name, phone number, email address (optional), your partner's name for the Partner package, the package you chose, any notes you write, and your agreement to this policy and the membership terms. Used to process your membership application; your phone number also becomes how you sign in to the member area.
  • Feedback form: your name, a way to reach you, a category and your message. Used to investigate and reply to complaints or suggestions.
  • Club membership records: your name, phone number, photo (if you give us one), membership package and monthly payment records. Used to administer membership, discounts and dues.
  • Tournament entries: your name and phone number, and the names and phone numbers of any partners or team-mates you register. Used to build draws, contact entrants and record results.
  • Match results and ratings: your scores, results, placings and skill rating. Used to run tournaments and maintain the standings.
  • Café and merchandise orders: the items you ordered, the amount, a payment reference, and any receipt image you upload. Used to fulfil and verify your order.
  • Phone number at the counter: used solely to check whether you are a member entitled to a discount.
  • Club administrator sign-in with Google: see section 3.
  • Website analytics: Cloudflare Web Analytics collects visit statistics without cookies and without following you to other websites. It does not identify you personally.

3. Google user data (club administrators only)

  • Google sign-in is used ONLY on app.lekapong.com, by people who manage a club. Players, members and café customers never need a Google account to use our services.
  • The scopes we request are openid, email and profile — nothing else. We do not request access to Gmail, Google Drive, Calendar, Contacts, Photos or any other Google service.
  • From those scopes we receive: your stable Google account identifier, your email address, whether Google has verified that address, your display name, and the URL of your profile picture.
  • We use the account identifier to recognise you when you sign in again; the email address to match you to club invitations and to contact you about your account; and your name and picture to show who is signed in and who made a given change in the portal.
  • We NEVER receive or see your Google password.
  • We do NOT request access tokens or refresh tokens, and we do not store them. Once sign-in completes we make no calls to any Google API on your behalf.
  • We do NOT keep a copy of your profile picture. We store only the link Google gives us and display it; that link stops working when you change or delete your Google account.
  • Limited Use: our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it to anyone except as described in section 6.
  • To withdraw access: go to myaccount.google.com/permissions and remove LekaPong. You can also email support@lekapong.com and we will delete your user record — see section 8.

4. What is shown publicly

  • If you enter a tournament, your name and your photo (if we have one) appear publicly and without any login on entry lists, draws, live scoreboards, tournament galleries and ranking tables at games.lekapong.com.
  • That includes your match results, placings and skill rating. This information is a sporting record and may be indexed by search engines.
  • What is NEVER shown publicly: phone numbers, email addresses, membership packages, payment records, receipt images and any private notes about you.
  • The player standings page on lekapong.com is marked noindex so it does not appear in search results.
  • If you would rather your name or photo were not shown, email support@lekapong.com. We will remove your photo, and can shorten your displayed name on request.

5. How we store and protect it

  • Data is held on Cloudflare infrastructure (D1 database and R2 object storage), and the website's feedback form submissions are stored in our Sanity content system.
  • All traffic to our site and apps is encrypted with HTTPS, with HSTS enabled.
  • Submitted forms are stored as private records that cannot be read without authorisation, and are never automatically published.
  • Access to the administrator portal requires signing in, and significant changes are written to an audit trail recording who made them and when.
  • Your data may be processed in data centres outside Malaysia by our service providers. We use only providers that offer comparable protection.

6. Who we share it with

  • We do NOT sell your personal data, and we do not share it for third-party advertising or marketing.
  • We share data only with the service providers that operate this system for us: Cloudflare (hosting, database, storage, analytics, email), Sanity (feedback form storage), Google (administrator sign-in) and OpenAI (generating tournament posters from event titles — no personal data is sent).
  • When another club runs a tournament on our platform, they see only the players who registered with them. They cannot see LekaPong's member list, phone numbers, payment records or notes, and we cannot see theirs.
  • We may disclose data where Malaysian law requires it, or to protect rights, safety and property.

7. How long we keep it

  • Membership and payment records: for as long as you are a member, and for up to seven years afterwards to meet accounting and tax requirements.
  • Match results, placings and ratings: kept indefinitely as the sporting record of a tournament.
  • Registration and feedback form submissions: deleted once we have finished acting on them.
  • Payment receipt images: deleted once payment is confirmed and the dispute window has closed.
  • Google sign-in records: kept while you administer a club, and deleted on request or when your access ends.
  • Analytics statistics: aggregate only, and cannot be linked back to you.

8. Your rights, and how to delete your data

  • Under the PDPA 2010 you have the right to access your personal data, correct inaccurate data, withdraw consent, and limit how your data is processed.
  • To get a copy of your data, email support@lekapong.com from the address you use with us, or ask us at the café.
  • To delete your Google account from our system: email support@lekapong.com with the subject “Delete account”. We will delete your user record — including the Google identifier, email, name and picture link — within 30 days.
  • To cut off our access without contacting us, remove LekaPong at myaccount.google.com/permissions. That stops any new sign-in immediately.
  • Some records cannot be fully deleted: payment transactions we must retain for accounting, and match results that form part of other people's tournament record. Where that applies we will de-identify the record instead if we can.
  • We respond to every request within 21 days. If you are not satisfied, you may complain to Malaysia's Personal Data Protection Department.

9. Cookies and similar technologies

  • We use one session cookie to keep staff and administrators signed in. It is strictly necessary for the system to work and is not used for tracking.
  • During Google sign-in a temporary 10-minute cookie protects against cross-site request forgery. It is deleted as soon as sign-in completes.
  • The ordering app keeps your order history in your own browser so you can look it up again. It is not sent to us.
  • Our website analytics uses no cookies and does not follow you across other websites.
  • We use no advertising cookies and allow no advertiser to track our visitors.

10. Children

  • Children under 18 may become members or enter tournaments with a parent's or guardian's permission.
  • For under-age entrants we collect only their name, a guardian's phone number and their match results.
  • Google sign-in is not available to children: it is only for adult club administrators.
  • A parent or guardian may request access to, or deletion of, their child's data at any time at support@lekapong.com.

11. Changes to this policy

  • If we change this policy we will update the date at the top of this page.
  • For changes that materially affect how we use your data we will post a notice on the website and, where appropriate, email you.
  • A Malay version of this policy is available at lekapong.com/privacy.

12. Contact us

  • Email: support@lekapong.com
  • Phone and WhatsApp: +60 11-1193 6770
  • Address: LekaPong (AF TTC & Gadget Enterprise), Salak Tinggi, Sepang, Selangor, Malaysia.
  • We normally reply within two working days, and always within 21 days for a formal data request.