Privacy policy
Last updated: 2026-11-14
This policy explains how the personal data of people who use Spogly, the app to organize football matches among friends, is processed under Regulation (EU) 2016/679 (GDPR).
1. Data controller
[Name or company name of the controller, address, privacy contact email]
2. Data we process
| Data | Source |
|---|---|
| Email, password (stored only in hashed form), name | Sign-up |
| Last name, nickname, phone, date of birth, nationality, photo or avatar | Optional, entered by you or by the group admin |
| Group activity: poll answers, appearances, teams, results, goals, fee payments | Use of the app |
| Teammate ratings | Use of the app; they are anonymous: nobody, not even the admin, can see who voted what |
| Language, push notification subscription of your device | App settings |
| Technical data (IP address, time of requests) in providers' logs | Operation of the service |
We do not use profiling cookies or advertising tools. The browser only stores what the app needs to work (sign-in session, language, current group).
3. Purposes and legal bases
- Providing the service (account, groups, matches, standings, kitty, notifications): performance of a contract (Art. 6.1.b GDPR).
- Security and abuse prevention (technical logs, sign-up limits): legitimate interest (Art. 6.1.f).
- Group history (appearances and results that remain in teammates' standings after an account is deleted): the group's legitimate interest in keeping its sporting history (Art. 6.1.f).
- Legal obligations, where applicable (Art. 6.1.c).
Your date of birth, if entered, is only used to build balanced teams and is not visible to others. Your phone number is visible to teammates only if you choose so.
4. Who can see the data
Group data is visible only to members of the same group, according to their role (player, admin, technical staff). Access is enforced at database level.
Providers processing data on our behalf (processors):
- Supabase Inc. – database, authentication and photo storage; server region: [Supabase project region, e.g. EU – Frankfurt]
- Netlify Inc. – hosting of the website and app
- [Chosen email provider, e.g. Brevo / Resend] – confirmation and password reset emails
- Browser or operating system push services (Google, Apple, Mozilla, Microsoft) – notification content only
Weather forecasts (Open-Meteo) and pitch address search (Photon/Komoot) only receive the pitch location, not data about people. Some providers may process data outside the EU: in that case transfers rely on the safeguards provided by the GDPR (such as standard contractual clauses).
5. Retention
- Account and profile data: as long as the account exists.
- When you delete your account, your email, password, profile, phone, date of birth, photo and group memberships are deleted. The name you appeared with in the group, your appearances and results remain in the group history as a "guest", with no link to your account.
- Technical logs: according to providers' retention, usually a few days or weeks.
6. Your rights
You can request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interest by writing to [privacy email]. You can edit most data directly in your profile and delete your account from your profile at any time. You also have the right to lodge a complaint with your data protection authority.
7. Children
Spogly is not intended for children under 14. [Check the applicable minimum age in launch countries]
8. Changes
If this policy changes significantly we will let you know in the app. The date above shows the latest version.