Privacy Policy
This policy explains what personal data Athlomate collects, why, who receives it and what your rights are. It follows the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is OPERATOR_NAME (an individual), OPERATOR_ADDRESS. Contact: SUPPORT_EMAIL.
2. What we collect
| Data | Why |
|---|---|
| Email address and password (the password is stored only in hashed form) | Create and secure your account, send account emails |
| Name, age, gender, city and an optional profile photo | Your profile, so others can recognise you and find games in your city |
| Sports, skill levels and interest levels | Matching you with games and players at a similar level |
| Games you create or join, join requests, places and times of games | Running the games feature |
| Messages (direct chats and game chats) and chat photos | Letting players talk to each other |
| Feedback after games (kudos) | Showing friendly feedback on profiles |
| Reports and blocks | Keeping the community safe |
| In-app notifications (for example a join request was accepted) | Telling you what happened |
| Your settings (hide age, hide from Discover, read receipts, approximate area, language) | Respecting your choices |
| Diagnostic error reports: a shortened error message, a technical stack trace, app version, phone operating system version, app language, and your account id if you are signed in | Finding and fixing bugs. They contain no names, messages, places or locations (we remove those before sending) |
| Approximate area, only if you turn it on | Showing you on the Discover map and a rounded "about X km away" (see section 4) |
Other users can see: your name, photo, city, sports and levels, and your age unless you hide it. If you turn off "Show me in Discover" you do not appear in the Discover list and map.
We do not use advertising, tracking or analytics tools, and we do not sell your data. The diagnostic error reports above are used only to fix bugs, not to track you or to measure how you use the app.
3. Legal bases
- Contract (Art. 6(1)(b) GDPR): account, profile, games, chats and notifications, which are needed to provide the app.
- Consent (Art. 6(1)(a)): the approximate area on the map. It is off by default and you can switch it off at any time.
- Legitimate interests (Art. 6(1)(f)): safety, reports, blocking, preventing abuse, keeping the service secure, and finding and fixing bugs (diagnostic error reports). [REVIEW: confirm this is the right legal basis for diagnostic error reports]
- Legal obligation (Art. 6(1)(c)): when the law requires us to keep or hand over data.
4. Location
- The app asks for location only while it is in use, with low accuracy, and never in the background.
- When you pick your city, your device position is used once to suggest the nearest city. Only the city name is saved, not the position.
- The approximate area is opt-in (off by default). Your device rounds the position to a grid of about 2 km and only the centre of that cell is sent and stored; the database rounds it again. We never store or send a precise position. Other users may see you on the map in that area and a rounded distance.
- "My location" on a map only moves the map on your screen and stores nothing.
5. Photos
Profile photos are uploaded to our storage. Photos you send in chats are re-encoded on your device before upload (largest side 1600 px, JPEG) which removes hidden data such as EXIF and GPS location. Chat photos are kept in a private storage area and shown only to the people in that chat through short-lived links; the app does not keep them on your device's disk.
6. Who receives your data
- Other users, as described in section 2.
- Supabase provides our database, sign-in, file storage and real-time messaging, and acts as our processor. Our project is hosted in London, so your data is stored in the UK (AWS region eu-west-2) under the EU adequacy decision for the UK. [REVIEW: before launch, re-check that the adequacy decision is still in force and sign/confirm Supabase's data processing agreement (DPA)]
- Mapbox provides the map pictures and address search (processor). When you view a map, your device requests map tiles from Mapbox, which therefore receives technical data such as your IP address and the map area you view. When you search for an address or move the pin when creating a game, the text you type or the pin position is sent to Mapbox. When a game is saved, one further lookup is sent to Mapbox to store a place name. Mapbox may process data outside the EU and UK, under safeguards such as standard contractual clauses. [REVIEW: confirm Mapbox's current DPA and transfer mechanism] Map data is © Mapbox and © OpenStreetMap contributors. Court data comes from OpenStreetMap contributors (ODbL licence).
- Resend is the email service (processor) that sends report details to the operator: when someone reports a user, a message or a game, an email with the report, the names and ids involved and the reported text is sent to the operator through Resend so it can be reviewed. [REVIEW: confirm Resend's DPA and transfer mechanism]
- Email delivery: account emails (for example password reset and email confirmation) are sent through an email service. [REVIEW: name the email provider chosen in LA8]
- Push notifications are not active yet. If we add them, we will name the provider here before they are switched on. [REVIEW: update after LA10]
- Authorities, only where the law requires.
7. International transfers
Data is stored in the UK. Some processors (for example Supabase Inc. and Mapbox Inc.) are based in the United States or may process data there. Where this happens, we rely on the EU's standard contractual clauses or an adequacy mechanism such as the EU-US Data Privacy Framework. [REVIEW: verify per processor]
8. How long we keep data
[REVIEW: proposed retention periods, please confirm each]
- Account, profile, sports, games, messages, photos, feedback, blocks: kept until you delete your account, then deleted.
- Reports about a user, a message or a game, including a copy of the reported name and message text: kept for moderation for 12 months, then deleted, even if the account they concern (or the account that made the report) has been deleted in the meantime.
- Diagnostic error reports: deleted automatically after 30 days, or earlier when you delete your account.
- In-app notifications: shown in the app for 30 days. [REVIEW: confirm when the older rows are physically deleted]
- Game chats: you can write in a game chat until 7 days after the game ends; the messages stay stored until they are deleted with the account or the game.
- Backups: Supabase may keep encrypted backups for a limited time after deletion (usually up to 7 days on a paid plan). [REVIEW: confirm the plan and backup period]
- Data we must keep by law is kept as long as the law requires.
9. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable form, and withdraw consent at any time (for example by switching off the approximate area). Most of this you can do directly in the app (Edit profile, Settings). To delete your account and all your data, use Settings, Delete account. For anything else write to SUPPORT_EMAIL; we answer within one month.
You may also complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the authority in your own country.
10. Age
Athlomate is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think someone under 18 uses the app, please tell us and we will remove the account.
11. Security
Data is sent over encrypted connections, access is restricted with database rules so that people only see what the app lets them see, and chat photos are private. No system is perfectly secure; if there is a breach that affects you, we will inform you and the authority as the law requires.
12. Changes
We may update this policy. The date below changes, and for important changes we will tell you in the app.
Last updated: 2026-10-30