Privacy Policy — SportanPlay

Last updated: 21 Sep 2026

1. Data Controller

The controller of your personal data is:

• Owner: Pablo Gandul Romero
• Tax ID (NIF): 14324239T
• Address: Calle Rioja 13, 1 C, 41001 Seville, Spain
• Contact email: privacy@sportanplay.com

SportanPlay (hereinafter, "the Platform") is a sports matchmaking service available at sportanplay.com and app.sportanplay.com, and through our iOS mobile app.

This policy covers both ways of accessing the service. Where a processing activity exists only in the mobile app, we say so explicitly: that is the case for push notifications (section 2.7) and content reporting (section 2.8). Those activities apply from the publication of the app, which is later than the previous version of this policy.

2. Data We Collect

2.1 Account data

When you sign up: email address, username, first name and password (stored encrypted and irreversibly hashed; never in plain text). Optionally, you may also give your surname and your city and province of residence: they are not needed to use the Platform, and you can add, change or delete them at any time from your profile. When you complete registration we record your acceptance of the Terms and Conditions, storing the date and time of acceptance and the version accepted as evidence of that consent.

2.2 Profile data

Information you choose to add to your profile: bio and profile picture (avatar), and data derived from your sports activity on the Platform (player statistics, match history, levels per sport).

2.3 Location data

To enable nearby match discovery, the Platform processes location data:

• Match locations: coordinates of the venue for each match (provided by the match creator). So that matches can be grouped by area, we send those coordinates to the OpenStreetMap reverse geocoding service (Nominatim), which returns the city, province and country (section 5).

• Your location, when you allow it: if you grant geolocation permission in your browser or in the mobile app, we obtain your device's position and use it to centre the search and show you the matches closest to you.

  This is your precise location. Although we ask the system for balanced accuracy — on the order of one hundred metres, to spare your battery — the coordinates leave your device with all their decimal places, and travel that way in the search query. We state this explicitly because what we declare is what leaves the device, not the accuracy we request.

  We do not store that position on your profile, nor do we keep a history of your locations. It is used at the moment of the search and then discarded; like any other request, it may transiently appear in the technical logs described in section 2.5, for the period set out in section 7.

  You may deny or revoke the permission at any time in your browser or in your device settings. If you do, you can still use the Platform normally: the search opens on a default area which you can move manually.

• Your city and province, if you provide them: they are optional (section 2.1). They are declared by you, not derived from your device, and they are visible to other users (section 4).

2.4 Content you generate

• Messages: those you send in match conversations.
• Feedback: ratings and comments you leave about other players and those others leave about you.
• Matches: the details of matches you create or join, including their title and description.

2.5 Technical data

IP address, connection and browsing data required for security and service operation (e.g., request rate limits to prevent abuse), and technical error data (via our error monitoring tool) to diagnose and fix failures.

2.6 Contact form data

If you write to us through the contact form, we collect your name, email address, the reason for your enquiry and the message content, for the sole purpose of handling and responding to your request. You do not need to be registered to use this form. We keep these messages only for as long as necessary to handle your enquiry and any related ones; they are deleted afterwards.

2.7 Push notifications (mobile app only)

If you install the mobile app and agree to receive alerts, we record a device identifier — the notification token issued by the Expo service —, the platform (iOS or Android) and the registration and last-activity dates of that device. The identifier is linked to your account: it is what makes an alert reach your phone and not someone else's.

To deliver each alert, its content passes through two providers: the Expo push notification service and then Apple's push notification service (APNs). Both are listed in section 5.

Some alerts carry personal data in their own text. In particular, the new-message alert includes the name of the person writing to you and a snippet of the message, so you can decide whether it is worth opening; a match alert includes its title. If you would rather that did not leave the Platform, you can turn off that type of alert in your notification preferences, or deny the permission altogether.

You may withdraw the permission in your phone settings at any time, and choose which types of alert you receive from your account's notification preferences. When you log out, the device is no longer registered.

2.8 Content reports and moderation (mobile app only)

If you report a person, a message or a match, we receive the reason you pick from a closed list, any text you choose to add (up to 2,000 characters) and the identifiers needed to locate the reported content: those of the person, the match and the message.

The report also includes your identifier, your name and your email address, which we take from your signed-in session and never from the form: this is what prevents anyone from reporting in your name, and what allows us to reply to you.

Reports are not stored in the Platform's database: they are sent to the moderation inbox (section 5), where they are reviewed by hand. We commit to responding within 24 hours. We do not disclose your identity to the reported person.

2.9 Service usage data

To understand how the Platform is used and decide what to improve, we record product events in our own systems: sign-up, email verification, login, match creation and cancellation, join requests and their outcome, messages sent and feedback left.

For each event we store the type, the date and time, your user identifier and a few aggregable dimensions: the sport, the match's province and the identifiers of the match or message. We never store the content: we know that you sent a message, not what it said.

These events are linked to your identifier and therefore to you. When you delete your account they are irreversibly unlinked and survive only as an aggregate figure.

This is distinct from the website analytics (Umami), which is anonymous and cookieless, and is described in sections 3 and 5.

3. Purposes and Legal Bases

We do not make automated decisions with legal effects about you, nor profile you to that extent.

4. Visibility of Your Information Within the Platform

Part of your information is visible to other users, as it is the essence of the service:

• Profile: your username, your first name, your city and province if you have provided them, your profile picture if you upload one, your bio, your levels per sport, your player statistics and the feedback you have received are visible to any registered user of the Platform. Your surname and your email address are not shown to other users.
• Matches: when you create or join a match, other participants can see your user identity.
• Feedback: ratings you leave are shown together with your username.
• Messages: messages in a match conversation are visible to that match's participants.

Think before you post: do not include personal data you do not wish to share (phone number, home address, etc.) in your bio, messages or feedback.

5. Recipients: Who Processes Data on Our Behalf

We do not sell your data or share it with third parties for commercial purposes. To provide the service we rely on providers acting as data processors:

6. International Transfers

Some of our providers process data outside the European Economic Area (US, UK). In those cases, transfers rely on a European Commission adequacy decision (the EU-US Data Privacy Framework, or the UK adequacy decision) or on Standard Contractual Clauses approved by the Commission, depending on the provider. You may request further information about the safeguards applied at privacy@sportanplay.com.

7. Retention Periods

• Account and profile data: for as long as your account remains active. When you request account deletion, the account becomes inaccessible immediately and you have a 30-day grace period during which you can recover it; after that period, your personal data is irreversibly anonymised and your profile picture is deleted from storage.
• Record of the relationship (blocked data): after anonymisation, we keep a minimal record blocked (an identifier, email, name, sign-up and deletion dates, and the record of your acceptance of the terms) for the sole purpose of handling potential requests from authorities or courts, or defending against claims. This data is not used for any other purpose and is not accessible during the normal operation of the Platform, and it is permanently deleted after a maximum of 6 years (or the applicable limitation period).
• Messages and feedback: retained while the account is active. Upon account deletion, your feedback may be kept in anonymised form (unlinked from your identity) to preserve the integrity of other players' reputation system.
• Push notification devices: while the app is installed and signed in. The registration is deleted when you log out, when the delivery service tells us the token is no longer valid (for example, when you uninstall the app), when you delete your account, and automatically if the device goes unseen for 90 days.
• Content reports: they live in the moderation inbox, not in the database. They are kept while the case is being handled and, if it led to any action, for as long as needed to evidence that action against a claim.
• Usage events: kept as a historical series so that periods can be compared, but they stop being linked to your identity as soon as you delete your account; from that point they are aggregate figures that no longer identify you.
• Technical data and security logs: up to 12 months.
• Contact form messages: kept while your enquiry and any related ones are being handled; deleted when no longer needed, up to a maximum of 12 months.

8. Your Rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, by writing to privacy@sportanplay.com from the email associated with your account (or otherwise proving your identity).

Many of these actions are also available directly in the Platform: editing your profile, managing notification preferences, revoking the location or notification permission from your device settings, or deleting your account.

If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) or your local supervisory authority.

9. Security

We apply appropriate technical and organisational measures: encrypted communications (HTTPS), irreversible password hashing, session tokens protected from script access (HttpOnly cookies), defences against common attacks (CSRF, rate limiting), system access controls and error logging. No system is infallible; should a security breach affecting your data occur, we will notify it in accordance with the GDPR.

10. Minors

SportanPlay is intended for users aged 18 or over. We do not allow minors to register and do not knowingly collect data from minors. If we detect an account belonging to a minor, we will delete it. If you are a parent or guardian and believe a minor has provided us with data, contact us at privacy@sportanplay.com.

11. Changes to This Policy

We may update this policy to reflect changes in the service or in applicable law. The current version will be published on this page with its update date; if changes are substantial, we will notify you by email or through a notice in the Platform.

Specifically, if a change introduces a new processing activity affecting existing accounts, we will notify you before applying it. This version is not such a case: it describes more precisely activities that already existed — internal usage measurement, which the previous version described incompletely — and adds those that exist only in the mobile app, which was not published when the previous version was written.

12. Contact

For any questions about this policy or the processing of your data: privacy@sportanplay.com.