Privacy Policy

This policy explains what personal data Athlomate collects, why, who receives it and what your rights are. It follows the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is OPERATOR_NAME (operated from Berlin, Germany), OPERATOR_ADDRESS. [REVIEW: confirm how to describe the operators (two people working together) and their legal form] Contact: [email protected].

2. What we collect

Other users can see: your name, photo, city, sports and levels, and your age unless you hide it. If you turn off "Show me in Discover" you do not appear in the Discover list and map.

Only on your device (we never receive it): your language, the area and radius you chose for Discover and Events, other preferences such as hints you have seen, and your sign-in session. Per-account preferences are removed when you delete your account. The map pictures you view are kept only in memory during the session, and chat photos are not saved on the device.

We do not use advertising, tracking or analytics tools, and we do not sell your data. The diagnostic error reports above are used only to fix bugs, not to track you or to measure how you use the app.

3. Legal bases

• Contract (Art. 6(1)(b) GDPR): account, profile, games, chats and notifications, which are needed to provide the app.
• Consent (Art. 6(1)(a)): the approximate area on the map. It is off by default and you can switch it off at any time.
• Legitimate interests (Art. 6(1)(f)): safety, reports, blocking, preventing abuse, keeping the service secure, and finding and fixing bugs (diagnostic error reports). [REVIEW: confirm this is the right legal basis for diagnostic error reports]
• Legal obligation (Art. 6(1)(c)): when the law requires us to keep or hand over data.

4. Location

• The app asks for location only while it is in use, with low accuracy, and never in the background.
• When you pick your city, your device position is used once, on the device, to suggest the nearest place from a list that is built into the app. Only the place you choose is saved: its name (as your city) and the centre point of that place, which is a public town centre and not where you are. Your device position is not sent or saved.
• The approximate area is opt-in (off by default). Your device rounds the position to a grid of about 2 km and only the centre of that cell is sent and stored; the database rounds it again. We never store or send a precise position. Other users may see you on the map in that area and a rounded distance.
• "My location" on a map only moves the map on your screen and stores nothing.

5. Photos

Profile photos are uploaded to our storage. Photos you send in chats are re-encoded on your device before upload (largest side 1600 px, JPEG) which removes hidden data such as EXIF and GPS location. Chat photos are kept in a private storage area and shown only to the people in that chat through short-lived links; the app does not keep them on your device's disk.

Profile photos are different: they are stored in a public storage area and the app shows them to people who can see your profile through a link. Anyone who has that link can open the photo, without signing in. [REVIEW: new text, lawyer to check that this is described correctly and is enough]

6. Who receives your data

• Other users, as described in section 2.
• Supabase provides our database, sign-in, file storage and real-time messaging, and acts as our processor. Our project is hosted in London, so your data is stored in the UK (AWS region eu-west-2) under the EU adequacy decision for the UK. [REVIEW: before launch, re-check that the adequacy decision is still in force and sign/confirm Supabase's data processing agreement (DPA)]
• Mapbox provides the map pictures and address search (processor). When you view a map, your device requests map tiles from Mapbox, which therefore receives technical data such as your IP address and the map area you view. When you search for an address or move the pin when creating a game, the text you type or the pin position is sent to Mapbox. When a game is saved, one further lookup is sent to Mapbox to store a place name. Mapbox may process data outside the EU and UK, under safeguards such as standard contractual clauses. [REVIEW: confirm Mapbox's current DPA and transfer mechanism] Map data is © Mapbox and © OpenStreetMap contributors. Court data comes from OpenStreetMap contributors (ODbL licence).
• Resend is the email service (processor) that sends report details to the operator: when someone reports a user, a message or a game, or sends feedback, an email is sent to the operator through Resend so it can be reviewed. A report email contains the reason, the names and ids of the reporter and the reported person and the reported text or game. A feedback email contains the type, your message, app version, phone operating system, language and your account id, but never your email address or name. [REVIEW: confirm Resend's DPA and transfer mechanism]
• Email delivery: account emails (for example password reset and email confirmation) are sent through an email service. [REVIEW: name the email provider chosen in LA8]
• Push notifications are not active yet. If we add them, we will name the provider here before they are switched on. [REVIEW: update after LA10]
• Authorities, only where the law requires.

7. International transfers

Data is stored in the UK. Some processors (for example Supabase Inc. and Mapbox Inc.) are based in the United States or may process data there. Where this happens, we rely on the EU's standard contractual clauses or an adequacy mechanism such as the EU-US Data Privacy Framework. [REVIEW: verify per processor]

8. How long we keep data

[REVIEW: proposed retention periods, please confirm each]

• Account, profile, sports, games, messages, photos, feedback, blocks: kept until you delete your account, then deleted.
• Reports about a user, a message or a game, including a copy of the reported name and message text: kept for moderation for 12 months, then deleted, even if the account they concern (or the account that made the report) has been deleted in the meantime.
• Diagnostic error reports: deleted automatically after 30 days, or earlier when you delete your account.
• In-app notifications: shown in the app for 30 days, then deleted automatically.
• The optional "Looking for" line: it stops showing after 14 days and is deleted automatically 30 days after that.
• Connection requests that were declined, withdrawn or expired: deleted automatically after 180 days. Accepted connections are kept until you or the other person remove them or delete the account.
• Technical counters used only against spam: deleted automatically after 2 days.
• "Delete chat" in the app hides a chat only for you; the other people in it keep their copy until they or the account that wrote it are deleted. Emoji reactions are deleted together with the message or the account.
• Game chats: you can write in a game chat until 7 days after the game ends; the messages stay stored until they are deleted with the account or the game.
• Backups: Supabase may keep encrypted backups for a limited time after deletion (usually up to 7 days on a paid plan). [REVIEW: confirm the plan and backup period]
• Data we must keep by law is kept as long as the law requires.

9. Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable form, and withdraw consent at any time (for example by switching off the approximate area). Most of this you can do directly in the app (Edit profile, Settings). To delete your account and all your data, use Settings, Delete account. For anything else write to [email protected]; we answer within one month.

You may also complain to the data protection authority responsible for the operator, which is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de), because we are based in Berlin. If you live in Greece you can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the authority in your own country. [REVIEW: new text, lawyer to confirm the lead authority]

10. Age

Athlomate is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think someone under 18 uses the app, please tell us and we will remove the account.

11. Security

Data is sent over encrypted connections, access is restricted with database rules so that people only see what the app lets them see, and chat photos are private. No system is perfectly secure; if there is a breach that affects you, we will inform you and the authority as the law requires.

12. Website and support emails

[REVIEW: new section, lawyer to check] The Athlomate website (athlomate.app, with these pages) is hosted by Cloudflare (Cloudflare Pages), which also manages the domain name. When you visit the website, Cloudflare sees technical data such as your IP address in its server logs. When you write to our support address, Cloudflare Email Routing forwards your email to the operators' mailbox, which is a Google Gmail inbox. Cloudflare and Google therefore handle the content of your email and your email address. We use your email only to answer you and, if you reported something, to handle the report. [REVIEW: confirm roles (processor or controller), data processing agreements and transfer basis for Cloudflare and Google, and how long support emails are kept]

13. Changes

We may update this policy. The date below changes, and for important changes we will tell you in the app.

Last updated: 2026-11-11