Privacy Policy

1. Who is responsible for your data

The controller of your data is Qbits Technologies SRL, VAT ID 48357432, registered in Timișoara, Romania. For any question or request about your data, write to us at [email protected].

We have no designated data protection officer, because the law does not require one of us. Requests go straight to the team that builds the app.

2. What we collect

Only what the app needs to work:

• Account: the phone number or email address you sign in with. If you choose Apple or Google, we receive your name and email address from them, or the anonymised address if you chose to hide it with Apple.
• Profile: your display name, photo, a short bio, your city, your sports and your level in each.
• Activity: the matches you join or organise, the groups you belong to, your votes in polls.
• What you publish: chat messages, community posts and photos, and the reports you send us.
• Notifications: a device identifier used only to deliver notifications to you, and your notification preferences.
• Technical data: IP address, device and browser type, error logs when something breaks.
• Where you came from: if you reached us through an invitation, an ad or a search, we record the source.

We have no passwords. Sign-in uses one-time codes, so there is no password of yours that could be lost or stolen from us.

We do not access your device location. You pick your city in your profile and can change it any time.

3. What other players see

Sportly is a social app, so some of your data is visible to others. Specifically:

• Your name and profile photo appear on matches you have joined and in the groups you belong to.
• Your city and sports help other players find you when they are looking for someone to play with.
• Your phone number and email address are never public and appear nowhere in the app.
• In your profile you choose who sees your full profile: everyone, only players you share a group with, or only members of your groups.
• In communities you can post anonymously. Other players cannot see who you are, but we can.

4. Why we use it

• To keep your account and sign you in.
• To show you matches and players in your area.
• To send you notifications about your matches and groups.
• To fix what breaks and understand what works badly.
• To stop spam, fraud and abuse.
• To meet our legal obligations.

We do not use your data to sell you ads and we do not build advertising profiles.

5. On what legal basis

We process data on the basis of:

• Performance of the contract (Art. 6(1)(b) GDPR): your account, matches, groups and chat. Without this data the app simply cannot work.
• Your consent (Art. 6(1)(a) GDPR): analytics cookies, push notifications and access to photos on your phone. You can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): platform security, stopping abuse, and improving the app.
• Legal obligation (Art. 6(1)(c) GDPR): when the law requires us to keep or provide certain data.

6. Who we pass it to

We do not sell data. We only send it to the providers we need in order to run the app, all under data processing agreements:

• Hetzner (Germany): the servers and the database. This is where your data physically lives.
• Resend: sending email, from sign-in codes to notifications.
• Infobip: sending the SMS with your sign-in code.
• Expo: delivering push notifications to your phone.
• Apple and Google: only if you choose to sign in with them.
• Google Analytics: website usage statistics, and only if you accepted analytics cookies.
• Authorities: only on a valid legal request.

The servers holding your data are in Germany. Some of the providers above (Resend, Expo, Google, Apple) are United States companies and process data under the standard contractual clauses approved by the European Commission or under the EU-US Data Privacy Framework.

7. How long we keep it

• Account data: for as long as your account exists.
• Messages and posts: for as long as the conversation or community exists, or until you delete them.
• Sign-in codes: a few minutes, then they expire and cannot be reused.
• Technical logs: rotated periodically, not kept long term.
• Analytics cookies: at most 13 months, as set out in the Cookie Policy.

8. What happens when you delete your account

Deletion is immediate and final. We do not hold the account for 30 days and we cannot bring it back afterwards. The moment you confirm deletion:

• your name, photo, bio, phone number and email address are erased, and the photo is removed from our image storage too;
• your sessions, notification tokens and Apple or Google links are revoked;
• future matches you were organising are cancelled, and the players who had joined are notified;
• the spots you held in other matches are freed up for other players;
• you leave every group, and groups you created pass to the longest-standing member left;
• your votes in still-open polls are deleted, while votes in closed polls remain, so past results do not change retroactively;
• you leave the communities you belonged to;
• messages you already sent stay in their conversations but without your name, so the discussion still makes sense to the others.

9. Your rights

GDPR gives you the following rights, and we honour all of them:

• Access: you can ask for a copy of the data we hold about you.
• Rectification: you can correct wrong data, most of it straight from your profile without writing to us.
• Erasure: you can delete your account at any time, yourself, from the app. See the section above.
• Restriction: you can ask us to limit how we use your data.
• Portability: you can ask for your data in a structured format another program can read.
• Objection: you can object to processing based on our legitimate interest.
• Withdrawing consent: at any time, without affecting what we lawfully processed until then.

Write to us at [email protected] and we will answer within 30 days.

If you think we are not doing our job, you can complain to the Romanian National Supervisory Authority for Personal Data Processing: www.dataprotection.ro

10. How we protect it

• All traffic between you and us is encrypted (HTTPS).
• We store no passwords, because we use no passwords.
• Database access is limited to a few people on the team.
• We take regular database backups.
• We monitor access and abuse attempts.

No measure is perfect. If a breach puts your data at risk, we will tell you and notify the authority within 72 hours, as the law requires.

11. Cookies

On the website we use cookies for sign-in, preferences and analytics. Which cookies, what they do and how to turn them off is described in the Cookie Policy.

12. Minimum age

Sportly is for people aged 16 and over. We do not knowingly collect data about children below that age. If you find out a child has created an account anyway, write to us at [email protected] and we will delete it.

13. Changes

When we change something important about how we use your data, we will tell you by email or with a message in the app before it takes effect. The date of the last update is shown at the top.

14. Contact

For any question or request about your data:

• Email: [email protected]
• Qbits Technologies SRL, VAT ID 48357432, Timișoara, Romania