- We collect only the data needed to run the app: your name, email, city, sports preferences, and in-app activity.
- We never sell, rent, or share your data with advertisers or data brokers.
- You can export or delete all your data at any time.
- We comply fully with the EU General Data Protection Regulation (GDPR).
01Data Controller and Contact
SportSync is a service based in Italy. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), SportSync is the Data Controller of your personal data.
This Privacy Policy explains what personal data we collect, why, the legal basis for each processing activity, how long we keep it, who we share it with, and the rights you hold over it. By creating an account or using SportSync, you acknowledge that you have read and understood this policy.
For all privacy matters, data access requests, or to exercise your rights, contact us at support@sportsyncc.com. We aim to acknowledge all requests within 72 hours and respond fully within 5 working days.
02Data We Collect
We collect the minimum data necessary to provide SportSync, grouped into the following categories:
Account information
- Name and email address — required to create and manage your account
- Profile photo and username — optional; displayed publicly on your profile
- Age, city, sports preferences, and skill levels — used to match you with relevant games
- Bio text and gallery photos — optional; help other players get to know you
Activity data
- Games you create, join, leave, or cancel
- Attendance records — whether you attended games you committed to
- Host and player ratings and written reviews you submit or receive
- Points, badges, and achievements earned through the app
- Follow and follower relationships with other users
Communications
- Messages sent in game group chats and direct messages with other users
- Push notification device token — stored only if you enable game reminders
Technical and diagnostic data
- Device location — accessed only whilst the app is open in the foreground, if you have granted permission
- App preferences stored locally on your device, including colour scheme and language
03How We Use Your Data
Your data is used exclusively to operate and improve SportSync:
- Create and maintain your account and public player profile
- Display nearby games based on your current location or stated city
- Enable in-app messaging between players and game hosts
- Send game-related push notifications and reminders, only if you opt in via Settings
- Operate the attendance tracking and community rating systems
- Apply the no-show policy to discourage last-minute dropouts and preserve game integrity
- Detect, investigate, and prevent abuse, fraud, and violations of our Terms of Service
04Legal Basis for Processing (GDPR)
Under GDPR Article 6, every processing activity requires a lawful basis. The following sets out our bases for each category of processing:
Contract performance (Art. 6(1)(b))
- Account creation and authentication
- Hosting, joining, and managing games
- In-app messaging between participants
- Displaying your public player profile to other users
Legitimate interests (Art. 6(1)(f))
- Attendance tracking to protect the integrity of the platform and other users' experience
- No-show policy enforcement to maintain community reliability
- Community ratings and reviews to enable informed participation
- Security monitoring, fraud detection, and abuse prevention
Consent (Art. 6(1)(a))
- Push notifications and game reminders — you may withdraw consent at any time via Profile → Settings → Notifications
- Location access — you may revoke this at any time via your device Settings → Privacy → Location Services
- Optional profile content including photo, bio, and gallery — provided voluntarily and removable at any time
Legal obligation (Art. 6(1)(c))
- Responding to lawful requests from regulatory or law enforcement authorities
- Retaining records required by applicable Italian or EU law
05Third-Party Services
SportSync uses the following trusted sub-processors. Each processes your data securely and in compliance with applicable privacy law.
Your profile, game data, messages, attendance records, and uploaded photos are stored on Supabase's infrastructure. Row-level security ensures users can access only their own data.
Delivers push notification reminders to your device via Apple APNs. Your device push token is stored only if you enable notifications in Settings.
The app is distributed via the Apple App Store, subject to Apple's own Privacy Policy and App Store terms.
In-app maps for game locations are rendered using map tile imagery from OpenStreetMap. Loading a map screen sends the visible map area and your device's IP address to OpenStreetMap's tile servers to retrieve the relevant tile images.
Game detail screens display weather forecasts sourced from Open-Meteo, an open-source weather API. No personal data is sent to Open-Meteo — only game coordinates are transmitted to retrieve local weather.
06Location Data
We request "When In Use" location permission. Your device's location is accessed only whilst SportSync is open in the foreground. We do not track your location in the background or when the app is closed.
Location data is used to display nearby games. Your precise GPS coordinates are not permanently stored on our servers. Only a general city-level location derived from reverse-geocoding your coordinates may be saved to your profile to show other users your general area.
07Photos and Media
Photos you upload — your profile picture and optional gallery images — are stored securely on Supabase Storage and displayed to other SportSync users as part of your public profile.
We request camera or photo library permission only at the moment you choose to upload a photo. We do not scan, index, or access your photo library in the background or for any purpose other than the upload you explicitly initiate.
You can remove any uploaded photo at any time by editing your profile. Deleted photos are permanently removed from our storage within 24 hours.
08International Data Transfers
SportSync is operated from Italy and your data is processed within the European Economic Area (EEA) where possible. However, some of our sub-processors may process data in countries outside the EEA, including the United States.
Where data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V. These include Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions by the European Commission for the destination country, and certification under recognised privacy frameworks such as the EU-US Data Privacy Framework.
You may request a copy of the safeguards applicable to any specific transfer by contacting support@sportsyncc.com.
09Automated Decisions and Profiling
SportSync uses limited automated processing to enforce fair-play rules:
- Automated no-show suspension: If a user accumulates 2 or more recorded no-shows within a single calendar month, the system automatically applies a 14-day suspension from joining new games. This decision is triggered by attendance records submitted by game hosts.
- Community rating calculation: Your player rating and host rating are calculated automatically as the arithmetic mean of ratings submitted by other users after games you participated in or hosted.
- Player suggestions and game matching: The people and games shown to you (for example on the Discover and map screens) are ranked automatically using non-generative algorithms based on factors such as your selected sports, skill levels, location, and stated availability.
These automated processes have a significant effect on your use of the Service. Under GDPR Article 22, you have the right to request human review of any automated decision that significantly affects you. To exercise this right, contact support@sportsyncc.com within 14 days of the decision.
Artificial intelligence disclosure.
SportSync uses only conventional, rule-based and statistical algorithms to calculate ratings, enforce fair-play rules, and rank suggestions. SportSync does not use generative artificial intelligence to create profiles, messages, reviews, or other content shown to you, and does not deploy chatbots or automated agents that impersonate real people. Every profile, message, and review on the Service is created by a real human user. We do not use your personal data to train third-party generative-AI models.
10Local Storage and Device Data
SportSync stores certain data locally on your device using React Native's AsyncStorage. This local storage is used to:
- Cache your profile information, game listings, and chat threads for faster app loading
- Remember your app preferences, including colour scheme and language
- Track which games are pending a rating so you are reminded after a game ends
- Persist your authenticated session between app launches
This locally stored data is not transmitted to any third party, remains on your device only, and is automatically cleared when you log out or delete the app. SportSync does not use browser cookies, as it is a native mobile application. No tracking pixels or similar technologies are used.
11Data Retention and Deletion
We retain your personal data for as long as your account is active and for such additional period as may be required by applicable law. When you delete your account via Profile → Settings → Delete Account:
- Your profile, personal information, and uploaded photos are permanently deleted within 24 hours
- Your authentication credentials are removed from Supabase Auth immediately upon account deletion
- Games you hosted are anonymised — your name is detached from the game record
- Messages you sent in group chats may be anonymised rather than deleted, to preserve conversation context for remaining participants
- Ratings and reviews you submitted are permanently unlinked from your identity and may be retained in aggregated, anonymised form
12Your Rights Under GDPR
If you are located in the EU, EEA, or United Kingdom, the GDPR gives you the following rights over your personal data. All rights may be exercised free of charge by contacting support@sportsyncc.com:
- Right of access (Art. 15): Request a copy of all personal data we hold about you
- Right to rectification (Art. 16): Ask us to correct any inaccurate or incomplete personal data
- Right to erasure (Art. 17): Request deletion of your personal data where it is no longer necessary or processing is unlawful
- Right to restriction (Art. 18): Ask us to pause or restrict processing of your data in certain circumstances
- Right to data portability (Art. 20): Receive your personal data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing carried out on the basis of legitimate interests
- Right to withdraw consent (Art. 7(3)): Withdraw consent for notifications or location access at any time via Profile → Settings
- Right to lodge a complaint: You have the right to lodge a complaint with your national supervisory authority. In Italy: Garante per la Protezione dei Dati Personali — garanteprivacy.it
13Security
We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, use, alteration, or disclosure:
- All data in transit between the app and our servers is encrypted using HTTPS/TLS 1.2 or higher
- Row-level security policies enforced at the database level ensure users can only read and modify data they are authorised to access
- Passwords and authentication tokens are managed entirely by Supabase Auth — we never store plain-text credentials
- Production database access is restricted to authorised personnel only, using role-based access control
- User photo storage buckets are private by default, with access controlled via signed URLs
No security system can guarantee absolute protection. If you believe your account has been compromised or you become aware of a security vulnerability, please notify us immediately at support@sportsyncc.com.
14Children's Privacy
SportSync is not directed at, and is not intended for, children under the age of 16. We do not knowingly collect personal data from any person under 16. Our Terms of Service require all users to confirm they are at least 16 years old at the time of registration.
If you are a parent or guardian and have reason to believe your child has created a SportSync account without your consent, please contact us immediately at support@sportsyncc.com. Upon verification, we will promptly suspend the account and permanently delete all associated personal data.
15Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in the app's features, our data practices, our sub-processors, or applicable law. When we make material changes, we will update the effective date shown at the top of this page and send you an in-app notification or email where the changes materially affect your rights or how we process your personal data.
Your continued use of SportSync after the effective date of a revised policy constitutes your acknowledgment of the changes. We encourage you to review this policy whenever you update the app or have questions about how your data is used.
16Contact Us
For privacy questions, data subject rights requests, or to contact the Data Controller:
We aim to acknowledge requests within 72 hours and respond fully within 5 working days.
Data Controller: SportSync — Italy
Supervisory authority: Garante per la Protezione dei Dati Personali (garanteprivacy.it)