Privacy Policy

Bridge2Things Automation Process GmbH, Annagasse 6, 3. Stock, 1010 Wien, Österreich, e-mail: office@matchupsports.app. No data protection officer has been appointed (not legally required). Please send privacy requests to office@matchupsports.app.

This policy covers our website matchupsports.app and the MatchUp app in its current version (MatchUp V2). What concerns only the website is in the section “This website”; all other sections describe the app.

This privacy policy tells you how we handle your data. You do not have to agree to it: when you sign up you only confirm that you have read it. We ask separately for your consent to the newsletter.

Hosting and server logs: The website matchupsports.app is a static website on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor. When you open a page, Google processes the data technically needed for it: IP address, date and time, the address requested and your browser details (user agent). This serves delivering the website and running it securely (legitimate interest, Art. 6(1)(f) GDPR). Processing may take place in the USA; it is safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework. More: Firebase Privacy.

No cookies, no analytics: The website sets no cookies and uses no analytics, tracking or advertising tools. We serve the fonts ourselves; your browser loads nothing from Google Fonts. In your browser we store only one technical marker, which never reaches us: that the intro animation has already played in this tab (mu-intro-seen in sessionStorage, cleared when you close the tab). The language follows from the address (/de or /en) and is not stored.

Links to the app stores: The App Store and Google Play buttons are plain links. The link matchupsports.app/app, which you can share from the app, for example, checks in your browser from the user agent whether you use an iPhone, iPad or Android device and sends you straight to the matching store; on a computer it shows both buttons. This check runs only in your browser: apart from the normal page request nothing reaches us, and there is no tracking. In the App Store and on Google Play, Apple’s and Google’s privacy terms apply.

Event pages: If you open an event page with a code (matchupsports.app/en/event?code=…), your browser asks our database service Supabase (Frankfurt data centre, EU) directly for the event data. Supabase receives your IP address, your user agent and the code (legitimate interest in showing the event, Art. 6(1)(f)). No other page of the website makes such a connection.

E-mail to us: If you write to us at office@matchupsports.app, for example with a question, a privacy request, a report or a complaint, we process your e-mail address and the content of your message to deal with your request (legitimate interest, Art. 6(1)(f); where it concerns your account, performance of the contract, Art. 6(1)(b); for privacy requests, our legal obligation, Art. 6(1)(c)). We keep the e-mails until your request is settled, unless a statutory retention period applies.

Account: e-mail address, password (stored encrypted only), username, date of birth (to check that you are at least 18 and, only if you switch it on, to show your age in years on your card; nobody sees the date itself; if you gave only your age earlier or had it corrected, an approximate date worked out from it), gender, city, time zone, profile photo, bio, your newsletter choice with the date of your consent, when and which version of the terms you accepted and when you were last active. Optional: how you found MatchUp (social media, friends or QR code). To protect your account, the sign-in service stores your sessions with IP address and device. We do not collect a full name.

Sign-in with Google or Apple: if you choose “Continue with Google” or “Continue with Apple” (iPhone only), you sign in with Google or Apple. Our sign-in service (Supabase) then receives your e-mail address, the identifier of your Google or Apple account and, from Google, your name and profile picture link. We store the name and picture link only there, do not show them, do not copy them into your profile and delete them with your account. From Apple we only request the e-mail address, not your name. If you choose “Hide My Email” with Apple, we only receive a forwarding address from Apple, and our sign-in e-mails reach you through it. There is no password then; you enter the other details as in the e-mail sign-up. If you sign in with Apple, our server exchanges a one-time code from Apple for an Apple token and stores it on the server only, never in the app. We use it solely to tell Apple, when you delete your account, that MatchUp no longer has access (revocation); for this the token is sent back to Apple. It is deleted with your account. Google and Apple process your sign-in with them under their own responsibility and learn that you sign in to MatchUp. Their privacy policies apply to this: policies.google.com/privacy and apple.com/legal/privacy.

Sport: your sports with level.

Using the app: swipes, likes, matches and friendships; chats with their text and whether a message was read; meetings with sport, time and place; whether a meeting took place; star ratings with an optional comment; multiplayer games; for ranked, your rating (MatchupPoints, MP), results, rankings and searches, your check-in at a ranked meeting (“I am here” with its time, seen by the players of that meeting; after a block not by the other side), and your teams (for example padel 2v2) with team name, members and team rating, and the sport Ranked opens on for you; for chess at a partner café, your board booking (café and time) and a photo of the board after the game (Proof of Game); blocks, reports and requests to correct your age or gender. We send you a welcome message in the app chat; what you write there is read by the MatchUp team to improve the app, and you can delete the chat for yourself like any other chat.

From other users: reports about you, star ratings and ranked results your opponents enter.

Calendar: if you add a meeting to your calendar or switch on “Add meetings to my phone calendar”, the app writes confirmed meetings directly on your device. The setting stays on your device. We do not read any entries from your calendar (on Android the app only sees the list of your calendars, to find the main one).

Map: when you pick the place for a meeting, the app shows a map: Apple Maps on the iPhone, Google Maps on Android. Your phone loads the map tiles directly from Apple or Google; they receive your IP address and the area shown, but not your account. Apple and Google process this data under their own responsibility. Only if you tap “My location” on the map does your iPhone ask whether the app may use your location while you use it. If you allow it, your iPhone shows your location as a dot on the map and centres the map on it; this happens only on your device. We do not receive or store your location. Because the map then loads the area around you, Apple learns which area you are looking at. You can withdraw the permission at any time in the iPhone settings. Searching on the map (district, street, place) also runs only on your device. The app remembers the last map area shown on your phone (after “My location” that is the area around you, rounded to about 100 m) so the map opens there again; it is never sent to MatchUp and is deleted when you sign out. On Android there is no “My location”: the app does not use your location there. On the web the app shows a list instead, without location.

Notifications: if you allow push notifications, we store your device’s push token with its platform (iOS or Android). We also store which kinds of notifications you want, in which language, and the notifications sent to you with title, text (for example the start of a chat message) and whether they were delivered. When you sign out, we remove this device’s token.

Technical: events in the app (for example a new match or a ranked search), error reports and performance data. On your device we store only what the app needs to work (for example your sign-in, your language and which hints you have already seen). We use no cookies or trackers from advertising or analytics providers. We do not receive or store your location (for “My location” on the iPhone see Map).

App updates: Each time it starts, the app asks Expo’s update service (EAS Update) whether a fix is available for its version, downloads it in the background if so, and uses it from the next start. Expo receives your IP address, the platform (iOS or Android), the app version, the update channel, the IDs of the installed updates and a random installation ID that the app creates on your device for this purpose; after a crash at start-up, also the technical error message. Expo does not receive your account, your name or any content from the app. The legal basis is our legitimate interest in fixing errors quickly without a store update (Art. 6(1)(f) GDPR).

For protected admin access, Supabase Auth processes the TOTP setup secret, factor status and setup time. This serves account security based on our legitimate interest (Art. 6(1)(f) GDPR); the data is kept until the factor is removed or the account is deleted. Only the person setting up the factor receives the setup secret; opening their chosen authenticator app passes it to that app. One-time codes are sent to Supabase Auth for verification during admin access and password recovery.

With the pictured person’s withdrawable consent, the tutorial shows a photo bundled locally in the app under the fictional name “Martin”. The name, age and profile details are examples; the photo is not sent to our database service. Consent can be withdrawn via office@matchupsports.app; we remove the photo in an app update. Older installed versions may retain it until updated or uninstalled.

E-mail address, password (not when you sign in with Google or Apple), username, date of birth, gender, city and profile photo are required. Without them we cannot create an account. To find people and play you also need at least one sport with a level. Everything else is optional.

To run the app (contract, Art. 6(1)(b) GDPR): show your profile, suggest people in the city and with the sports you pick, make chats, meetings, multiplayer games and ranked possible. The protected space and games for women and non-binary people only use the gender you entered.

Safety and improvement (legitimate interest, Art. 6(1)(f)): review reports, prevent abuse, ban accounts, fix errors and analyse how the app is used, including how people find MatchUp.

We send the newsletter only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

Your full profile, including your bio, sports and levels, is visible only to you, admins and your swipe matches. A Ranked or Multiplayer chat alone does not grant access. In a 1:1 chat without a swipe match, for example from Ranked or Multiplayer, the other person sees only the sports you both play, each with your level, so that you can propose a game or a meeting together. Others see your card with your name, photo and the sport and level shown there. Until older app versions are excluded, your bio remains readable through the previous profile interface by people who can see your card. Your age is shown only if you enabled it. Unmatching ends profile access. Depending on the feature, cards also show your username, photo, average stars, match count and, to other ranked players, your MP. When swiping, people can pick a city and see who plays there, so others can tell which city you are in. If you pick a city other than your own while swiping, we store that city with the date so people there also see you while swiping for 7 days; they can then also tell that you are swiping there. When you pick your own city again or the 7 days are over, we delete it, at the latest with your account. Others see your age only if you switch on “Show my age to others”: then only in full years (never your date of birth) next to your name, and only people you meet in the app (anyone who sees your card while swiping, that is anyone swiping in your city or, for 7 days, in the city you swipe in, your matches and chats, your Ranked opponents and people who can see your Multiplayer game). Without your agreement your age stays hidden. We ask you (when you sign up, otherwise once in the app on this device; after “Not now” at most one more time a few days later); you change it at any time under Profile → Edit profile → Privacy & legal. They do not see your e-mail address, gender or individual ratings. An individual rating is visible only to the person who gave it. Chat partners see whether you have read their messages.

Protected space: women and non-binary people can use the protected space; for them it is on by default. Then only women, non-binary people and people you already have contact with (friendship, shared chat, shared multiplayer game, a ranked proposal or match against each other, a shared ranked team) see you. To everyone else you are invisible: in swiping, in profiles, photos, sports and player lists. On leaderboards they see you without name, photo or city, and in a multiplayer game as a “taken” spot. If you are in the same mixed game, you see each other. When swiping you also only see women and non-binary people.

Ranked: if you play Ranked, everyone else who plays Ranked sees you on the leaderboard of your sport in your city, in the city you search in and in every city where you played a confirmed match: your username, photo, city, position, rating, wins and losses. If you searched in a sport in the last 30 days but have no confirmed match there yet, you are listed with name, photo and city under “Not ranked yet”. If you are in Ranked but have never searched, you see the others but are not on any list yourself yet. People who do not play Ranked themselves (including those who only watch) see the leaderboard only with positions and ratings, without names, photos or cities. You cannot hide yourself: to stop being visible, leave Ranked. Then you disappear from the leaderboards; your rating is kept. If you only watch, you are on no leaderboard. If you play ranked in a team, other Ranked players see the team name, team rating and members on the team leaderboard. If you accept a team invite, you become active in Ranked for that sport. Only the members see your teams and invites.

Multiplayer: while a game is open, full or scheduled, people from any city whose sport and level fit and who pick the game’s city in the list (their own is preselected) see the game with the players’ names and photos and the time. After that only its players see it. Players in a game can invite their matches: the invite arrives as a message in your chat and names the game’s sport, format and time. The list shows all your matches; those who can’t join are greyed out with a general note (e.g. “Doesn’t play padel”) that reveals neither gender nor blocks. People you blocked or who blocked you are not listed. Chat partners and fellow players see your shared messages and meetings.

Chess board photo (Proof of Game): after a chess game the app asks for one photo of the board, taken with the camera (never from your photo library). It is required for a Ranked chess result and optional for a friendly game. Only the two players of that game and our team (to check disputed results) can see it. Please photograph only the board, no faces. The app uses the camera only when you tap to take this photo; you can withdraw the permission at any time in your phone’s settings. Partner cafés see no photos and no names.

Profile photos are only available to signed-in users. Our team sees reports and the data it needs to review them. Every team decision is logged.

Service providers (processors): Supabase Inc. (sign-in, database, storage and sign-in e-mails; Frankfurt data centre, EU; subprocessors include AWS), Resend by Resend, Inc., USA (sends Supabase’s sign-in e-mails, for example confirmation and reset codes, to your e-mail address), Sentry by Functional Software, Inc., USA (error reports and performance data, without name, e-mail address or IP address; stored in Frankfurt, EU), Expo by 650 Industries, Inc., USA (forwards push notifications with push token, title and text to Apple or Google, and delivers app updates), Apple (app distribution and push notifications on iPhones) and Google (push notifications on Android via Firebase Cloud Messaging). Data processing agreements under Art. 28 GDPR are in place or being concluded with these providers. We do not send a newsletter yet; we only store your choice with the date of your consent. Before we send the first newsletter, we will name the service it runs on here.

Your data is stored in the EU. Supabase Inc. is based in the US, and its support may access the systems from the US in individual cases. The European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in Supabase’s data processing agreement apply to this. Sentry also stores error reports and performance data in Frankfurt (EU); Functional Software, Inc. is based in the US, however, and may access them from the US in individual cases. With Resend, Expo, Apple and Google, processing may take place in the USA. For Sentry, Resend, Expo, Apple and Google, this is safeguarded by EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. For sign-in with Google or Apple, however, Google and Apple act as controllers of their own within your account with them; their own terms and safeguards apply there, not our Standard Contractual Clauses. Copies of the safeguards are available on request at office@matchupsports.app.

Default rule: anything without its own period below (for example meetings, multiplayer games, ratings and your ranked history) is kept as long as your account exists and deleted with it.

You can delete your account at any time under Profile → Edit profile → Account → Delete account. Deleted immediately: profile, sports, swipes, likes, matches, friendships, ratings, blocks, reports against you, open requests, your ranked ratings and your teams. Your profile photos go into the deletion queue at once and are removed from storage on the next run. This deletion run takes place every hour.

What stays with others: your messages then show “Deleted user” and stay with your chat partners until the chat is deleted under the periods below or no longer exists for them. Ranked results stay without any link to you so your opponents keep their rating. Reports you made and in-app events stay without any link to your account. Notifications others received about you (for example the start of your message) stay with them for at most 90 days.

Chats: after an unfriend we delete the chat’s messages 30 days later, even if a meeting was still open then. Ranked chats between people who are not friends leave the list 7 days after the match; we delete their messages 30 days after the last match ended, once no meeting is open any more. Group chats of multiplayer games and team matches are emptied 30 days after the game ended; a finished game nobody is left in is deleted completely. If an open report concerns a chat, we wait until it is decided. If one of you blocks the other, the chat leaves both lists at once and we delete its messages 30 days after the block. If the other person deletes their account, you can still read the chat for 30 days; then we delete it. If you delete a chat in your chat list, it and its messages so far disappear for you only; the others keep it, and if someone writes again, it comes back with the new messages. For this we only store when you deleted it; the messages themselves are deleted under the periods here. If you delete a 1:1 chat, meetings with this person that can still be cancelled without penalty are cancelled, and the other person is notified. An open Ranked match between you that has not started yet ends without a rating change.

Push tokens and your notification settings are deleted with your account; a token that is no longer valid is deleted right away. The notifications sent to you are deleted after 90 days, at the latest with your account.

Other periods: chess board photos after 30 days (if the result is disputed, only once our team has decided; if you delete your account, a photo you took stays with the game until then, without any link to you), in-app events after 13 months, decided reports and age requests 12 months after the decision, the log of team decisions after 3 years, your daily stored leaderboard positions (for the change since last week, visible only to you) after 28 days. Sign-ups whose e-mail address was never confirmed are deleted after 7 days. If you sign in with Google or Apple and do not submit the profile form, we delete the account 7 days after your last sign-in. Sentry deletes error reports automatically after 90 days at the latest.

If three different people who have already had contact with you (a friendship, a shared chat, a shared Multiplayer game, a shared Ranked team, or a Ranked proposal or match against each other) report your profile, it is hidden automatically until our team has reviewed the reports. Our team also reviews reports from people without such contact, but they do not hide a profile automatically. The app tells you when this happens. If you report someone (while swiping, in a chat or on their profile), the app also blocks that person for you. When usernames, bios, team names, messages and free-text meeting places are saved, the server automatically checks them for offensive words and refuses them if they contain one (legitimate interest, Art. 6(1)(f)). In ranked, the app calculates your rating automatically from results. The app proposes opponents automatically by sport, mode, city and MP; it proposes your last opponent again only when nobody else fits and one of you has been searching for several hours. Results can only be entered after the meeting has started. If only one side reports a result, it counts 24 hours after the meeting started, but no sooner than 24 hours after the report. If nobody reports a result, the match ends 48 hours after the meeting started without a rating change. A late cancellation can count as a loss. If you block someone before your Ranked match starts, it ends without a rating change; after the start the result still counts. The started meeting then stays visible to both of you until the match is decided; neither of you sees the other side’s check-in time. Blocking never counts as a loss. With check-in, a result can only be entered once both sides have tapped “I am here” (from 30 minutes before to 30 minutes after the start; in a team one player is enough). If only one side has checked in by then, it wins automatically; if nobody has, the match does not count. For chess at a partner café the window runs from the start to 15 minutes after it, and if a side has not checked in the match never counts (no automatic win). A Ranked chess result can only be entered with the board photo. After a block, neither of you sees whether the other side has checked in, and the result can only be entered once check-in has closed. A ban is always decided by a person. The app takes no decision with legal effect within the meaning of Art. 22 GDPR. You can ask for any of these decisions to be reviewed via office@matchupsports.app; how complaints about moderation decisions work is set out in the Terms.

When a player reports a Ranked result, including a draw, we record that all participants who have not yet answered met; earlier answers are preserved. We store draw reports as result reports. When both players confirm a draw, the match is voided without changing MP. An unanswered draw report also ends the match without changing MP once both result-reporting windows above expire.

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of your consent with effect for the future. You can download a copy of your data in a common, machine-readable format (JSON) yourself under Profile → Edit profile → Privacy & legal → Request my data. You change your username under Edit profile, the newsletter under Edit profile → Notifications, your age and gender through “Request a correction”. For everything else write to office@matchupsports.app; we reply within one month. You can lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna (dsb.gv.at).

Where we process data based on our legitimate interest (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Write to office@matchupsports.app. We then stop, unless we have compelling legitimate grounds, such as the safety of other users.

If you choose a sport that is not yet available during setup or in Edit profile, we save your sport wish privately for you. When it becomes available, we ask in the app whether you want to add it with a level you choose. The team sees only the number of wishes per sport, without names. The wish is included in your data export and deleted after your answer or after adding the available sport, when you remove it during setup or in Edit profile, or when you delete your account.

Our internal dashboard uses aggregate usage figures and pseudonymous aliases to help improve MatchUp (legitimate interest, Art. 6(1)(f) GDPR).

To welcome and support new members, we send your city and the total account count to the team’s internal Discord channel. If you answered the optional “How did you find MatchUp?” question, we add only the generic category Social media, Friends or QR code, never free text or your username. We delete our delivery ledger after 90 days; this does not automatically delete messages already sent to Discord.

Your answer to “How did you find MatchUp?” is optional. You can delete it under Profile → Edit profile → Privacy & legal → Remove how I found MatchUp.

If you had an account in the previous version of the app (MatchUp V1), we moved it into this version on 27 October 2026, so you do not have to sign up again. The source of this data is your MatchUp V1 account. The controller is the same company, and the data stays with Supabase in Frankfurt (EU).

We moved your sign-in (e-mail address with your previous password, stored encrypted only, and the link to Google or Apple), username (with a number added if it was already taken; a neutral name if it contained an offensive word), date of birth, gender, city, bio (unless it contained an offensive word), profile photo, your sports with level (where this version offers them), your newsletter choice, when you accepted the V1 terms, and your blocks. We did not move chats, matches, friendships, star ratings, reports, your Ranked ratings, your meetings or your full name.

The legal basis is the continuation of your contract with us (Art. 6(1)(b) GDPR) and our legitimate interest in letting you move without signing up again and in keeping your blocks to protect you (Art. 6(1)(f)).

Others only see your moved profile once you open the app and finish setup; after that we ask you to accept the terms of this version. Anyone who did not want the move could delete their V1 account beforehand; we did not move deleted accounts.

For the move we store which accounts we moved and, as proof, the times of your consents in V1 (newsletter and terms). If you delete a moved account, we keep only its identifier until the move is closed, so that it is not created again. We delete these move records once the move is closed, expected 30 days after 27 October 2026.