Privacy Policy

Bridge2Things Automation Process GmbH, Annagasse 6, 3. Stock, 1010 Wien, Österreich · Email: office@matchupsports.app. No data protection officer has been appointed (not legally required). Please send privacy requests to office@matchupsports.app.

This website runs on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access the site, technically necessary data is processed (IP address, date/time, page requested, browser/user-agent) to ensure secure and stable operation. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Details: Firebase Privacy.

This website sets no cookies and uses no analytics or tracking tool. Only one technical setting is stored on your device and never transmitted to us: a marker that the intro animation has already played, under mu-intro-seen in sessionStorage. Your language choice is not stored — it follows from the URL. Fonts are served locally; no request is made to Google Fonts.

If you open an invitation or event page with a code, your browser requests the corresponding event data directly from our backend, Supabase. This transmits your IP address, your user agent and the invitation code to Supabase. The legal basis is our legitimate interest in displaying the invitation (Art. 6(1)(f) GDPR). Apart from this and the waiting-list form (see the next section), all pages of this website are static and make no such connection.

The app has not been released yet. If you sign up using the form on this website, we store your email address, the language you were reading the site in, whether the signup came from the home page or an event page, the event code where applicable, and the time of the signup. Submitting the form also transmits your IP address and user agent to our backend Supabase (servers in the EU). The purpose is one single message when MatchUp is in the store — no newsletter, nothing passed on to third parties, no profiling. The legal basis is your consent (Art. 6(1)(a) GDPR); you may withdraw it at any time with effect for the future (Art. 7(3) GDPR), informally by email to office@matchupsports.app. We delete your address once the launch message has gone out, and at the latest three months after launch.

Using the app requires an account. We process your email address, display name/profile details, password (as a hash only) and date of birth. You state your date of birth yourself and it is stored; it is not checked against an ID document or any other proof. Alternatively you can sign in via “Sign in with Apple” — if you use Apple’s Private Relay, we receive an anonymised forwarding address instead of your real one. Sign-up, confirmation and password-reset emails are delivered through Supabase’s mail service. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). One account per person is permitted; a pseudonymous session identifier is processed to enforce this.

You may optionally add a profile picture, a short bio, a home city and a social media handle (Art. 6(1)(a) GDPR). For the profile picture we access your camera and photo library with your permission. The file is stored in our Supabase storage in the EU. Please note that image files can contain metadata written by your camera — such as capture time or GPS coordinates. Your profile picture is visible to other players; choose it accordingly.

To find nearby players and venues we process your location — only after you grant the device permission (Art. 6(1)(a) GDPR). Coordinates are rounded and transmitted only when you actively mark yourself as available to play; venue check-ins expire automatically after 24 hours. Maps are rendered on every platform — including iOS — via Google Maps (Google Ireland Limited and Google LLC, USA), which transmits your IP address and the map viewport to Google. You can withdraw the location permission at any time in your device settings.

Match results and game history are processed to provide the service (Art. 6(1)(b) GDPR). Because a match always involves two people, we also receive information about you from your opponent (Art. 14 GDPR) — for example the reported result.

After a confirmed match you can report the other person. We store the category (no-show, unsportsmanlike conduct or a false result report), the link to the match, and who reported whom and when. If you write to office@matchupsports.app instead — about discrimination, bullying, harassment or threats, for example — we process the details you give in that message. Because a report always concerns another person, the person reported receives information about themselves from a source other than themselves (Art. 14 GDPR).

Every report is reviewed by a human being. If it checks out, the person reported is blocked from matchmaking for a set period or their account is closed; we notify them of the decision and give reasons. No decision is taken solely by automated means within the meaning of Art. 22 GDPR. The legal basis is performance of a contract and our legitimate interest in a functioning community (Art. 6(1)(b) and (f) GDPR). Objections and complaints go to office@matchupsports.app.

Separately, you can block other people. For this we store who has blocked whom; the person blocked is not told. The legal basis is our legitimate interest in a platform where people can stay out of each other’s way (Art. 6(1)(f) GDPR).

If you write to office@matchupsports.app — as a support request, to exercise your rights as a data subject, as a report or as a complaint against a decision — we process your email address and the details you give in your message. The purpose is solely to deal with your request. The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), performance of a contract where the request relates to one (Art. 6(1)(b) GDPR), and our legal obligation in the case of data protection requests (Art. 6(1)(c) GDPR).

Messages between two players are processed and stored to enable communication (Art. 6(1)(b) GDPR). Delivery happens in real time over a WebSocket connection to Supabase. Messages are deleted automatically after 12 months. Message content is not screened — neither automatically nor by us.

With your permission, MatchUp writes confirmed matches to your device calendar and updates or removes those entries again (Art. 6(1)(a) GDPR). Entries contain the time, place and the name of your opponent. Calendar data stays on your device or in the calendar account you selected; we do not read your calendar.

With your consent we send push notifications (Art. 6(1)(a) GDPR). For this we store a push token together with your user ID, the platform and the device model. Delivery runs through the Expo Push Service (Expo Inc., USA) and from there to Apple (APNs). Notification text may contain the names of fellow players and match times. You can disable push at any time in your device settings.

For app stability we use Sentry (Functional Software, Inc., USA). Data is received and stored via the EU endpoint in Germany. We process:

• Technical diagnostic data: device type, OS, app version, error messages and stack traces
• Log messages and performance measurements for a share of sessions
• Session Replay: a recording of the screen content and your interactions. Roughly 10% of all sessions are recorded, plus sessions in which an error occurs. Input fields and text are masked by Sentry; even so, a recording can allow inferences about how you use the app.
• Once you have given consent, additionally your IP address, user agent and user ID

The legal basis is your consent (Art. 6(1)(a) GDPR), given on first launch and revocable at any time with future effect in the app under “Settings → Privacy”. Sentry data is deleted after 90 days. We also use Sentry to understand in pseudonymous form which app features are used; no profiling or advertising takes place.

On every launch the app checks for a new version via EAS Update (Expo Inc., USA). This transmits your IP address, device, operating system and installed version. The legal basis is our legitimate interest in shipping bug-fixed versions (Art. 6(1)(f) GDPR).

• Supabase Inc. – backend, database, authentication, storage and mail delivery (region: EU, Frankfurt; sub-processors include AWS)
• Google Ireland Limited – Firebase Hosting for this website and the web app, and Google Maps
• Functional Software, Inc. (Sentry) – error, crash and stability monitoring incl. Session Replay (EU ingest)
• Expo Inc. – push notification delivery and app updates (EAS Update)
• Apple Distribution International Ltd. – app delivery, “Sign in with Apple”, push delivery (APNs)

Data processing agreements under Art. 28 GDPR are in place (or being concluded) with these providers. The minimum age for using MatchUp is 16. In Austria the age at which a person can consent independently is 14 (§ 4(4) DSG); we deliberately set a higher threshold and do not address our service to children.

Our backend (Supabase) and the Sentry endpoint are operated in the EU. With Google, Apple and Expo, processing may take place in the USA. Such transfers are safeguarded by appropriate measures — EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Copies of the safeguards are available on request at office@matchupsports.app.

• Account and profile data: until account deletion, then up to 30 days in backups
• Chat messages: 12 months from the last message
• Reports and the measure taken in response: until the matter is settled, then for as long as a complaint against it is possible (six months from the decision)
• Blocks: until you lift them or either account is deleted
• Email correspondence: until your request has been dealt with, unless a statutory retention period applies
• Venue check-ins: 24 hours
• Profile bio: removed automatically after 2 years of inactivity
• Sentry data incl. Session Replay: 90 days
• Push tokens: until withdrawal or uninstall
• Match data: indefinitely, but anonymised after account deletion — see the next section

So that your opponents’ game history stays complete, match results are not deleted but anonymised when you delete your account: the link to you is removed and the result remains as a record without personal reference. The legal basis is our legitimate interest in the integrity of that history (Art. 6(1)(f) GDPR); Art. 17(3) GDPR remains unaffected. If one of your reports led to a measure, it is kept — without the link to you — for the duration of the complaint window; see “Retention”. All other data is deleted.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with future effect (Art. 7(3) GDPR). You can delete your account anytime in the app under “Profile → Settings → Delete account”. On request we provide a copy of your data in a common, machine-readable format. Send requests to office@matchupsports.app; we reply within one month.

You may lodge a complaint with a supervisory authority — in Austria the Data Protection Authority, Barichgasse 40–42, 1030 Vienna (dsb.gv.at).