Privacy Policy

Last updated: June 14, 2026

Subsoccer Pro ("we", "us", "our") operates the Subsoccer Pro web application and related services. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information.

1. Data We Collect

We collect the following categories of data:

a) Account Data (registered users)

• Email address — used for authentication and account recovery
• Username — chosen by you, displayed publicly on leaderboards
• Avatar — profile picture (uploaded or AI-generated)
• Country — selected by you during registration

b) Game Data

• Match results — scores, player names, timestamps
• Tournament history — brackets, placements, participant names
• ELO rating — calculated from match results

c) Analytics Data (all users, including QR scan visitors)

• Approximate location — city-level, determined from your IP address via a server-side lookup. We do not use GPS or the browser Geolocation API. We do not store your IP address.
• Device type — browser user agent string (e.g., "Safari on iPhone")
• Browser language — your browser's language preference
• Session duration — how long you played
• Session ID — a random identifier that groups your actions within a single visit. It is not linked to your identity and resets when you close the browser tab.
• UTM parameters — marketing campaign tags from the URL (e.g., utm_source), if present

2. How We Use Your Data

• Account Data: To authenticate you, display your profile, and let you participate in leaderboards and tournaments.
• Game Data: To calculate rankings, display match history, and generate player statistics.
• Analytics Data: To understand how the app is used, identify popular regions, and improve the product. Analytics data is viewed only by the Subsoccer team through an admin-only dashboard.

3. Data Storage & Security

• All data is stored in Supabase (hosted on AWS in the EU region).
• All communication is encrypted via HTTPS/TLS.
• Database access is protected by Row Level Security (RLS) policies that restrict who can read or modify data.
• Passwords are hashed with bcrypt before storage. We never store plaintext passwords.
• Authentication is handled by Supabase Auth with industry-standard JWT tokens.

4. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• Supabase — our database provider (processes data on our behalf)
• Netlify — our hosting provider (serves the application)
• Sentry — error monitoring (receives anonymous error reports with sendDefaultPii: false)

We do not use Google Analytics or any third-party advertising trackers.

5. Your Rights

Under GDPR and applicable data protection laws, you have the right to:

• Access — request a copy of your personal data
• Rectification — update or correct your data via your profile settings
• Deletion — delete your account and all associated data. You can do this directly from the app (Settings → Delete Account) or by contacting us.
• Data Portability — request your data in a machine-readable format
• Objection — object to processing of your data

6. Data Retention

• Account Data: Retained until you delete your account.
• Analytics Data: Retained for up to 24 months, then aggregated or deleted.
• Game Data: Retained as part of the public leaderboard for the lifetime of the service.

7. Children's Privacy

Subsoccer Pro does not knowingly collect personal data from children under 13. The QR-code scanning feature (Instant Play) works without any account or personal data collection — only anonymous analytics data is recorded.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date at the top of this page.

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at: