Privacy Policy

1. Who we are

Gameset is a sports community platform based in Greece. We are the controller of personal data processed through the Service. To contact us, write to info@gameset.gr.

2. What we collect

Information you give us when you create an account or use the Service:

• Account details — email, name, password, or a Google or Apple account identifier if you sign in with Google or Apple.
• Profile information — preferred position, city, avatar, and any other details you choose to add.
• Content you post — messages, lobby names, team names, and similar.
• Game and activity data — matches played, ELO rating, win/loss record, MVP awards, streaks, and other statistics generated by your use of the Service.
• Technical data — IP address, device type, operating system, app version, approximate location derived from your IP, and a device push‑notification token (via Expo) if you enable notifications, used to operate and secure the Service.
• Information from third parties — if you sign in with Google, Google shares your email and basic profile (name, profile picture). If you sign in with Apple, Apple shares your name and email, or a private relay address if you choose to hide your email; messages we send to that relay address still reach you.

3. Why we use your information

We process your information to:

• Provide and improve the Service — matchmaking, rankings, profile sync.
• Communicate with you about service updates, security notices, and — with your consent — marketing.
• Prevent fraud, abuse, and violations of our Terms.
• Comply with legal obligations.

4. Legal basis (EEA / UK users)

Under the GDPR, we rely on the following legal bases:

• Performance of a contract — to provide the Service you signed up for.
• Legitimate interests — to improve and secure the Service, prevent fraud.
• Consent — where we ask for it specifically (e.g. optional analytics via PostHog, marketing emails, push notifications). You may withdraw at any time without affecting prior lawful processing.
• Legal obligation — where required by law.

5. Who we share with

We share personal data only with:

• Service providers — Amazon Web Services (hosting, and storage of profile and venue photos in S3) and Expo (delivery of push notifications to your device), under contractual safeguards.
• Sentry — crash and error reports from the app and website, so we can find and fix bugs. Sentry is hosted in the EU (de.sentry.io) and receives a stack trace, device and OS details, a request id, and your athlete id and handle — never your email, name, phone number, card data, or IP address. Basic crash reporting runs by default and you can turn it off in Settings → Privacy; more detailed crash diagnostics — extra steps leading up to the crash, plus device details — are only sent if you separately turn that on, and you can withdraw it at any time in the same place.
• PostHog — product usage analytics, and, only if you separately turn it on, masked session replay (a recording of the seconds before an error, with every text and image masked). PostHog is hosted in the EU (eu.i.posthog.com) and, like Sentry, receives only your athlete id and handle. Both are off until you choose to turn them on in the app, and you can withdraw that choice at any time in Settings → Privacy. Sentry and PostHog each keep this data for the period stated in their own EU data processing terms.
• These are the only crash‑reporting and analytics processors we use.
• Other users — profile information you choose to make visible (name, avatar, position, ELO) is shown to users you interact with.
• Authorities — when required to comply with valid legal process or to protect our rights, safety, or property.
• Successors — in connection with a merger, acquisition, or sale of assets, with standard safeguards.
• We do not sell personal data.

6. International transfers

Some service providers operate outside the European Economic Area, including in the United States. When we transfer your personal data outside the EEA, we use safeguards such as the European Commission’s Standard Contractual Clauses or transfers to providers certified under recognised frameworks.

7. How long we keep your information

Deleting your account: you can delete your account at any time in the app, under Settings › Danger Zone. Deletion immediately removes your profile, photo, and personal account data, and disables sign‑in. We retain your match scores and reviews with your identity removed (anonymised), so other users’ match history and ratings stay accurate, and any records we are legally required to keep, such as transaction records for accounting and tax purposes, for the period the law requires.

• Account data — while your account is active, plus a reasonable period to handle disputes and meet legal obligations.
• Match history and statistics — retained while your account is active; anonymised after deletion as described above.
• Logs and technical data — typically up to 12 months for security and abuse‑prevention purposes.
• You can delete your account at any time — see “Deleting your account” above, and Your rights below.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), subject to exceptions.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
• To exercise these rights, email info@gameset.gr, or delete your account directly in Settings › Danger Zone. We respond within one month.

9. Local storage and cookies

Our website uses the browser’s local storage to remember your language preference. We do not use third‑party tracking cookies on the website. When enabled, we use PostHog (EU-hosted) for cookieless product analytics: it runs in memory only, sets no cookies, and does not persist across visits. The mobile app stores authentication tokens securely on your device (iOS Keychain / Android Keystore equivalents).

10. Children

The Service is intended for users aged 16 and older. We do not knowingly collect data from children under 16. If you believe we have collected data from a child, contact us at info@gameset.gr and we will delete it.

11. Security

We protect personal data with industry‑standard measures, including encryption in transit and at rest, access controls, and regular reviews. No method is 100% secure; we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. For material changes we will notify you in the Service or by email at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

Questions, complaints, or requests: info@gameset.gr