Privacy Policy
This policy explains what Leaguies collects, why, who else sees it, and what happens when you delete your account. It covers the Leaguies mobile app and the Leaguies API.
Leaguies is operated by Andres Arias (doing business as Leaguies) (“we”, “us”), who is the data controller. You can reach us at support@leaguies.app.
1. What we collect
We collect only what the app needs to run a league. There is no advertising and no tracking across other apps or websites. The app does use a first-party analytics system (described in the table below) and a small number of service providers, listed in section 3.
| What | Why |
|---|---|
| Account — your email address, your name, and a password (stored only as a bcrypt hash, never in plain text). If you choose to sign in with Google or Apple (when those options are offered), we store your Google or Apple account identifier instead of a password. | To create your account, sign you in, and send you the emails below. |
| Player profile — your sport and playing positions, and anything you choose to add: a short bio, years played, preferred skill level, date of birth, gender, jersey number, and a profile picture. | So captains and organizers can see who you are. Every field here is optional except the sport. |
| Home area — a free-text location you type, and the latitude and longitude our server may derive from it (the app can also send its own coordinates). To derive them, the text you typed is sent to a geocoding service (Photon, run by Komoot; see section 3). | Only to answer “which leagues and teams are near me”. We store an approximate point for your stated home area, not a trail of where you have been. The app does not track your location in the background. |
| Approximate and precise location — if you allow it, your device’s location while the app is open, used to show nearby players, teams, leagues and places on a map. | Foreground only: we ask only while you are using the app, never in the background, and we do not keep a history of where you have been. Your approximate home area (above) is the only location we store. You can turn location off in your device settings and still use the app. |
| Photos and avatars — a profile, team or league picture you choose to upload from your photo library. | To show on your profile and your teams. We only read the picture you pick; the app does not scan your library. Uploaded images are stored with our hosting provider and shown through a content delivery network. |
| User-generated content — chat messages, and reports or blocks you file about other users or content. | To deliver messages, and to let us review reports, remove abusive content and suspend accounts. Reports are read by us and are not shown to the person reported. |
| Product analytics — usage events from the app (an event name, its properties, your platform, and an anonymous identifier, plus your account id when you are signed in). | To understand how the app is used. This is our own system; the events are not sent to an advertising network. You can opt out in the app under Me → Settings. Events are kept for 13 months (see section 5). |
| Registration answers — whatever a league’s registration form asks, which can include a phone number. | So the organizer can run their season. Only the organizer of that league sets the questions. |
| Participation — the teams, leagues, seasons and tournaments you belong to, your availability, attendance, match appearances, statistics and ratings. | This is the league record itself: fixtures, standings, and stats. |
| Messages — team, league and direct messages you send in the app, and which messages you have read. | To deliver them to the people you sent them to. |
| Payments — what you owe and what you have paid. Card details are entered on Stripe’s own checkout page, if and when in-app payments are enabled, and are never sent to or stored by Leaguies. | So organizers can collect fees and keep their books straight. |
| Device and technical — a push notification token (from Expo and Google or Apple) if you allow notifications, the device type and connection identifier for the live-match connection, and request counts used for rate limiting. | To send you notifications you asked for, to keep live scores updating, and to stop abuse. |
Children
Leaguies is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, write to support@leaguies.app and we will remove it.
2. Why we are allowed to use it
- To perform our contract with you — running your account, your teams, your fixtures and your payments.
- Your consent — push notifications, and turning yourself on as discoverable to captains looking for players. Both are off unless you switch them on, and you can switch them off at any time.
- Our legitimate interests — keeping the service secure, preventing abuse, and keeping league history intact for the other people in your league.
- Legal obligation — retaining financial records, which is why some payment rows survive account deletion. See section 6.
3. Who else sees it
We do not sell your personal information, and we do not share it for advertising. We use these service providers, and only for the purposes named:
- Amazon Web Services — hosting, file storage for images you upload, and sending account emails.
- Supabase — managed PostgreSQL database hosting, where the data above is stored.
- Photon (Komoot) — address and place lookup. When you type a home area or search for a place, our server sends that text to Photon (photon.komoot.io) to find matching places and coordinates.
- Stripe — payments and payouts, if and when in-app payments are enabled. Stripe collects your card details directly under its own privacy policy; we receive only the result and the amount.
- Apple — sign-in with Apple, only if you choose it and when that option is offered.
- Google — sign-in with Google, only if you choose it and when that option is offered; Google Maps, which draws the map tiles in the app and receives the map area being viewed and your device’s IP address; and Firebase Cloud Messaging, which delivers push notifications to Android devices.
- Expo — relaying push notifications to your device (they receive your push token and the notification text), and delivering app updates to the app from Expo’s update service.
- DiceBear — generating the default avatar image for profiles without an uploaded picture. The app loads the image from DiceBear (api.dicebear.com) using a URL derived from your display name, so DiceBear receives that name and your device’s IP address.
Other people in your leagues see what you would expect them to see: your name, your picture, your profile, your fixtures, your stats, and anything you post in a team or league conversation. Organizers of a competition you join also see what you owe and whether you have paid.
4. Where it is stored
Our servers and database are hosted in the United States. If you use Leaguies from outside the United States, your information is transferred there.
5. How long we keep it
We keep your account information for as long as your account exists. When you delete it, section 6 applies. Records we are required to keep for financial or legal reasons are kept for as long as that obligation lasts, in the reduced form described below. Some technical records are removed automatically on a schedule:
- Sign-in (refresh) tokens: 30 days after they expire or are revoked.
- Email verification and password reset tokens: 1 day after they expire.
- Notification logs (other than those tied to a payment): 6 months.
- Delivered notification queue entries: 30 days.
- Audit logs (other than financial ones): 13 months.
- Stored responses used to prevent duplicate requests: 24 hours.
- Rate-limit counters: removed once their time window has ended.
- Product analytics events: 13 months.
6. Deleting your account
You can delete your account from the app at any time: Me → Settings → Delete account. It takes effect immediately and does not require emailing us. You can also request deletion without the app at /legal/delete-account.
What is deleted: your name, email address and password, your Google or Apple sign-in link, your profile picture, bio, home area and coordinates, your push notification tokens, your sign-in sessions, and your live-connection and notification-preference records. Your email address is released, so the same address can be used to register again later.
What remains, and why:
- League history. Match results, events, lineups and standings stay, because they are the shared record of competitions other people took part in, and their statistics are calculated from them.
- Chat messages. Messages you sent stay in the conversations they were sent in. Your account is removed from those conversations.
- Registration answers. Answers you gave when registering for a season, including any signed waiver, stay with the organizer as a record of that agreement. Only the link to your profile is removed.
- Analytics events. Events are anonymized (your account id and anonymous identifier are removed) rather than deleted, and are purged after 13 months.
- Payment records. Fees you owed or paid remain on the organizer’s books with the link to your profile removed, keeping only the name recorded at the time of the charge. We retain these under a legal obligation to keep financial records; we cannot delete them on request.
- Teams you owned. A team that has played is handed to another member rather than destroyed, so the people still on it keep their club.
7. Your rights
Depending on where you live, you may have the right to access, correct, or delete your personal information, to object to or restrict how we use it, and to withdraw consent. You can do most of this in the app: edit your profile, turn notifications and discoverability on or off, opt out of analytics, and delete your account. For anything else, write to support@leaguies.app and we will respond within 30 days.
If you are in the EEA or UK you also have the right to complain to your local data protection authority. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.
8. Security
Passwords are stored only as bcrypt hashes. Traffic between the app and our servers is encrypted in transit. Access to production data is limited to people who need it to operate the service. No system is perfectly secure, and we cannot guarantee absolute security.
9. Changes
If we change this policy we will update this page and the Last updated date.
10. Contact
Andres Arias (doing business as Leaguies)
support@leaguies.app