Privacy Policy
1. Controller
Piotr Moskaluniec
Alt-Friedrichsfelde 23
10315 Berlin, Germany
E-mail: piotrasmc@googlemail.com
No data protection officer has been appointed, as the legal requirements for this do not apply.
2. Overview
SandMatch is an app and web application (sandmatch.app) for organising beach volleyball sessions, tournaments and open play rounds. We process only data that is required to operate these functions or that you provide voluntarily. We do not sell data, do not build profiles for advertising purposes and do not use analytics or advertising services.
3. Data processed in detail
3.1 Account and profile
When you register we process your e-mail address and password (or, when signing in with Google, the identifier and e-mail address transmitted by Google). In your profile you may voluntarily add: first and last name, profile picture, skill level, gender, home town and preferred payment details for refunds of participation fees.
Purpose: providing the user account, assigning sign-ups, display to other participants. Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for voluntary details Art. 6(1)(a) GDPR (consent).
3.2 Sessions, sign-ups and tournaments
When you create a session or sign up for one, your account identifier, name, sign-up status, accompanying guests, payment status and match results are stored and shown to the other participants of that session.
Legal basis: Art. 6(1)(b) GDPR.
3.3 Location data
The app can access your device location to filter sessions by distance and to show venues on the map. Access takes place only after you have explicitly granted it in the operating system and can be revoked there at any time. The location is used to calculate distances and is not stored permanently on our servers.
Legal basis: Art. 6(1)(a) GDPR.
3.4 Chat, comments and reports
Messages in session chats and comments are stored and shown to their recipients. If you report a message for inappropriate content, we store the reported message, its author, the time and your identifier so that we can review the case. If you block a person, that identifier is stored in your profile so that their content is hidden from you.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in a platform free of abuse).
3.5 Push notifications
For notifications about invitations, cancellations and new messages we store the Firebase Cloud Messaging device token. Notifications can be disabled at any time in the system settings.
Legal basis: Art. 6(1)(a) GDPR.
3.6 Payments
Participation fees can be paid via Stripe or PayPal. Payment processing takes place entirely with the respective provider; card or bank account details are never transmitted to us or stored by us. We only receive the information whether and in what amount a payment was made, together with the transaction identifier.
Legal basis: Art. 6(1)(b) GDPR.
3.7 Technical data
When the servers are accessed, our service provider processes technically necessary connection data (IP address, time, error messages) to ensure operation and system security.
Legal basis: Art. 6(1)(f) GDPR.
3.8 Website and web app (sandmatch.app)
The web version of the app and these information pages are hosted by Netlify. When you access them, Netlify processes technically necessary connection data (IP address, date and time of access, requested file, browser identifier) in server logs in order to deliver the pages and ensure system security. The web app loads Google Maps for the map view; in doing so your IP address is transmitted to Google.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional provision).
3.9 Cookies and local storage
The website, web app and apps do not use cookies or comparable techniques for advertising or tracking purposes and no analytics services. Only technically required data is placed in the local storage of the browser or device, such as the sign-in state (Firebase Authentication) and chosen settings like language and appearance. This storage is strictly necessary to provide the service (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); no consent is required for it, which is why no cookie banner is shown.
4. Recipients and processors
| Service | Provider | Purpose |
|---|---|---|
| Firebase Authentication, Realtime Database, Storage, Cloud Functions, Cloud Messaging | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Accounts, data storage, server functions, push notifications |
| Google Maps | Google Ireland Limited | Map display and place search |
| Google Sign-In | Google Ireland Limited | Optional sign-in with a Google account |
| Stripe | Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland | Payment processing |
| PayPal | PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg | Payment processing |
| Web hosting (sandmatch.app) | Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA | Delivery of the website and web app, server logs |
Transfers to third countries, in particular to the USA, may take place within these services. The providers rely on the EU Commission's standard contractual clauses or on the EU-US Data Privacy Framework. The database is hosted in the europe-west1 region (Belgium).
5. Retention periods
- Profile data: until the account is deleted.
- Sign-ups, results and chat messages: until the organiser deletes the respective session.
- Reports of inappropriate content: up to 12 months after the review is completed.
- Push tokens: until sign-out or account deletion.
6. Deleting your account
You can delete your account yourself at any time in the app under Profile → Delete account. This removes your profile and login credentials. Sign-ups for sessions that have already taken place and tournament results remain, without your profile data, as part of the history of the respective event. Detailed instructions and the e-mail route are available under Delete account.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw any consent you have given at any time with effect for the future. Please contact the e-mail address above for this.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.
8. Changes to this policy
If the app is extended with functions that process further data, we will update this policy. The version published here applies in each case.
This English version is provided for convenience. The German version (Datenschutzerklärung) is the legally binding one.