Privacy Policy

What we collect when you sign in

You can sign in with Telegram, Google or Apple. We never see your password for any of them; each provider confirms who you are and passes us a small profile.

• Telegram: your Telegram user id, username, first name, profile photo, language and premium status.
• Google and Apple: the provider's stable account identifier, your email address, your name and, where the provider supplies one, your profile picture. If you use Apple's Hide My Email, we only ever see the relay address.
• We store the provider's identifier so we can recognise you next time. Signing in with a different provider creates a separate PlaySpot profile — we do not join accounts by email.

What you add yourself

Anything on your profile, along with your rating and match history, is visible to other players in the app. Treat it as public and only add contact details you are happy to share.

• Display name, bio, date of birth, country, gender and profile photo.
• Contact handles you choose to publish, such as Instagram or WhatsApp.
• Playing preferences: dominant hand, preferred side, match type and preferred time.
• Matches and tournaments you create or join, scores, and the rating and ranking computed from them.
• Photos you upload for your profile or for a tournament.

What we collect automatically

We do not use advertising cookies and we do not track you across other websites. The only cookie we set is the one that keeps you signed in.

• A session record each time you sign in: a hashed session token, your IP address, your browser or app user agent, and the time.
• A sign-in audit entry, kept so we can investigate suspicious access to an account.

Why we are allowed to use it

• To provide the service you asked for — this covers your profile, matches, tournaments and ratings.
• To keep accounts secure and investigate abuse, which is our legitimate interest.
• To meet legal obligations where they apply to us.

Who else handles it

We do not sell your data and we do not share it with advertisers.

• Supabase — our database, authentication and file storage, hosted in the EU (AWS eu-central-1, Frankfurt).
• Vercel — hosting for the app and its API, served from the Frankfurt region.
• Telegram, Google and Apple — only during sign-in, and only to confirm who you are.

How long we keep it

• Sign-in sessions expire 30 days after they are created.
• Your profile, matches and tournaments are kept while your account exists.
• Ask us to delete your account and we remove your profile, your identities and your photos. Matches and tournaments you played in stay, because they are part of other players' history and results — your name is removed from them.

Your rights

You can ask for a copy of your data, correct it, or have it deleted. Most of it you can edit yourself on your profile screen. For anything else, write to support@play-spot.app and we will answer within 30 days. If you are in the EU or the UK and you think we have handled your data badly, you may also complain to your local data protection authority.

Children

PlaySpot is not intended for children under 13. If you believe a child has created an account, tell us and we will remove it.

Changes

If we change this policy in a way that matters, we will update the date at the top and let you know in the app before the change takes effect.