Privacy Policy
Last updated: 25 June 2026
This Privacy Policy explains how the Sportez mobile app and website ("Sportez", "Platform") process your personal data, in compliance with GDPR and Turkey's KVKK. Sportez processes only the data needed to provide the service and does not sell your data.
1. Data We Process
• Account & profile: name/display name, email or phone, date of birth (18+ verification), gender, favorite sports, level, bio and profile photo. • Location: your device location is read only while the app is in the foreground, to show nearby meetups and calculate distances. If you tap "Use my location" it is saved to your account; the saved location is also used to notify you about nearby meetups while the app is closed. Other people never see your raw location — only your approximate distance. You mark your own attendance; no location data is collected when you do. • Event data: events you create/join, participation, ratings and attendance. • Chat: in-event messages (retained 90 days). • Media: photos you upload (EXIF location stripped on upload; content is moderated). • Device & usage: push token, device type, app version and diagnostic/error logs.
2. Purposes
We process data to create and secure your account, match/recommend nearby events, provide event and chat features, send notifications, ensure safety and moderation, and meet legal obligations.
3. Legal Bases
Processing relies on (a) performance of the service contract, (b) your explicit consent (separately for location, push, marketing and transfer abroad), (c) legitimate interest (safety, fraud/abuse prevention) and (d) legal obligation. Permissions are separate, not pre-checked, and can be withdrawn at any time.
4. Third-Party Processors
We share limited data with processors to deliver the service: • OneSignal — push notification delivery. • AWS Rekognition — image moderation. • Wasabi (storage) and Bunny CDN — media hosting/delivery. • Mailgun — transactional email. • Google/Apple Maps — map and location display. • ip-api.com — coarse location (city) estimate from your IP address; the IP is processed server-side only and is not sent directly from your device. Some providers may be located abroad; transfers abroad require separate explicit consent and you are informed.
5. Retention
• Saved location: kept while your account exists; you can change it or withdraw the permission from your profile at any time. • Chat messages: 90 days. • On account deletion: 7-day soft-delete window, then permanent deletion (including push tokens, media, messages and analytics).
6. Your Rights (GDPR / KVKK Art. 11)
You have the right to access, rectify, erase, restrict processing of, port (export) and object to the processing of your personal data. Exercise these in-app (Settings → Export data / Delete account) or via destek@sportez.io. Export requests are fulfilled as a JSON+ZIP archive within 7 days.
7. Security
Data is encrypted in transit (TLS) and stored encrypted/tokenized at rest. Passwords are hashed with Argon2id. We apply image and text moderation, account security (2FA, session management) and an immutable audit log.
8. Children
Sportez is for users aged 18 and over. We do not knowingly collect data from anyone under 18.
9. Contact
For privacy and data requests: destek@sportez.io. Updates to this policy are posted on this page and we notify you of material changes.