Privacy Policy
Last updated: 25 June 2026
This Privacy Policy explains how the Sportez mobile app and website ("Sportez", "Platform") process your personal data, in compliance with GDPR and Turkey's KVKK. Sportez processes only the data needed to provide the service and does not sell your data.
1. Data We Process
• Account & profile: name/display name, email or phone, date of birth (18+ verification), gender, favorite sports, level, bio and profile photo. • Location: only while the app is in the foreground; for event discovery and on-site GPS check-in. Precise coordinates are anonymized within 90 days after check-in. • Event data: events you create/join, participation, ratings and attendance. • Chat: in-event messages (retained 90 days). • Media: photos you upload (EXIF location stripped on upload; content is moderated). • Device & usage: push token, device type, app version and diagnostic/error logs.
2. Purposes
We process data to create and secure your account, match/recommend nearby events, provide event and chat features, send notifications, ensure safety and moderation, and meet legal obligations.
3. Legal Bases
Processing relies on (a) performance of the service contract, (b) your explicit consent (separately for location, push, marketing and transfer abroad), (c) legitimate interest (safety, fraud/abuse prevention) and (d) legal obligation. Permissions are separate, not pre-checked, and can be withdrawn at any time.
4. Third-Party Processors
We share limited data with processors to deliver the service: • OneSignal — push notification delivery. • AWS Rekognition — image moderation. • Wasabi (storage) and Bunny CDN — media hosting/delivery. • Mailgun — transactional email. • Google/Apple Maps — map and location display. • ip-api.com — coarse location (city) estimate from your IP address; the IP is processed server-side only and is not sent directly from your device. Some providers may be located abroad; transfers abroad require separate explicit consent and you are informed.
5. Retention
• Precise location: anonymized within 90 days after check-in. • Chat messages: 90 days. • On account deletion: 7-day soft-delete window, then permanent deletion (including push tokens, media, messages and analytics).
6. Your Rights (GDPR / KVKK Art. 11)
You have the right to access, rectify, erase, restrict processing of, port (export) and object to the processing of your personal data. Exercise these in-app (Settings → Export data / Delete account) or via destek@sportez.io. Export requests are fulfilled as a JSON+ZIP archive within 7 days.
7. Security
Data is encrypted in transit (TLS) and stored encrypted/tokenized at rest. Passwords are hashed with Argon2id. We apply image and text moderation, account security (2FA, session management) and an immutable audit log.
8. Children
Sportez is for users aged 18 and over. We do not knowingly collect data from anyone under 18.
9. Contact
For privacy and data requests: destek@sportez.io. Updates to this policy are posted on this page and we notify you of material changes.