Privacy Policy

1. Data we process

• sign-in and account data provided through Clerk, including the account identifier and information needed to authenticate;
• profile information such as name, username, profile picture, short bio, age or date of birth, and selected city;
• selected sports and skill levels;
• created, discovered, joined, completed, or cancelled games and join requests;
• chat messages connected to games;
• ratings and reviews submitted by users;
• reports, blocks, moderation actions, and community-safety records;
• notification data and, if you enable push notifications, the browser subscription data needed to deliver them;
• anonymous product-usage events (profile created, game created, join requested, participant accepted, game completed, and rating submitted) containing only an event type and timestamp, never an account, device, or content identifier;
• basic technical, service, and security logs such as request timing, operation outcomes, and information used to prevent abuse.

2. Why we use data

• to authenticate you, operate your account, and show your profile;
• to help users find and arrange games and to send messages and notifications;
• to handle reports, blocks, abuse, and security incidents;
• to produce anonymous, aggregate feature-usage reports and improve service reliability;
• to operate, troubleshoot, protect, and maintain service reliability;
• to meet legal obligations, defend rights, and prevent fraud.

3. Legal bases

Processing may be necessary to perform the service you request; for our legitimate interests such as security, abuse prevention, and service stability; to comply with a legal obligation; or based on your consent where consent is required, such as for push notifications.

You can withdraw consent for future processing at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Who may process data

We use Clerk as our authentication provider. We use infrastructure providers operated by Replit and its subprocessors for app hosting, databases, profile-picture storage, and service operation. When enabled, push notifications are delivered through browser services and the connected infrastructure.

These providers process data on our instructions and only as needed to provide their services. Before public launch, we will publish a verified provider list and the relevant contractual safeguards where required. We do not sell data or use it for targeted advertising.

5. Retention and security

We retain data for as long as needed to operate an account, maintain safety, resolve disputes, and meet legal obligations. Retention periods depend on the type and purpose of the data; when data is no longer needed, we delete or anonymize it unless we must retain it. We retain raw anonymous product-usage events for no more than 90 days, then delete them.

We use reasonable technical and organizational safeguards, but no online system is completely secure. Tell us about a security concern or unauthorized access through the Contact page.

6. Your EU rights

Depending on the circumstances, you may have rights to access, correct, delete, restrict, object to, and receive a portable copy of your data, as well as withdraw consent. You may also complain to the Information Commissioner of the Republic of Slovenia. To exercise a right, use the contact published on the Contact page.

Clerk may act as an independent controller for some sign-in data. For sign-in requests, you may also use the controls available in the Clerk user interface.

7. Children and future features

MATCHUP is for people aged 18 and over. We do not intend to collect data from people who do not meet that age requirement.

MATCHUP stores the exact location you provide for your profile and games to determine which games are within 20 km. You can provide it once from your device or enter coordinates manually; MATCHUP does not track your live location. Payments, subscriptions, marketing, ad profiling, and other services not described in this policy are not currently part of MATCHUP.