Privacy Policy

Last updated · July 17, 2026

1. Information We Collect

1.1 Information you provide

• Account details — name, username, email address, password, profile photo, favorite club, player positions, nationality, age, and any other details you add to your profile.
• Group & activity data — group descriptions, activity preferences, availability, RSVP status, attendance history, and chat or match notes you submit.
• Photos and media — profile photos, group logos and covers, and other images you choose to upload.
• Support requests — questions or feedback submitted to support channels.

1.2 Information we collect automatically

• Usage data — app interactions, feature engagement, referring screens, crash/error diagnostics, and performance metrics.
• Device data — device type, operating system, language, time zone, mobile network, and device identifiers.
• Location data — the approximate area you choose for discovering games, and your precise location only if you grant location permission (used to suggest nearby groups, pitches, and games while you use the app — we never access your location in the background).

1.3 Information from third parties

• Authentication providers — tokens or profile basics when you sign in with Google or Apple.
• Group admins / teammates — if someone invites you or records your participation, they may provide your email or display name.

2. How We Use Information

We use your information to: provide the Services (create and manage accounts, authenticate users, match players to groups); improve & personalize (analyze usage, develop new features); communicate (send transactional notices, RSVP updates, match reminders); ensure safety (detect fraud/spam, moderate content, enforce our Community Standards); and marketing only if you opt in.

2.1 Legal bases (EU/EEA/UK users)

Where the GDPR (or UK GDPR) applies, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and run your account and provide the core Services: authentication, group memberships, scheduling, RSVPs, live scores, stats, and voting.
• Legitimate interests (Art. 6(1)(f)) — to keep the Services safe and functioning: fraud/spam detection, content moderation, security, crash diagnostics, and improving features. We balance these interests against your rights and only rely on them where appropriate.
• Consent (Art. 6(1)(a)) — for optional marketing communications and for accessing your device location, camera, and photos. You can withdraw consent at any time (see Section 5), without affecting processing already carried out.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with the law, including child-safety reporting.

3. Sharing & Service Providers

We do not sell your personal data. We share data only when necessary to operate the Services:

• Google Firebase (Google LLC) — authentication, database (Cloud Firestore), file storage, cloud functions, hosting, and push notification delivery. This is where your account and content live.
• Google Maps — map display and place lookup for pitches and venues.
• Sentry (Functional Software, Inc.) — crash and performance reporting. We strip email addresses, usernames, and IP addresses from crash reports before they are stored; crashes are associated only with a pseudonymous ID.
• Expo (650 Industries, Inc.) — push notification delivery infrastructure.
• Group members — your profile, stats, and activity are visible to the groups and games you join. That's the point of the app.
• Legal & safety — when required by law or to protect users (for example, responding to valid legal requests or reporting child safety violations to authorities).
• Business transfers — in the event of a merger, acquisition, or asset sale, with notice to you.

4. Data Retention & Deletion

We retain account data while you actively use the Services. You can delete your account at any time:

• In the app — Profile > Settings > Delete Account. This immediately and permanently deletes your profile, group memberships, stats, saved activities, notifications, uploaded photos, and authentication record.
• On the web — via our account deletion page, processed within 30 days.

We may keep minimal records where required for legal or fraud-prevention purposes (for example, anonymized moderation reports).

5. Your Rights & Choices

Access & update — edit profile and group information directly within the app. Delete — use the in-app controls, the web deletion page, or email support@futtos.app. Marketing preferences — opt out at any time. Permissions — revoke location, notifications, or camera/photo permissions in your device settings; the app keeps working without them.

5.1 Your rights under the GDPR (EU/EEA/UK)

If you are in the EU, EEA, or UK, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — delete your account and data, as described in Section 4.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests.
• Data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller where technically feasible.
• Withdraw consent — where processing is based on consent (e.g. marketing, device permissions), withdraw it at any time without affecting prior processing.

To exercise any of these rights, use the in-app controls or email support@futtos.app. We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority — for example, the data protection authority in your EU member state, or the ICO in the UK — though we would appreciate the chance to address your concern first.

5.2 Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects or similarly significantly affects you.

6. Security

We use industry-standard safeguards such as encryption in transit, access controls, device integrity checks, and monitoring. No system is 100% secure — use a strong password and keep your device updated.

7. Children's Privacy

Futtos is not directed to children under 13 (or the higher minimum age in your region), and account creation requires confirming you meet the minimum age. In parts of the EU/EEA, the minimum age for consent to online services is higher (for example, 16 in Germany and the Netherlands); where a higher age applies, users below it must have parental or guardian consent. We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us data, contact support@futtos.app and we will delete it promptly. See also the child-safety section of our Community Standards.

8. Where Your Data Is Stored

Your data is stored on Google Firebase infrastructure (primary region: Jakarta, Indonesia) and may be processed in other countries where our service providers operate. Where cross-border transfer mechanisms are required, we rely on our providers' safeguards such as Standard Contractual Clauses.

9. Changes to This Policy

We may update this policy to reflect new features, legal requirements, or business practices. We notify users through the app or email when material changes occur.

10. Data Controller & Contact

The data controller responsible for your personal data is PT. Mayuca Digital Studio, Jl. Raya Uma, RT 000, RW 000, Tampaksiring, Tampaksiring, Kabupaten Gianyar, Bali 80552, Indonesia. Questions or privacy requests: support@futtos.app.

For EU/EEA and UK users: you can direct any data-protection questions or requests to support@futtos.app. Where a representative under Article 27 of the GDPR is required, their contact details will be published here.

You also have the right to lodge a complaint with your local supervisory authority (see Section 5).