Effective from: · Wersja polska. If the versions differ, the Polish one prevails.
1. Who is responsible for your data
The controller of your personal data is Paweł Kawalec, ul. Dwie Topole 24A, 21-040 Kalinówka, Poland. Contact for anything about your data: kawalec@gmail.com.
We have not appointed a data protection officer — at this scale of processing it is not required. Write directly to the address above.
2. The short version
- Nobody sees your exact location. Others see at most a city or district and an approximate distance. The exact place of an activity is shown only if its organiser chooses to give it.
- We do not sell data or profile you for ads. Ads are matched to what you are looking at (sport, area), not to who you are.
- Messages disappear after 30 days.
- You can delete your account in the app (Profile → Delete account). Your personal data is anonymised 30 days later.
- Sparingo is for adults only.
3. What data we process
Account
- e-mail address, name (display name), date of birth, password — stored only as a cryptographic hash, never in plain text;
- when you sign in with Google: your Google account ID, e-mail address and name as provided by Google. We never receive your Google password.
Profile (all optional)
- profile photo — before it is stored we remove its metadata, including the GPS coordinates phones add to photos;
- sports and skill level, the hours you are free to play;
- location: city or district, and — if you allow the app to access your location — a point from your phone, used to calculate distances. The app uses location only while it is open, never in the background. You can withdraw access in your phone settings at any time and enter a city by hand.
What you create in the app
- activities (title, description, time, place at the precision you choose, cost), sign-ups and attendance;
- messages in activity chats and one-to-one conversations, game proposals;
- ratings and comments, reports of misconduct, blocks;
- friends and friend requests, groups (name, description, picture, members, requests and invitations), activities you watch;
- the “I am here” check-in (its time) — seen only by the activity organiser.
Premium subscription (if you use it)
- until when you have Premium, and whether you have used the trial;
- the Google Play purchase identifier, plan, end of the period and whether it renews — to confirm the purchase with Google and link it to your account;
- promo codes you used.
We never receive card or other payment details — Google Play handles the payment.
Technical data
- a push notification token — so we can send notifications to your phone;
- error reports from the app and the server — without IP addresses, request contents or account identifiers.
Ad counters (how many times an ad was shown and tapped on a given day) are aggregated and do not point to any person.
4. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, finding and organising activities, sign-ups, chats, partner matching, notifications | performance of a contract — Art. 6(1)(b) |
| Checking you are an adult | performance of a contract (the service is for adults only) — Art. 6(1)(b) |
| Reputation: ratings, games played, no-show rate | performance of a contract — Art. 6(1)(b); our legitimate interest in letting users judge whom they meet — Art. 6(1)(f) |
| Safety: reports, blocks, removing content, suspending accounts | legitimate interest — protecting users from abuse — Art. 6(1)(f) |
| Finding and fixing errors | legitimate interest — a working service — Art. 6(1)(f) |
| Ads matched to context (sport and area on screen) | legitimate interest — funding a free service — Art. 6(1)(f) |
| Premium subscription: confirming purchases, linking them to your account, the trial, promo codes | performance of a contract — Art. 6(1)(b) |
| Backups | legitimate interest — protecting data from loss — Art. 6(1)(f) |
| Establishing and defending legal claims | legitimate interest — Art. 6(1)(f) |
Providing your e-mail, name and date of birth is voluntary, but an account cannot be created without them. Other data you provide only if you want to use the feature it is for.
We do not make decisions about you based solely on automated processing that have legal effects. The order of search results (e.g. by distance and shared hours) is sorting, not a decision about you.
5. What other users see
- your name, profile photo, sports and level;
- your reputation: average rating, number of games played and — after at least three activities — your no-show rate;
- in partner search: an approximate distance and only the hours that overlap with the searcher's own — never your full week;
- activities you organise, with the place at the precision you chose;
- messages — only the participants of that chat;
- a rating comment — only the person rated, and only once both sides have rated each other or 7 days have passed.
Nobody sees your e-mail address, date of birth or exact location. A person you block cannot see you and you cannot see them — and they are not notified.
6. Who processes data on our behalf
We use providers who process data on our behalf and only on our instructions:
- Railway Corporation — servers and database, EU region (Amsterdam, the Netherlands);
- Cloudflare, Inc. — file storage: profile photos, ad graphics, backups;
- Functional Software, Inc. (Sentry) — error reports, EU region (Germany);
- Resend — sending e-mails (e.g. the password reset code);
- Google LLC — Google sign-in and delivering push notifications (Firebase); confirming Premium subscription purchases. The Google Play payment itself is handled by Google as a separate controller, under its own terms;
- 650 Industries, Inc. (Expo) — relaying push notifications to your phone.
Some of these providers may process data outside the European Economic Area, mainly in the USA. This happens on the basis of a European Commission adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by writing to the address in section 1.
We do not sell data or share it with advertisers. We may disclose data to public authorities where the law requires it.
7. How long we keep data
| Data | Period |
|---|---|
| Account and profile | until you delete the account; then 30 days, after which personal data is anonymised |
| Messages | 30 days from sending |
| Activities | 10 years — the history of games played on which users' reputation rests. After you delete your account the activity remains, but without your data (“Deleted account”) and without its description. |
| Ratings you gave others | as activities; after account deletion only the rating remains, without the comment or your name, as it is part of the rated person's reputation |
| Reports of misconduct and moderation decisions | as long as needed to handle them and keep users safe, no longer than until any related claims become time-barred |
| Backups | 14 days |
| Error reports | according to the retention period set with the provider (Sentry) |
After you delete your account your data leaves the database after 30 days, and the backups at most 14 days later. How to delete your account.
8. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data — most of it you can change yourself in your profile,
- erasure — delete your account in the app or by writing to us,
- restriction of processing,
- portability of the data you gave us,
- object to processing based on legitimate interest (section 4),
- lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your country of residence.
To exercise these rights, write to kawalec@gmail.com from the address linked to your account. We will reply within one month.
9. Cookies and website statistics
The app does not use cookies.
The sparingo.com home page may use Google Analytics (Google Ireland
Limited) to count visits — but only if you agree in the box at the bottom of the page.
Without consent the Google script is not loaded and no request reaches Google. With
consent, Google sets _ga cookies (for up to 2 years) and receives, among other
things, your IP address, browser type and the pages you visit. Google signals and ad
personalisation are switched off. The legal basis is your consent (Art. 6(1)(a) GDPR); you
can withdraw it at any time with the "Cookie settings" link in the footer, which also
deletes the _ga cookies. Google may process data outside the EEA under
standard contractual clauses.
10. Changes to this policy
We will tell you about significant changes in the app before they take effect. The current version is always at this address, with its effective date at the top.