Privacy Policy

Privacy Policy

Last updated: 2 October 2026

1. Who controls your data

The service owner and data controller is Nadav Cohen (sole proprietor), Israel. For any privacy question or request: sporchatapp@gmail.com. We respond within 3 business days.

2. What data we collect

Phone number — collected at sign-up and used to verify your identity and sign you in. It is the primary identifier of your account. Profile details — nickname, profile picture, bio, country and favourites (leagues and teams). You provide all of these and most are optional. Date of birth — collected to verify the minimum age; not shown to any other user. Athletes you follow — kept so we can notify you when they are playing. Content you create — chat messages, posts, comments, images, videos and voice messages. Activity in the service — predictions, points, badges, participation in leagues and trivia, and rooms you have joined. Reports and blocks — when you report content or block a user, a record is kept so the report can be handled. Notification subscriptions — if you turn notifications on, we store your browser or device subscription details so we can send you the event types you chose (goals, messages, match events). Basic technical data — IP address and request times, kept by our infrastructure providers for security and rate limiting. Usage and error data — when you use the website, we collect how it is used: which pages were opened, what you clicked, and technical errors that happened on your side. On some screens a recording of the screen is also kept, so we can understand where something is not working. In the recording and in the click data all text and everything you type is hidden, and no recording is made at all on personal screens: chats and rooms, communities, profile, settings, notifications, search, account and devices, the sign-in screens, blocked and muted users, reports, account deletion, the menu, and the creator and owner screens. Once you are signed in, this data is linked to your account ID only, never to your name, phone number or email address. To do that, an identifier is kept in your browser (in a cookie and in local storage). Your IP address is not stored with the usage data. You can turn measurement off at any time: in the notice shown on your first visit (“No thanks”) or with the “Usage measurement” switch in Settings. This data is collected on the website only, not in the native app. What we do not collect: we do not collect GPS location, we do not use advertising tools, and we do not track you across other apps or websites. We do not collect the content of your messages, posts or searches for measurement. The country shown on your profile is the one you chose, not a measured location.

3. Why we use the data

To operate the service and display content; to verify identity and secure your account; to prevent abuse, spam and fraud; to moderate content and handle reports; to match content to the preferences you chose; and to meet legal obligations. We do not sell personal data and we do not pass it to advertisers.

4. Who we share data with

We use service providers who process data only on our behalf: Supabase — database, user management and file storage. Vercel — website and server hosting. Cloudflare — protection, acceleration, and storage of encrypted deletion receipts. Vonage — sending verification SMS. Receives the phone number and the code only. OpenAI — moderation checks for text and images, and transcription of voice messages. The audio in videos and clips you publish is also sent to OpenAI for transcription and harmful-content checks. Your content is sent to OpenAI only after your explicit consent (see section 8). PostHog — usage measurement, error reporting and masked screen recordings (as described in section 2). The data is sent to PostHog servers in the European Union and is linked to your account ID only. Browser console logs are not sent. When you yourself share a match-summary card or a link to a room or to a message, the details shown on it — for example the message with the most reactions and the name of the person who sent it — leave the app to wherever you chose to share it. Beyond this, we disclose data only where the law requires it, or to prevent real harm to a person — including passing information to law enforcement in serious cases.

5. Where data is stored

The database and files are hosted in the European Union (Frankfurt, Germany). Some providers also operate infrastructure outside the EU; in those cases the transfer relies on those providers' standard safeguards.

6. How long we keep data

Account data and content — for as long as the account exists. After a deletion request — deletion completes within 7 days. Data export files — deleted automatically after 24 hours. Screen recordings (section 2) — kept for 30 days. Usage data and recordings are also deleted when you delete your account. Report and security records — kept after account deletion, without your identifying details, to guard against repeat abuse. Verification SMS — the SMS provider keeps a billing record for up to 13 months. When you delete your account we send it a deletion request for the records relating to you.

7. Your rights and how to exercise them

All rights are exercised from inside the app, without contacting us: Access and export — Settings → Privacy and data → Export my data. You receive a file containing the data in your account. Measurement data is not in the file, because it is kept by PostHog; the export screen explains what is kept there and how to ask for a copy. Correction — Settings → Edit profile. Restriction of processing — Settings → Privacy and data → Restrict processing. Deleting your own chat message — from the message menu, while the room is still open (once a room closes or is archived it can no longer be deleted). Deletion — Settings → My account → Delete account. A 7-day waiting period during which you can cancel, and an SMS confirmation when it completes. Deletion also covers the measurement data at PostHog: the profile, the events and the recordings. Turning usage measurement off — Settings → Usage measurement. Withdrawing AI-sharing consent — Settings. If you believe your rights have been infringed, contact us. Residents of the European Union may also complain to their local supervisory authority.

8. Artificial intelligence — explicit consent

You consent to sending content to an external provider for checking or transcription once, when you open your account: the terms box names it explicitly. Accounts opened before 25 September 2026 that have not consented yet are asked once, the first time they send content. Without consent the content is not sent and cannot be published. What is sent: the text of your message or post, the image you attached, or the voice recording. What is not sent: your phone number, nickname or account details. Voice transcripts: the transcript produced for the moderation check is also saved alongside the voice message and shown as readable text underneath it to everyone in the room, so the message is accessible to people who cannot play the audio. It is deleted when the message is deleted. Message translation: when you ask for a translation, or when automatic translation is enabled in a room's settings, the text of the message is sent to the provider for translation. The result is kept in a translation cache shared by that room, so the same message is not translated twice. AI room summary: when a match ends, the room may show a one-sentence summary generated automatically from the match details and the room's messages. Under the provider's policy, content sent through its interface is not used to train models. For text and image checks the provider keeps no abuse-monitoring logs at all. For voice transcription it may keep the recording for up to 30 days for abuse monitoring, after which it is deleted. You can withdraw consent at any time in Settings; withdrawal prevents future sending and does not delete content already sent.

9. Security

Access to data is protected by row-level permissions in the database, traffic is encrypted, media files are held in private buckets, and access to them is by time-limited signed links. No system is completely secure; if a security incident occurs that requires it, we will notify those affected and the authorities as the law requires.

10. Children

The service is not intended for anyone under 18. We do not knowingly collect data about minors. If such data is found, we delete it and close the account.

11. Changes to this policy

We update this policy from time to time. A material change will be shown inside the app before it takes effect.

12. Contact

sporchatapp@gmail.com — for any privacy question, request or complaint.