01Controller
The data controller is SPORT2GO d.o.o., Ob gasilskem domu 15, Zrkovci, 2000 Maribor, Slovenia, entered in the Slovenian Business Register under registration number 7444699000, tax number 58651128. For any privacy questions contact info@sport2go.app; every way to reach us is listed on the Support page.
02Data we process
- Account and profile: name, email address, phone number, date of birth, gender, profile photo, language preference.
- Availability status (optional): if you mark on your profile that you are injured, ill or away, and until when, we store it and show it to your teammates as a badge on your picture. An injury or illness badge is health data: only you can set it and you can remove it at any time.
- Sports profile (optional): sports with self-assessed level and frequency, positions, favourite clubs and athletes, height, weight, dominant hand and foot, jersey or shirt size, shoe size, and the number and name (nickname) on your jersey.
- Team activity: team and season memberships, events, RSVPs and attendance, results, statistics, leaderboards and collectible elements (badges, stickers).
- Cost records: amounts, per-event assigned costs and paid markers kept by the team organiser. Sport2GO does not make payments and stores no payment card data.
- Team payment details: an organiser can enter where players should send their share for the team — the payee name, IBAN, a payment app username and a note. We store these details and show them to the team’s members; Sport2GO does not make payments with them.
- Messages: team chat content, including photos and any location you choose to share.
- Content reports: when you report a message or a user, our support team receives by email your name, email address and account ID, the same details of the reported person, the team name, the time of the report and, for a reported message, its text and attachment (photo, poll or location).
- Blocked users: if you block a user in chat or on their profile, we store with your account whom you blocked and when, so that we do not show you their messages. Only you can see the list (in Profile → Account and privacy); the blocked person is not notified. You can undo a block at any time; the list is deleted when you delete your account.
- Prize draw: XP points, the reasons for them and your place on the activity leaderboard; for winners also contact details for the notification and for handing over the prize and, where tax law requires it, tax number.
- Technical data: session cookies for sign-in and basic server logs needed for operation and security. The log of sign-in attempts also contains the email address you sign in with.
03Purposes and legal bases
We process data to provide the service — organising teams, events, attendance, statistics and notifications (performance of a contract, Art. 6(1)(b) GDPR), to send transactional email such as invitations, sign-in codes and reminders (contract or legitimate interest), and to generate AI attendance forecasts (legitimate interest, Art. 6(1)(f) GDPR). There is no automated decision-making with legal effects.
We process content reports to review the reported content and act under the terms of use (legitimate interest in a safe community and our legal obligations as a service provider). We keep a report for as long as it is needed to handle it and for any legal claims.
Taking part in the prize draw is voluntary; we process the data for it in order to run it under the prize draw rules. You can switch participation off at any time on the My activity page. We process your availability status only because you chose to set it; once you remove it, we no longer show it.
04Sign in with Apple or Google, and Google Calendar
Sign in with Apple. When you sign in with Apple we receive from Apple the identifier of your Apple account, your name (on the first sign-in only) and your email address. If you choose “Hide My Email”, we receive Apple’s relay address instead of your real one; we send notifications to it and Apple forwards them to you. We also store Apple’s token from your latest sign-in, solely so that we can revoke the link with Sport2GO at Apple when you delete your account. The token is deleted together with the account.
Sign in with Google. When you sign in with Google we receive your name, email address and profile picture.
Google Calendar. If you choose to connect Google Calendar (the calendar.events scope), Sport2GO creates, updates and deletes only the entries for your teams’ events in your primary calendar. We do not read, store or share any other events in your calendar.
Access tokens are stored in our database and used solely for the synchronization described above. You connect on the website; you can disconnect at any time on the website or in the mobile app (Profile → Edit profile → Connections), or revoke access at myaccount.google.com/permissions. On disconnect we delete the tokens and the sync records; entries already written to your calendar remain until you delete them.
Sport2GO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
05AI attendance forecasts
To estimate expected attendance for a session we send the team’s RSVP history and player names to Google’s Gemini API. The result is a team-level forecast shown to organisers; it is not used for decisions with legal effects on individuals.
Right to object. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR), so under Art. 21 GDPR you can object at any time — write to info@sport2go.app and we will exclude you from the forecast, unless we can demonstrate compelling legitimate grounds that override your interests.
06Processors and transfers
We use contracted processors to run the service: Convex (database and backend), Vercel (hosting), Google (sign-in, Calendar, Maps, Gemini) and Resend (email, including content reports). If you choose Sign in with Apple, Apple (Apple Distribution International Ltd., Ireland) confirms your identity as the sign-in provider; we do not send Apple any data about your activity in Sport2GO. If you consent to analytics, Google Ireland Ltd. (Google Analytics) and Microsoft Ireland Operations Ltd. (Clarity) are added; without consent their scripts are never loaded. Some processors process data in the United States; transfers rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
The names of clubs and athletes that you can pick as favourites are provided by TheSportsDB.com. Searches go through our servers, so TheSportsDB does not receive your personal data.
07Sharing
We do not sell personal data and we do not use it for advertising. Team content (names, attendance, statistics, stickers) is visible to your teammates and organisers. If an organiser shares a public album link, the album content is visible to anyone with that link.
Active members of a season can see the team’s payments overview: how much has been collected, each player’s balance or debt, the items per player and the penalty fund. Only the team organiser (administrator) can add or edit payments. Email addresses and the details of individual payments — payment method and date, notes, payment claims and reminders — stay hidden; only the organiser and the player concerned can see them.
Only you can see your sports profile. The exceptions are your jersey or shirt size, shoe size and the number and name on your jersey: these are also visible to the organisers of the teams you play in (for ordering kit), but not to your teammates.
The activity leaderboard (XP) is shared across all teams: every signed-in user can see the activity leaderboard Top 10 (players and organisers) with full name, profile photo and points. From the leaderboard they can open a limited profile of a person on it — badges, number of matches played, win rate and leaderboard places — even without a shared team; the limited profile does not show teams, teammates or any other data. Anyone who leaves XP (turn off “I take part in XP” on My activity) does not appear on the leaderboard.
08Cookies and analytics
Strictly necessary cookies for sign-in, your chosen language and the record of your cookie choice are always used, because the service does not work without them.
Analytics is loaded only if you consent. We use Google Analytics and Microsoft Clarity to see which pages are used and where people get stuck. Clarity also records session replays — pointer movement, clicks and scrolling. By its default setting Clarity masks the contents of input fields, including passwords; other text shown on screen at the time may be part of the recording. The legal basis is your consent (Art. 6(1)(a) GDPR).
You can withdraw consent at any time and just as easily — one click on the Cookies page. When you withdraw, we delete the analytics cookies. Withdrawal applies going forward and does not affect the lawfulness of processing before it. Your choice is valid for one year, after which we ask again. We use no advertising trackers and no cross-site tracking. The full list is on the Cookies page.
09Mobile app and device permissions
The Sport2GO mobile app asks for a device permission only when you first use the feature that needs it. You can decline any permission or revoke it later in your device settings; the rest of the app keeps working.
- Camera and photo library: when you take or choose a profile photo, a team or player photo, an album cover, a photo to send in team chat or a picture you attach to a support message. Only the picture you choose is uploaded to our servers.
- Location: only when you tap “Share location” in team chat. We then read your current location once and store it as part of the message, which your team members can see. We never collect location in the background and we do not track it.
The mobile app does not load analytics. Google Analytics and Microsoft Clarity run only on the website and only with your consent (section 08); they are not loaded in the app, so the app does not ask you about cookies.
You can permanently delete your account directly in the app: Profile → Account and privacy → Delete my account (see section 10).
10Retention and deletion
We keep data for as long as you have an account or as needed for the purposes above. You can delete your account permanently yourself on the Account deletion page, which also explains what happens to your data. For deletion of specific data, write to info@sport2go.app.
We keep the details of prize draw winners that are needed for tax reporting for as long as tax and accounting rules require, even if you delete your account earlier.
11Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection. You may lodge a complaint with the Slovenian Information Commissioner (www.ip-rs.si). The service is not intended for children under 15 without parental or guardian consent.
12Changes
Changes to this policy are published on this page; the date of the last update is shown above.