Privacy Policy

1. Who we are

FanPlan (data controller). Contact: use the in-app Contact form or email stated in the App Store / Play listing. For EU/UK users, you may lodge a complaint with your national supervisory authority.

2. Scope (GDPR Art. 13–14)

This policy explains how we process personal data when you use FanPlan (iOS, Android) as an account holder or visitor. We process data under the EU General Data Protection Regulation (GDPR) and applicable national laws (e.g. Italy Legislative Decree 196/2003 as amended).

3. Data we collect

Account: email, display name, auth provider (Google/Facebook/email), subscription tier, XP/level, locale, profile visibility.

Trip & matchday: trips, fixtures, check-ins (including approximate location during check-in window), passport stamps, friends.

Technical: device push token (FCM), app version, logs, IP address for security and rate limiting.

Support: messages you send via Contact us (name, email, message content).

We do not sell your personal data.

4. Purposes & legal bases

Provide the service (contract — Art. 6(1)(b) GDPR).

Security, fraud prevention, rate limits (legitimate interest — Art. 6(1)(f)).

Push notifications you enable (consent — Art. 6(1)(a); withdraw in device/app settings).

Analytics/marketing cookies only if you accept them (consent — see Cookies Policy).

Legal obligations (Art. 6(1)(c)) where applicable.

5. Retention

Account data: while your account is active and up to 30 days after deletion request, unless law requires longer.

Check-in/location logs: up to 90 days (configurable).

Support messages: up to 24 months for handling enquiries.

Server logs: typically 90 days.

6. Recipients & transfers

Processors: hosting (e.g. Railway), Firebase/Google (auth, messaging), maps/weather providers where enabled.

Transfers outside the EEA use appropriate safeguards (Standard Contractual Clauses or adequacy decisions) where required.

7. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdraw consent where processing is consent-based.

To exercise rights: Contact us (category "Data request") or delete your account in Personal area → Delete account. We respond within one month (extendable per GDPR).

You may delete your account in-app (Personal area). Erasure is immediate except where law requires limited retention (e.g. billing logs).

8. Children

The service is not directed at children under 16. We do not knowingly collect data from children without parental authority.

9. Changes

We may update this policy; material changes will be notified in-app. Continued use after notice constitutes acknowledgment where permitted by law.