Privacy policy
Last updated: 27 September 2026
Sportsiou is free and does not live off your data: no advertising inside the app, no resale, no profiling. This page sets out exactly what we collect, why, for how long, and how you take back control. This is a translation for convenience; the French version prevails.
1. Data controller
HMN — sole trader, SIREN 930 142 765, publisher of the Sportsiou service.
For any question about personal data: support@sportsiou.com.
2. Data we collect
| Category | Data | Why | Legal basis |
|---|---|---|---|
| Account | Username, email address, password (stored as a bcrypt hash, never in clear text), creation date, language | Create and secure the account, verify the email address | Performance of the service |
| Profile | Profile picture or avatar, colour, favourite sport, default city (name and coordinates) | Identify you to other players, centre the map | Performance of the service |
| Sporting activity | Matches created and joined, team, attendance, scores, results, late withdrawals, ratings received, badges | Run matches and the player profile | Performance of the service |
| Support | Your message, your email address, and a technical diagnostic (browser, platform, language, screen size, app version, last error shown) | Handle your report and answer you | Performance of the service — no game data is attached: no match, no message, no friend, no location |
| Game alerts | Email address (if email alerts are chosen), map point rounded to about 100 m, chosen sports, language and time zone | Tell you about a new game posted within 10 km (at most one email every 12 h) | Consent — confirmed by a click in the email for a visitor, withdrawn in one click via the link in every email. Unconfirmed alert erased after 7 days, active alert erased after 12 months |
| Leaderboard | Username, overall rating, rank, city and country (derived from your default city), number of raters and matches | Publish a player leaderboard by city, country, worldwide and by sport | Legitimate interest (running the game) — you can opt out at any time, see § 3 |
| Communications | Match chat messages, notifications | Let participants organise the match | Performance of the service |
| Connections | Friend requests and accepted friendships | Find and invite the people you play with | Performance of the service |
| Location | One-off GPS position, if you allow it | Show venues and matches around you | Consent (browser permission, revocable at any time) |
| Technical | Session token (fa_session cookie), IP address held in memory only | Keep you signed in, limit abuse and brute-force attempts | Legitimate interest (security) |
| Analytics | Page viewed, page the visit came from (referrer), country, device type, browser and operating system; a few key steps counted anonymously (sign-up, verified email, match created, match joined, app install). No cookie, no identifier, no IP address kept | Know how many people use Sportsiou and where they come from | Legitimate interest (understanding and sizing the service) — see § 6 |
| Verification | Six-digit code, expiry date, attempt count | Confirm the email address belongs to you | Performance of the service |
Your location is not stored. It is read by your browser, sent to our server for the duration of a single request so we can work out what is around you, then discarded. No movement history is built. The one exception is your « default city », if you explicitly choose to save it.
What we do not collect
- No advertising tracker, no embedded social network, and no analytics entrusted to a third party: ours runs on our own server, without cookies and without identifying you (§ 6).
- No address book, no phone contacts.
- No payment data — the service is free and involves no payment.
- No special category data within the meaning of Article 9 GDPR (health, opinions, orientation…).
- No automated decision producing legal effects, no advertising profiling.
3. What other users can see
Other players can see your username, profile picture, favourite sport, playing statistics and badges — including negative ones such as « No-show », awarded after three withdrawals less than two hours before a match — as well as your messages in the chats of matches you take part in.
Never visible: your email address, your password, your precise location, your full friend list.
Without an account, a visitor sees published games in a form containing no personal data: sport, format, venue, time, number of spots taken and free. The organiser's username, the note attached to the game, the list of participants and the chats remain reserved to signed-in members.
Reporting a problem
The “Report a problem” entry in your account menu sends your description to support with a technical diagnostic — and nothing else. That diagnostic is shown to you before sending: browser, platform, language, screen size, app version, current screen and last error. No game data is included: not your matches, not your messages, not your friends, not your location. The server only records that list of fields, whatever the browser sends.
Your request is kept for the time needed to handle it, then one year, so that we can measure our response times. Those times and the service status are published every day on the status page. We commit to answering within 24 working hours.
The leaderboard
From the hundredth registered player onwards, Sportsiou publishes a player leaderboard — by city, by country, worldwide, and by sport. It shows your username, overall rating and rank, along with the city derived from your default city. This is visible to every signed-in user. Only players rated by enough different people are listed: the rating of a barely rated player is not comparable to anyone else's.
You can opt out in one gesture: « Leaderboard » screen, « Remove me from the leaderboard » button. You immediately disappear from every leaderboard without losing anything — your player card, badges, ratings and history stay intact. Coming back is just as simple.
There is no negative leaderboard: no « worst players », no ranking of negative badges. Negative badges fade away on their own after 90 days without a repeat: they sanction a behaviour, not a person.
4. Recipients and processors
| Recipient | Role | Data shared | Location |
|---|---|---|---|
| OVH SAS | Server and database hosting | All service data | France |
| Hostinger Operations UAB | Delivery of verification emails | Email address and six-digit code | Lithuania (EU) |
| No third party — the publisher's own analytics server, separate from the one hosting the service | Analytics (Plausible, open-source software): we administer that server, and no data is entrusted to any provider | Page viewed, referrer, country, device type, anonymous conversion events — never your username, never your email, never your location | France |
| OpenStreetMap Foundation | Base maps, city search, venue imports | Geographic coordinates only, sent by our server — never your identity, never your browser directly | EU / United Kingdom |
Relaying map tiles through our own server is a deliberate choice: your browser never talks to OpenStreetMap directly, so they see neither your IP address nor your browser fingerprint.
Transfers outside the European Union: none to date. Should a provider outside the EU be added, this page would be updated and the applicable safeguards (standard contractual clauses) set out here.
5. Retention periods
| Data | Period |
|---|---|
| Account and profile | Until the account is deleted, then erased within 30 days |
| Match chat messages | 60 days after the match date |
| Read notifications | 90 days |
| Leaderboard snapshot | Recomputed every hour; erased immediately if you opt out or delete your account |
| Sign-in sessions | 180 days |
| Cancelled matches | 30 days |
| Cached map tiles | 30 days (no personal data) |
| Email verification code | 15 minutes |
| Analytics | Kept indefinitely, because they are totals: no individual visit and no personal data appears in them |
These deletions are automatic: a purge runs periodically on the server, with no human involvement.
6. Cookies and analytics
Sportsiou uses a single cookie: fa_session, strictly necessary to keep
you signed in. It serves no analytics and no advertising purpose. As such it requires no prior consent
and no banner is displayed. Your browser's local storage also keeps your display preferences (light or
dark theme, language) — that information never leaves your device.
Cookieless analytics. To know how many people use Sportsiou and where they come from, we use Plausible, open-source software that we run on our own server, in France: no data is handed to Google or to any other analytics service. No cookie is set, no identifier is assigned to you and no IP address is kept — a visit is counted, then forgotten. Nothing makes it possible to follow you from one site to another, or from one day to the next.
What we see amounts to totals: pages viewed, the site or advertisement the visit came from, country, device type, and a few key steps counted anonymously — a sign-up, a verified email, a match created, a match joined, an app install. Those counters are never tied to an account: we know how many, never who. Nothing is sold or shared.
Because it sets no cookie, is limited to measuring this site's audience alone and allows no cross-site tracking, this measurement falls within the consent exemption recognised by the French data protection authority (CNIL): that is why no banner is forced upon you. As no personal data is kept, there is nothing here to export and nothing to erase.
7. Security
- Encrypted transport end to end (HTTPS, Let's Encrypt certificate, automatic redirection).
- Passwords stored as bcrypt hashes — they cannot be recovered, including by us.
- Email address verification is mandatory; disposable addresses are refused.
- Rate limiting on sign-in attempts and code requests, constant-time code comparison.
- HTTP security headers, origin checking on real-time connections, bounded input on every endpoint.
8. Your rights
Under the General Data Protection Regulation you have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death.
To exercise them, write to support@sportsiou.com from the address linked to your account. We reply within one month at the latest.
Deleting your account yourself from within the app is not available yet. Until it is, any erasure request sent to support@sportsiou.com is handled manually within the same one-month period, and your data is deleted in full — account, profile, messages and match history.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, cnil.fr, or with the supervisory authority of your country of residence.
9. Minimum age
Sportsiou is restricted to adults (18 and over). The service arranges in-person meetings between people who do not know each other: this limit is deliberate. No account is knowingly created for a minor, and any account reported as such is deleted.
10. Changes
Advertising. No advertising tracker is present to date, which is precisely why no consent banner is imposed on you. Should advertising be introduced to keep the service running (article 2 of the terms of use), this page would be updated before anything is deployed: new recipients, purpose, legal basis and retention periods would be set out here. Any advertising tracker would then require your prior consent, collected through a dedicated banner and revocable at any time; refusing would not prevent you from using the service.
This policy may change, in particular if a new processor is added. The date of the latest update appears at the top of the page; any substantial change will be announced in the application.