Privacy Policy

Roman Štěpka, a sole proprietor registered in the Czech Republic under business identification number (IČO) 04943708 ("we," "our," "us," or the "Operator") operates the Jedenáctka mobile application (the "App"), available on iOS and Android platforms. The App enables users to organize football (soccer) games, manage teams, communicate with teammates, and access competition data.

This Privacy Policy informs you of our policies regarding the collection, use, processing, disclosure, and protection of personal information when you use the App, and explains the choices you have associated with that data. By downloading, installing, or using the App, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of information in accordance with it.

We are committed to protecting your privacy and ensuring that your personal data is handled in compliance with applicable data protection legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council (the "General Data Protection Regulation" or "GDPR"), Act No. 110/2019 Sb. on the processing of personal data (Czech implementing legislation), and other relevant laws and regulations.

For the purposes of the GDPR, the data controller is:
Roman Štěpka
IČO: 04943708
Czech Republic
Email: roman@pickupsports.eu
Website: https://jedenactka.app

1. Information We Collect

We collect several types of information for various purposes in order to provide, improve, and administer the App. The categories of information we collect are described below.

1.1 Personal Data

When you create an account and use the App, we may collect personally identifiable information that can be used to contact or identify you. This includes, but is not limited to:

• Email address - used for account creation, authentication, and communication regarding your account and the service.
• Full name (first and last name) - used to identify you within the App, on team rosters, in event listings, and in communications with other users.
• Profile picture - an image you upload or provide via a third-party login provider, displayed on your public profile, team rosters, and within chat conversations.
• User ID - a unique identifier assigned to your account upon registration, used internally to associate your data across the App.
• Purchase and subscription history - records of in-app purchases and PRO subscription status, processed through RevenueCat and the respective app store (Apple App Store or Google Play Store).
• Language preference - your selected interface language, stored in your user profile.

1.2 Location Data

The App requests access to your device's location services to provide location-based features, including displaying nearby events on a map, showing event locations, and enabling location-based search functionality. We collect momentary (foreground-only) location data when you actively use the App's location features. We do not collect background location data, and we do not continuously track your movements.

Location data is processed by Google Maps services integrated within the App. You may disable location access at any time through your device's operating system settings, although this may limit certain features of the App.

1.3 Usage and Analytics Data

We automatically collect certain information about how you interact with the App, including:

• Firebase Analytics data - screen views, session duration, feature usage patterns, user engagement metrics, and general interaction data.
• Crash and diagnostic data - collected via Firebase Crashlytics, including crash logs, stack traces, device state at the time of a crash, and other diagnostic information necessary to identify and resolve technical issues.
• App performance data - load times, rendering performance metrics, and device capability assessments used to optimize the user experience.

1.4 Device Information and Permissions

We may collect information about your device, including:

• Device type, model, and operating system - used for compatibility, analytics, and crash reporting.
• Unique device identifiers - such as push notification tokens, used to deliver push notifications to your device.
• Camera and photo library access - requested solely for the purpose of uploading or capturing a profile picture. The App does not access your camera or photo library for any other purpose and does not store or process images beyond the profile picture you explicitly select.
• Notification permissions - requested to deliver push notifications about game events, team messages, and other relevant updates.

1.5 Communication Data

The App provides team chat and direct messaging features. We collect and store the content of messages you send through these features, including text messages, to facilitate real-time and asynchronous communication between team members. Message data is stored on our servers (hosted by Supabase) and is accessible to the intended recipients. We do not monitor the content of private conversations, except as may be required by law or to enforce our Terms of Service in response to reports of abuse.

1.6 Third-Party Login Data

If you choose to register or log in using a third-party authentication provider (Google Sign-In or Apple Sign-In), we receive certain information from that provider, which may include:

• Your email address (or a private relay email in the case of Apple Sign-In with Hide My Email).
• Your display name.
• Your profile picture URL (if provided by the authentication provider).
• A unique identifier from the authentication provider (e.g., Google account ID or Apple user ID).

We do not receive or store your password from any third-party authentication provider. The information we receive depends on the provider's policies and the permissions you grant during the login process. We encourage you to review the privacy policies of Google (https://policies.google.com/privacy) and Apple (https://www.apple.com/legal/privacy/) for information about their data practices.

1.7 Team and Game Data

When you create or join teams and organize or participate in games, we collect and store:

• Team names, team descriptions, and team membership information.
• Game/event details, including date, time, location, participant lists, and attendance status.
• Player availability information, including injury status and vacation status, as voluntarily provided by you.
• Team roles and administrative designations (e.g., team captain, member).
• Join requests and team invitations.

1.8 Rating and Performance Data

The App includes a player rating system that allows users to rate other players on a scale of 1 to 5 stars. Ratings are collected anonymously - the identity of the rater is not disclosed to the rated player. We store the aggregate rating data associated with each user profile. Additionally, we collect experience points (XP) and level progression data as part of the App's gamification system, which tracks your engagement and activity within the App.

2. How We Use Your Data

We use the information we collect for the following purposes:

• To provide and maintain the service - including creating and managing your account, enabling you to create and join teams, organize and participate in games, communicate with other users, and access all features of the App.
• To process transactions - managing in-app purchases and PRO subscription services through RevenueCat and the respective app stores.
• To communicate with you - sending push notifications about game updates, team invitations, chat messages, and other service-related communications; responding to your inquiries and support requests.
• To personalize your experience - displaying the App in your preferred language, showing relevant nearby events based on your location, and tailoring content to your usage patterns.
• To improve the App - analyzing usage data and analytics to understand how the App is used, identify areas for improvement, develop new features, and optimize performance.
• To ensure security and prevent abuse - monitoring for fraudulent activity, enforcing our Terms of Service, and protecting the rights, property, and safety of our users and the public.
• To diagnose and fix technical issues - using crash reports and diagnostic data to identify, troubleshoot, and resolve bugs and performance problems.
• To comply with legal obligations - processing data as required by applicable laws, regulations, legal processes, or enforceable governmental requests.
• To display player profiles and ratings - showing aggregated, anonymous rating data and XP/level information on user profiles to foster community engagement.
• To facilitate team management - enabling team captains and administrators to manage rosters, track player availability, and organize team activities.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR:

• Performance of a contract (Article 6(1)(b) GDPR) - Processing is necessary for the performance of the contract between you and us (the Terms of Service) when you create an account and use the App. This includes processing your personal data to provide the core functionality of the App, such as account management, team and event features, messaging, and subscription services.
• Consent (Article 6(1)(a) GDPR) - Where we rely on your consent, you have the right to withdraw it at any time. Consent is the legal basis for: processing your location data; sending push notifications; using optional analytics and performance monitoring; and processing your profile picture.
• Legitimate interests (Article 6(1)(f) GDPR) - We may process your data based on our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include: improving and optimizing the App; ensuring the security of our services; preventing fraud and abuse; and conducting aggregated, non-identifying analytics.
• Legal obligation (Article 6(1)(c) GDPR) - We may process your personal data to comply with applicable legal obligations, such as tax and accounting requirements, responding to lawful requests from public authorities, or preserving data as evidence when required.

4. Authentication and Third-Party Logins

The App offers multiple authentication methods to provide a secure and convenient registration and login experience:

4.1 Supabase Authentication

Our primary authentication infrastructure is provided by Supabase (Supabase, Inc.). Supabase manages the secure storage of authentication credentials, session tokens, and user identity data. When you register with an email address or through a third-party provider, Supabase processes your authentication data on our behalf. Supabase acts as a data processor under the GDPR. For more information, please refer to Supabase's privacy policy at https://supabase.com/privacy.

4.2 Google Sign-In

You may authenticate using your Google account via Google Sign-In. When you choose this method, Google will ask you to grant the App permission to access certain information from your Google account. We receive your name, email address, and profile picture. We do not gain access to your Google account password, Google Drive content, or other Google services data. Google's use of your information is governed by Google's Privacy Policy. You may revoke the App's access to your Google account at any time through your Google account settings.

4.3 Apple Sign-In

You may authenticate using your Apple ID via Sign in with Apple. Apple allows you to share or hide your email address using the "Hide My Email" feature, which provides a unique, random email address that forwards to your personal email. We receive your name (if you choose to share it) and either your real email or the private relay email address. We do not gain access to your Apple ID password or any other Apple services data. Apple's use of your information is governed by Apple's Privacy Policy. You may stop using Sign in with Apple at any time through your Apple ID settings.

5. Third-Party Service Providers

We engage third-party companies and services to facilitate and improve the App. These service providers have access to your personal data only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose. Each provider acts as a data processor under the GDPR where applicable.

For information about how these third-party providers handle your data, we encourage you to review their respective privacy policies:

• Supabase: https://supabase.com/privacy
• Google (Firebase, Maps, Sign-In): https://policies.google.com/privacy
• Firebase: https://firebase.google.com/support/privacy
• RevenueCat: https://www.revenuecat.com/privacy
• Apple: https://www.apple.com/legal/privacy/

6. Third-Party Data and Statistical Information

The App may display competition, league, and match data sourced from third parties, including information related to football competitions organized by the Football Association of the Czech Republic (FAČR) and other football governing bodies.

The display of third-party competition data does not imply any affiliation, endorsement, or partnership between the Operator and any football association, league, or other third-party data source, unless explicitly stated otherwise.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your information in the following limited circumstances:

• With other users of the App - Certain information you provide is visible to other users as part of the App's functionality. This includes your name, profile picture, team memberships, game participation, aggregated player ratings, XP level, and availability status. Chat messages are shared with the intended recipients (team members or direct message participants).
• With service providers - We share data with the third-party service providers listed in Section 5, strictly for the purposes described in this Privacy Policy and subject to contractual obligations of confidentiality and data protection.
• For legal reasons - We may disclose your personal data if required to do so by law, or in the good faith belief that such disclosure is reasonably necessary to: (a) comply with a legal obligation, court order, or lawful request from public authorities; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the App; (d) protect the personal safety of users of the App or the public; or (e) protect against legal liability.
• Business transfers - In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal data.
• With your consent - We may share your information for any other purpose with your explicit consent.

8. International Data Transfers

Your personal data may be transferred to and processed in countries other than the country in which you reside. In particular, our service providers (including Supabase, Google/Firebase, RevenueCat, and Apple) may process data in the United States and other jurisdictions outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA to countries that have not been deemed to provide an adequate level of data protection by the European Commission, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreements with service providers.
• Adequacy decisions by the European Commission, where applicable (e.g., the EU-U.S. Data Privacy Framework for certified U.S. companies).
• Other legally recognized transfer mechanisms under the GDPR.

You may request further information about the specific safeguards applied to the transfer of your personal data by contacting us at the address provided in Section 19.

9. Data Retention and Deletion

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law. The specific retention periods depend on the nature of the data and the purpose for which it was collected:

• Account data - retained for the duration of your account's existence. When you delete your account, your personal data is permanently deleted or anonymized within 30 days, unless retention is required by law.
• Chat messages - retained for the duration of the relevant team's existence or until the team administrator deletes the content. When you delete your account, your messages may be retained in anonymized form within team conversations.
• Analytics data - retained in accordance with Firebase Analytics' default retention policies (typically up to 14 months), after which it is aggregated and anonymized.
• Crash data - retained for up to 90 days in Firebase Crashlytics for diagnostic purposes.
• Purchase and subscription data - retained as required by tax and accounting regulations, typically for a minimum of 10 years under Czech law.
• Location data - processed in real time and not stored on our servers. Location data processed by Google Maps is subject to Google's retention policies.

Deleting Your Data

You may delete your account and associated personal data at any time through the App's settings (Profile > Account > Delete Account). Upon account deletion, we will permanently erase or anonymize your personal data within 30 days, except where retention is required by law.

Alternatively, you may request account deletion by contacting us at roman@pickupsports.eu. We will process your request without undue delay and in any event within one month of receipt.

10. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR with respect to your personal data:

• Right of access (Article 15) - You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data along with information about how it is processed.
• Right to rectification (Article 16) - You have the right to request correction of inaccurate personal data and completion of incomplete personal data. You can update most of your information directly within the App's profile settings.
• Right to erasure ("right to be forgotten") (Article 17) - You have the right to request deletion of your personal data under certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, or when you withdraw your consent.
• Right to restriction of processing (Article 18) - You have the right to request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to data portability (Article 20) - You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible.
• Right to object (Article 21) - You have the right to object to the processing of your personal data based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Article 7(3)) - Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint - You have the right to lodge a complaint with a supervisory authority. In the Czech Republic, the relevant authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

To exercise any of these rights, please contact us at roman@pickupsports.eu. We will respond to your request without undue delay and in any event within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of your request.

We may ask you to verify your identity before processing your request. We will not charge a fee for exercising your rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

11. Cookies and Similar Technologies

The App itself is a native mobile application and does not use browser cookies. However, the following technologies and identifiers may be used within the App or by our third-party service providers:

• Firebase instance IDs and tokens - used by Firebase Analytics and Firebase Cloud Messaging to identify app installations and deliver push notifications. These are device-level identifiers, not browser cookies.
• Advertising identifiers - We do not collect or use advertising identifiers (IDFA on iOS, GAID on Android) for advertising purposes. Firebase Analytics may collect a device advertising identifier, which you can reset or opt out of through your device settings.
• Local storage - The App uses local device storage (e.g., SharedPreferences on Android, UserDefaults on iOS) to store your preferences, session tokens, and cached data for performance optimization. This data remains on your device and is not transmitted to our servers except as described in this Privacy Policy.

Our website (https://jedenactka.app) may use cookies and similar tracking technologies. Please refer to our website's cookie policy for details.

12. Push Notifications

We use Firebase Cloud Messaging (FCM) to send push notifications to your device. Push notifications are used to inform you of:

• New team chat messages and direct messages.
• Game and event updates (e.g., new events, event cancellations, roster changes).
• Team invitations and join requests.
• Important service announcements and updates.

To deliver push notifications, we store a device push token associated with your account. This token is provided by Apple Push Notification Service (APNs) on iOS or Firebase Cloud Messaging on Android.

You may opt out of push notifications at any time by adjusting your notification preferences in your device's operating system settings. Disabling push notifications will not affect the core functionality of the App, but you may miss timely updates about games and messages.

When you are actively viewing a specific team chat within the App, push notifications for new messages in that chat are suppressed to avoid redundant alerts.

13. In-App Purchases and Subscription Data

The App offers a PRO subscription and other in-app purchases. All payment processing is handled by the respective app stores (Apple App Store and Google Play Store). We do not collect, process, or store your payment card details, bank account information, or other financial payment data.

Subscription and purchase management is facilitated by RevenueCat, which acts as a middleware between the App and the app stores. RevenueCat receives and processes:

• Your anonymized user identifier (app user ID).
• Purchase and subscription transaction data (product identifiers, purchase dates, expiration dates, renewal status).
• The app store from which the purchase was made.

RevenueCat does not receive your name, email address, or other personally identifiable information directly from us. For more information, see RevenueCat's privacy policy at https://www.revenuecat.com/privacy.

Subscription management (including cancellation and refund requests) is handled through the respective app store. We retain records of your subscription status for the purpose of granting access to PRO features and for accounting and tax compliance as required by law.

14. User-Generated Content

The App allows you to create and share content, including but not limited to:

• Profile information (name, profile picture, bio).
• Team names and descriptions.
• Game and event details.
• Chat messages (team chats and direct messages).
• Player ratings and reviews.
• Availability status updates (e.g., injury, vacation).

You are solely responsible for the content you create and share through the App. Content that you make available to other users (such as your profile name, profile picture, team membership, and event participation) may be viewed by those users. Chat messages are visible to the members of the respective team chat or the recipient of a direct message.

We reserve the right to remove or disable access to any user-generated content that violates our Terms of Service, applicable laws, or the rights of others, including content that is defamatory, abusive, obscene, or otherwise objectionable.

Player ratings are submitted anonymously. While we store the association between a rater and a rating internally for integrity purposes, the identity of raters is not disclosed to the rated player or to other users.

15. Security of Data

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in transit - All data transmitted between the App and our servers is encrypted using TLS (Transport Layer Security) protocols.
• Encryption at rest - Personal data stored in our database (Supabase) is encrypted at rest using industry-standard encryption.
• Access controls - Access to personal data is restricted to authorized personnel and systems on a need-to-know basis. Supabase enforces Row Level Security (RLS) policies to ensure that users can only access data they are authorized to view.
• Secure authentication - Passwords are hashed using secure, industry-standard algorithms. Authentication sessions are managed using secure tokens with appropriate expiration policies.
• Regular security updates - We regularly update our software dependencies and infrastructure to address known security vulnerabilities.

However, no method of transmission over the Internet and no method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law.

16. Children's Privacy

The App is not intended for use by children under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you are aware that your child has provided us with personal data without your consent, please contact us at roman@pickupsports.eu.

If we become aware that we have collected personal data from a child under the age of 16 without verification of parental consent, we will take steps to delete that information from our servers promptly. If you believe that we may have inadvertently collected information from a child under 16, please contact us immediately so that we can take appropriate action.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App's features, legal requirements, or other operational, legal, or regulatory reasons. When we make material changes to this Privacy Policy, we will:

• Update the "Last updated" date at the top of this page.
• Post the revised Privacy Policy on this page and within the App.
• Where required by applicable law or where changes are material, provide additional notice (such as an in-app notification or a push notification) prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of the App after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

18. Governing Law and Jurisdiction

This Privacy Policy and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Czech Republic, without regard to its conflict-of-law provisions.

Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of the Czech Republic, unless mandatory consumer protection laws in your jurisdiction provide otherwise.

Nothing in this Privacy Policy shall limit your rights as a data subject under the GDPR or other applicable data protection legislation. If you are located in the EEA, you retain the right to lodge a complaint with your local supervisory authority regardless of the governing law specified herein.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

We will endeavor to respond to all legitimate inquiries within a reasonable timeframe and in any event within one month of receipt, as required by the GDPR. If your request is particularly complex or you have made a number of requests, we may extend this period by up to two additional months, in which case we will notify you accordingly.

© 2024–2026 Roman Štěpka. All rights reserved.