Privacy Policy

Tactiq Fantasy

Draft — first pass only. Not reviewed by a lawyer. Do not publish as final without legal review. See README.md in this folder for the specific open issues.

Effective date: [DATE] Last updated: [DATE]

1. Who we are

Tactiq Fantasy is currently operated by Carlo Ascobereta Arcaute and Theoharris Ouzounidis as individuals (the "data controller" for the purposes of this policy, jointly). You can reach us about anything in this policy at ascoberetacarlo@gmail.com.

This policy explains what personal data we collect through the Tactiq Fantasy website and app (the "Service"), why we collect it, who we share it with, and the rights you have over it — written to comply with the EU General Data Protection Regulation (GDPR), since our users are expected to be located in Spain and other EU countries including Germany, Italy, France, and the Netherlands.

2. What data we collect

Account data. When you sign up, we collect your email address and a password. Your password is hashed by our authentication provider (Supabase) — we never see or store it in plain text.

Game data. As you use the Service, we store the data you generate playing it: your fantasy squad, weekly lineups, transfer history, and the points/scores computed from those selections.

Usage and log data. Like most web services, our hosting provider (Vercel) automatically logs standard technical data with each request, such as IP address, browser/device information, and timestamps, primarily for security, abuse prevention, and diagnosing problems.

Cookies. We currently use only strictly necessary cookies, specifically an authentication session cookie (set by Supabase via our login system) that keeps you signed in. We do not currently use analytics or advertising cookies.

We do not currently collect payment information, and we do not collect any special categories of data (health, religion, political opinions, etc.) — nothing about the Service asks for or needs that kind of data.

3. How we use your data

We use the data above to:

Create and manage your account, and let you sign in;
Operate the core game: build and score your squad, run your lineups, calculate standings, and show you and other league members the results;
Maintain the security and integrity of the Service (for example, detecting abuse or unauthorized access);
Communicate with you about your account or material changes to the Service or these policies;
Diagnose and fix technical problems.

We do not sell your personal data, and we do not currently use it for advertising or share it with advertisers, because the Service does not currently run ads. If that changes — see Section 9.

4. Legal basis for processing (GDPR)

We process your data on these legal bases:

Performance of a contract — creating your account and running the core game (squad, lineups, scoring, standings) is necessary to provide the Service you signed up for.
Legitimate interests — securing the Service, preventing abuse, and diagnosing technical issues, balanced against your privacy interests.
Consent — where we ask for it explicitly (for example, if we introduce optional cookies or communications in the future).

5. Who we share data with

We use a small number of third-party service providers (data processors) to run the Service:

Supabase — hosts our database and handles authentication (sign-up, sign-in, password storage). Supabase processes your account and game data on our behalf.
Vercel — hosts the application and processes standard request/log data as described in Section 2.
TheStatsAPI — supplies public football match and player statistics used to calculate scores. This is a one-way data source: we send it requests for match data, and it does not receive any personal data about you or other users.

We don't share your personal data with any other third party, and we don't sell it. We may disclose data if required by law, to protect our legal rights, or to prevent fraud or abuse.

6. International data transfers

Our database is hosted by Supabase in the US East region (N. Virginia, us-east-1), and our application is served via Vercel's infrastructure, which may process requests outside the EU. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards (such as Standard Contractual Clauses) provided by these vendors.

[Open flag, not yet resolved: the database is currently hosted in the US, not the EU. Since your users are expected to be primarily in Spain and other EU countries, moving the Supabase project to an EU region before public launch would meaningfully simplify this section and reduce transfer-related risk — worth doing regardless of what the lawyer says. This is a real infrastructure change (new project + data migration), not a documentation fix, so flag it for prioritization rather than treating it as done.]

7. How long we keep your data

We keep your account and game data for as long as your account is active. If you delete your account (Section 10), we'll delete or anonymize your personal data within a reasonable period, except where we need to retain limited data for legal, security, or dispute-resolution purposes.

[Placeholder — a specific retention period, and what happens to historical league/scoring data that involves other users when one user deletes their account, should be defined with your lawyer.]

8. Your rights

If you're in the EU/EEA, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate data;
Erase your data ("right to be forgotten"), subject to certain exceptions;
Restrict or object to certain processing;
Port your data to another service in a structured, machine-readable format;
Withdraw consent at any time, where we rely on consent;
Lodge a complaint with your local data protection authority (for example, Spain's AEPD, Germany's respective state DPA, France's CNIL, Italy's Garante, or the Netherlands' Autoriteit Persoonsgegevens) if you believe we've mishandled your data.

To exercise any of these rights, contact us at ascoberetacarlo@gmail.com. We'll respond within the timeframe required by GDPR (generally one month).

9. Children's privacy and minimum age

The Service is intended for users aged 16 and over — chosen because it clears the GDPR digital-consent age in every currently-targeted country (Germany and the Netherlands require 16, France 15, Spain and Italy 14), rather than setting a different minimum per country. Users under the age of majority in their country should only use the Service with a parent or guardian's consent.

If we learn we've collected personal data from a child below the applicable age without proper consent, we'll take steps to delete it. Parents or guardians who believe their child has provided us data without consent can contact us at ascoberetacarlo@gmail.com.

10. Deleting your account and data

You can request deletion of your account and associated personal data at any time by contacting us at ascoberetacarlo@gmail.com. We'll process deletion requests within a reasonable time, subject to the retention exceptions in Section 7.

11. Advertising and future changes to data use

The Service does not currently display ads or use advertising/analytics cookies. If we introduce advertising in the future, we will update this policy before doing so to describe: what ad partners are used, what data and cookies they use, and how you can manage or withdraw consent (via a cookie-consent mechanism, as EU law requires for non-essential cookies). We will not enable ad tracking for EU users without first obtaining valid consent as required by the ePrivacy Directive and GDPR.

12. Security

We rely on our infrastructure providers' (Supabase, Vercel) security practices, including encryption in transit and hashed password storage, and follow reasonable practices to protect data within our own control. No system is perfectly secure, and we can't guarantee absolute security of your data.

13. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version with a new "Last updated" date, and for material changes, we'll make reasonable efforts to notify users directly (such as an in-app notice or email).

14. Contact

Questions, requests, or complaints about this policy: ascoberetacarlo@gmail.com