Privacy policy

The controller of your data is César Augusto Berroterán Yanes, a private individual resident in Spain and owner of Matchplay. For anything regarding your data you can write to [email protected] or use the contact page.

Email, username, hashed password (BCrypt), location at province/city/area level, favorite games, optional bio, session history, session chat messages and ratings received. We also keep minimal technical data (such as the IP address in security logs). That's it.

We process your data to: Provide the service — show you nearby sessions, let you create and join tables, manage chat and your account (legal basis: performance of the usage contract). Security and reliability — calculate your reliability status, prevent abuse and moderate the community (legal basis: legitimate interest). Optional emails — reminders, cancellations and notices you've enabled (legal basis: your consent, which you can withdraw at any time). Analytics cookies — only if you accept them in the banner (legal basis: your consent). We make no commercial use of your data and take no automated decisions with legal effects.

We don't sell your data or share it for commercial purposes, and there are no advertisers. To run the app we work with providers that process data on our behalf (Art. 28 GDPR): Hetzner (server and database, Germany), Cloudflare (CDN and protection), Resend (email delivery), New Relic (monitoring — aggregated metrics, none of your interaction content), Microsoft Clarity (heatmaps and session recordings to improve usability — only with your consent; the text you type is masked), Backblaze (encrypted backups, Germany), Plausible (cookieless web analytics, EU servers — aggregate metrics only, doesn't identify you) and Anthropic (AI-generated game summaries — it only processes public game descriptions, not your personal data). All your account data is hosted in the EU; some providers operate in the US under the EU–US Data Privacy Framework. We may also disclose data when required by law or a competent authority.

We keep your account data while your account is active. Chat messages and old sessions are automatically deleted on a regular basis once they're no longer needed. If you close your account, we delete or anonymize your personal data, except what we must keep to meet a legal obligation or resolve disputes.

You have the right to access, rectify, erase, object to, restrict and port your data. You can view, edit and delete most of it from your profile; to export everything or fully close your account, write to us at [email protected]. If you believe we're not handling your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Matchplay is not aimed at children under 16 and we don't allow them to register. If we detect an account belonging to someone under that age, we'll delete it. If you're a parent or guardian and believe a minor in your care has given us data, write to us and we'll erase it.

We apply technical and organizational measures to protect your data: HTTPS encryption on all traffic, passwords hashed with BCrypt, encrypted backups, access control and login rate-limiting. No system is 100% infallible, but if a breach occurs that poses a risk to your rights, we'll notify the supervisory authority and, where appropriate, the people affected, as required by the GDPR.

By default we only use strictly necessary cookies: the session cookie refresh_token (httpOnly, Secure, SameSite=Strict, 7-day lifetime) to keep you logged in across visits. Optional cookies (performance analytics via New Relic Browser and heatmaps / session recordings via Microsoft Clarity, with text masked) are only set if you tap Accept all in the banner — and you can revoke your decision any time from Manage cookies at the bottom of the page.

If we update this policy we'll notify you by email or a notice in the app and update the date above. We recommend reviewing it from time to time.

For any data request, write to us at [email protected] or via the contact page.