Privacy Policy

1. Introduction

Welcome to MatchReactions. We are committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, and safeguard your information when you use our service.

2. Account Data and Third-Party Login (Google OAuth)

When you sign in with Google, we receive your name, email address, and profile picture from Google. We use this data solely to create and manage your MatchReactions account. We do not access any other Google data (such as Calendar, Drive, YouTube, etc.).

Stored Data: We store the email address, name, and avatar URL provided by Google in our secure database, hosted with Supabase (see Section 8, Subprocessors). This allows us to identify your account and maintain your personalized overlays and settings.

Data Retention: We keep your account data as long as your account is active. If you choose to delete your account, this data will be permanently removed from our active systems.

3. User Uploaded Content

In order to provide our service, we store the content you actively upload or create, such as custom team names, team logos/crests, formations, and custom images.

This content is stored using our infrastructure provider, Supabase Inc., which hosts our database and file storage on Amazon Web Services (AWS) servers located in Frankfurt, Germany (EU region). No data is transferred outside the EU for this purpose. Supabase acts as our data processor under a signed Data Processing Agreement (DPA).

This content is retained for as long as your account is active, or until you choose to delete it from your dashboard. Upon account deletion, all associated uploaded content is permanently removed.

4. Match and Widget Data (Firebase)

To power your live overlays and polls in real time, we use Firebase (a Google Cloud service) to store and sync match state data, such as scores, game clock, lineups, and poll options. This data is hosted in the Europe-West region and does not contain personally identifiable information.

5. Cookies and Device Storage

We only use essential technologies (like server-side session cookies) that are strictly necessary to provide you with the service you requested (such as maintaining your logged-in state).

Because we do not store any non-essential information on your terminal device, and do not read any non-essential information from it, no consent is required under § 25(1) TDDDG. We rely on the exemption under § 25(2) no. 2 TDDDG for our essential authentication session.

Note: We do not use PostHog or any other analytics tools via cookies or device storage. See Section 6 for details on our cookieless analytics.

6. Analytics (PostHog)

We use PostHog, an analytics platform, to understand how our product is used so we can improve its usability, reliability, and performance.

• Cookieless & Non-Identified: Our PostHog configuration runs entirely in memory. It does not store cookies or access local storage on your device. Therefore, § 25(1) TDDDG consent is not required.
• No User Identification: We do not track or link analytics data to your individual user account or identity.
• IP Address Handling:Your IP address is discarded entirely by our analytics provider's edge servers. We also truncate it on the client-side as an additional safeguard, ensuring it remains fully pseudonymous and cannot be traced back to you.

Legal Basis for Processing (GDPR)

The processing of this pseudonymous analytics data is based on our legitimate interest (Art. 6(1)(f) GDPR) in analyzing user behavior to improve product usability, reliability, and performance. A documented Legitimate Interest Assessment (LIA) supports this processing.

Right to Object (Art. 21(1) GDPR)

You have the right to object to this processing. Because our analytics are cookieless, standard browser-based opt-out cookies do not apply. However, we respect global Do Not Track (DNT) signals. If you wish to object, you can enable DNT in your browser settings, or use standard ad/tracker blockers, which our system fully respects.

Data Transfer and Processors

PostHog processes data on our behalf, and we have executed a Data Processing Agreement (DPA) with them. Our PostHog instance is hosted in the EU, meaning no third-country data transfer occurs for this service. (Note: If US hosting is verified later, we rely on the EU-US Data Privacy Framework / SCCs.)

7. No Advertising

MatchReactions does not display advertisements, does not serve advertising scripts, and does not share your data with any advertising vendors.

8. Subprocessors

We use the following subprocessors to operate MatchReactions:

9. Data Location

Our database, file storage, and real-time sync infrastructure (Supabase, Firebase) are hosted within the European Union. Our website and backend functions are deployed via Vercel Inc., configured to run exclusively in Vercel's Frankfurt (EU) region. As Vercel Inc. is a US-based company, we rely on Standard Contractual Clauses (SCCs) as an additional safeguard for any technical data that may be processed by Vercel outside the EU (e.g. account/billing administration).

10. Contact and Rights

For any privacy-related inquiries, to request access to your data, or to exercise your rights under the GDPR, please contact us at fabian.gadau@gmail.com.