Privacy Policy

Who is responsible for your data

GPDO is the controller for the personal data described here. For anything to do with your data — access, correction, deletion, a complaint, or a question about this policy — write to office@gpdo.app. A person reads it. The operator's full registered details are available on request at the same address.

What GPDO collects

Plainly, before the detail: an email address and a password, an @username, optionally your full name, and your date of birth. Photos and videos you upload, captions and comments you write, messages you send, the games you create and join, and — only while the map is open — your device location.

Your live location is read on the device and is never written to our servers. Your date of birth is never shown to anyone. Your age appears only next to your name on the player list of a game you join.

The full list

Email address: Account identity and sign-in. Held by Firebase Authentication and in our own database. Never shown to other users, and it cannot be used to find you in search.
Password: Held by Firebase Authentication. It never reaches our servers in any form, hashed or otherwise.
@username and full name: Your @username is shown to other users and is how people find and mention you. Your full name is optional and stays hidden unless you turn on Show my full name in Privacy & Security; if you are under 18 it is always hidden.
Date of birth: Used to enforce the minimum signup age of 16, to apply the protections for users under 18, and to show your age on game player lists. If you are 16 or 17, we also record when you confirmed that a parent or guardian agrees. The date itself is never shown to anyone else, and it cannot be changed once it is set — write to us to correct a genuine mistake.
Profile photo: Optional.
Posts, reels, captions, reel titles, comments: The content you publish, and who liked it. A like from someone under 18 on an adult's post is counted, but the adult is never told who gave it.
Chat messages and their photos: One-to-one and group conversations, including match chats.
Matches: The games you create, join, leave or are invited to, and the pitch and time they are at. If you join a game, your username (and your full name, if you have chosen to show it), photo and age appear on its player list, which anyone signed in who can see the game can open, even before joining and even if your account is private. If you are under 18, adults see you there only as a numbered player, and other under-18s see your details only when they are playing in the same game.
Follows, blocks and reports: Your social graph, and the moderation actions you take.
Last active day: The date, without a time, on which you last used the app, recorded once a day. It is used to find accounts that have been inactive for a long time, which may be deleted.
Precise location: Read on your device while the map is open, to centre the view and measure distance. Not transmitted to or stored on our servers.
Home base: Optional — you can skip it at signup and set it later in Settings → Privacy & Security; without one you simply do not get notifications about games nearby. A point you choose yourself so the map has an anchor when device location is off. This one is stored — for users under 18 only at district or postcode-area level (about 5 km), never as an exact point. It is never shown to other people. It is used to suggest people who play nearby, and being suggested to someone reveals at most that your home bases are within about 50 km of each other.
Push token: The device identifier Apple or Google needs to deliver a notification. Removed when you log out.
Crash and performance data: Only if you turn on Send crash reports in Privacy & Security. Sent to Sentry with personal data switched off, so a report says a screen crashed without saying whose phone it was.

Not collected: advertising identifiers, contacts, health or fitness data, payment or card data (there is no payment code in the product), browsing history outside the app, and background location. There are no advertising SDKs and no third-party analytics, in the app or on this website. Nothing here is "tracking" in Apple's sense — we do not combine your data with third-party data for advertising and we do not sell or share it with data brokers.

Why we are allowed to hold it

To run the service you asked for — Article 6(1)(b), performance of a contract: Your account, profile, content, matches, chat and notifications.
To keep the service safe — Article 6(1)(f), legitimate interests: Content moderation, reports, blocks, bans, abuse rate limits, and server error diagnostics. Our interest is a usable and lawful service; the processing is limited to what that needs.
To meet a legal obligation — Article 6(1)(c): The age check, responding to lawful requests, and retaining moderation records involving illegal content.
With your consent — Article 6(1)(a): Device location and push notifications, which your phone asks you for; crash reports; and the optional notification types — likes, friends' activity, new games and pitches nearby and today's games — which start switched off and are turned on in the app. You can withdraw any of them at any time, in your phone's settings or in the app.

Who else processes it

Everyone below acts on our instructions as a processor. None of them is allowed to use your data for their own purposes.

Google — Firebase Authentication: Email, password, user id. Global infrastructure including the United States.
Google — Firebase Storage: Your uploaded photos and videos. Global infrastructure including the United States.
Google — Firebase Cloud Messaging / Apple — APNs: Push tokens and notification payloads, to deliver notifications.
Google — Maps SDK: Renders the map on your device and receives what any map needs to draw a view.
OpenAI — text moderation: A processor in the United States. Post text, comments, reel titles and reel comments are screened by OpenAI's moderation model before they publish. Chat messages are never sent to it. This is the disclosure most easily missed, because it is invisible in the app.
Sentry — crash and performance reports: Only active where a reporting key is configured, and configured not to send personal data.
Hetzner Online — hosting: The API, our own media scanner and this website. Nuremberg, Germany.
Neon — managed PostgreSQL: The database. EU region.

Image and video scanning runs on our own service on the Hetzner machines, for photos and videos in posts, reels, profiles and pitch listings; photos sent in a chat are not scanned. Your media is not sent to a third-party moderation company on the normal path.

Data leaving the EU

Google, OpenAI, Apple and Sentry may process data in the United States. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses otherwise, together with a data processing agreement in each case.

How long we keep it

Your account and its content: for as long as the account exists. Deleting the account deletes them — see deleting your account.
Deleted content: a post, comment, reel or message you delete disappears for everyone at once; its text is kept for 30 days for moderation, then erased.
Games: a game's chat closes 24 hours after it ends; the game, its player list, its chat and its photos are deleted 90 days after it ends.
Moderation records — a report, a ban and its reason — are kept after the content is gone so the same abuse can be recognised again. Where the subject's account has been erased they no longer identify a person.
Crash reports: on Sentry's retention schedule, and not linked to an identity.
Server logs: kept for at most 31 days. They may contain technical identifiers such as your account id; the server in front of our app does not log IP addresses or the query part of web addresses.
Database history that our database host keeps for restores sits outside the deletion flow by design. It is overwritten within 6 hours and is never used to restore a deleted account. There are no other database backups.

Your rights

Under the GDPR you can ask for access to your data, correction of it, its erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. You can also withdraw consent for location, notifications or crash reports at any time, in your phone's settings or in the app, without affecting what was lawful before.

Erasure: Built in and immediate: Profile → Settings → Delete account, or the web route if you have already uninstalled. It is a hard delete.
Access and portability: There is no self-service export yet — an honest gap. Email office@gpdo.app from your account address and we will assemble it. We answer within one month.
Correction: Most of it you can edit yourself in the app. Anything you cannot, we will.
Complaints: You can complain to your national data protection supervisory authority. We would rather you told us first at office@gpdo.app.

Children

GPDO is not directed at children. The minimum signup age is 16 — the same in every country GPDO covers, across the EU, the EEA and Switzerland. The check runs on our servers at signup and refuses accounts below it. Your date of birth is self-declared: this is an age gate, not identity verification. Under 16, signup is refused and there is no parental-consent route; at 16 or 17 you confirm that a parent or guardian agrees.

Users aged 16 and 17 get further protections, enforced on our servers rather than only in the app. Their account is always private and cannot be made public until they turn 18. Under-18 and adult accounts cannot follow each other, send each other direct messages, be added to the same group chat or comment on each other's posts, and they do not appear in each other's search results or suggestions. An under-18 can like an adult's public post or reel; the adult sees that it was liked, never by whom. Games organised by an under-18 are visible only to under-18s. On a game's player list adults see each under-18 only as a numbered player, and an under-18 sees another under-18 by name only when both are playing in that game; under-18s see adult players by username, photo and age, including adults whose accounts are private. When someone turns 18, the follows, chats and games they already had with under-18 friends carry on, but nothing new can start. An under-18 home base is stored only at district or postcode-area level, about 5 km, never as an exact point. And because a date of birth cannot be changed once it is set, nobody can re-date themselves across the 18 line; a genuine mistake can be corrected by writing to office@gpdo.app.

Our standards and reporting route for child sexual abuse and exploitation are set out separately in the child safety standards.

This website

These pages are static files. They set no cookies, run no analytics and load no tracker — even the typeface is served from this domain, so your browser contacts nobody but us. That is why you were not asked to accept anything. They are served from our own server in Nuremberg, Germany, which keeps no log of your visit; it records only errors, without your IP address.

Changes

If we change this policy in a way that matters, we will change the version at the top and say so in the app. Continuing to use GPDO after that means the new version applies.

Questions: office@gpdo.app. See also the terms of use and the plain-language trust & privacy summary.

Privacy policy