Your location never leaves your phone.

Location is read on your device, and not stored

While you have the map open, GPDO reads your position on the phone to centre the view and measure distances. That position is not written to our servers.

If you would rather not share it at all, set a private home base pin instead and the map anchors there. There is no background tracking and GPDO never asks for your contacts.

Photos and videos are checked before they are stored

Every photo and video in a post, reel, profile or pitch listing is scanned for nudity before it is ever written to the database or to storage. Unsafe uploads are rejected on the spot; they do not sit in a queue waiting for someone to look at them.

The scanner is our own, running on European servers — media is not shipped off to a third-party moderation company in the normal path. It is tuned deliberately over-cautiously for a sports app, and it fails closed: if the scanner is down, uploads are refused rather than let through. Video is sampled about one frame every two seconds and stops at the first unsafe frame. Post text, comments, reel titles and reel comments are screened before they publish; chat messages and the photos sent in them are not scanned, and reach a moderator only when someone reports them.

Report and block

Report a post, comment, reel, reel comment, chat message or person in two taps, under one of 13 categories: intellectual property infringement, hate speech and harassment, terrorist content, child sexual abuse, sexual content, violence and gore, self-harm and suicide, privacy violation, advertising or promotion, spam, deceptive content, impersonation, or other illegal content. Every report needs a short written explanation of up to 500 characters. Every report goes to a moderator, and reports of terrorist content or child sexual abuse go first. The moderator removes the content, warns or suspends the account, or takes no action, and the person who reported it is told the decision.

Blocking is mutual and silent, in both directions: no messages, profile, feed, reels, search, follows or notifications either way. It severs any existing follows, and the person is never told. Blocked accounts live on one searchable screen with one-tap unblock.

You decide how visible you are

A private account means only approved followers see your posts, reels and details; everyone else gets a lock screen. Your username, photo and age still appear on the player list of a game you join.

People are identified by @username. Your age appears only next to your name on the player list of a game you join; your date of birth never does, and neither does your email address, which cannot be used to find you in search either. Anyone signed in who can see a game can open its player list, even before joining, and notifications about strangers’ games carry only the pitch, never the organiser’s name or face.

If you are 16 or 17, your account is always private until you turn 18, and our servers keep under-18 and adult accounts apart: they can’t follow each other, message each other, share a group chat or comment on each other’s posts, and neither appears in the other’s search results or suggestions. An under-18 can like an adult’s public post or reel; the adult sees that it was liked, never by whom. Games organised by an under-18 are visible only to under-18s. On a game’s player list adults see each under-18 only as a numbered player, and an under-18 sees another under-18 by name only when both are playing in that game; under-18s see adult players by username, photo and age. When someone turns 18, the follows, chats and games they already had with under-18 friends carry on, but nothing new can start. An under-18 home base is stored only at district or postcode-area level, about 5 km, never as an exact point.

Deletion that actually deletes

Erasure is a hard delete, not a flag: login, media, posts, reels, comments, likes, messages, devices, notifications, follows and blocks. Anything that still has to reference you reparents to an anonymous "Deleted User".

It also scrubs your name and photo out of notifications other people had already received, and sanitises the erasure record itself. It runs on an event as soon as you ask — not on a nightly sweep — and retries itself if anything fails. How to delete your account.

No ads, no trackers, European infrastructure

There are no advertising SDKs in GPDO, no third-party analytics, no advertising identifiers and no card data — there is no payment code in the product at all. This website sets no cookies and loads no tracker, which is why you have not been asked to accept anything.

The one diagnostic tool we do run is Sentry, for crash and performance reports. It is configured not to send personal data, so it tells us a screen crashed without telling us whose phone it was.

The API and the moderation service run on Hetzner Cloud in Nuremberg, with managed Postgres in the EU and TLS throughout. The full list of processors — including OpenAI, which screens text — is in the privacy policy.

Still being built

One thing is an honest gap rather than a feature, and we would rather say so here than have you find out later.

A one-click export of your data. The GDPR right to portability is real and we have not built the button yet. Deletion works, in the app and on the web; export does not. Ask us at office@gpdo.app in the meantime and a person will put it together for you.