Privacy Policy
Last updated: October 2026
Introduction
Kompetr is a web application for organizing private, amateur sports games among friends, colleagues, and other invited participants. It provides tools for managing participants, schedules, attendance, teams, results, player statistics, game history, and in-app communication. This Privacy Policy explains how personal data is collected and used when you access kompetr.com, use the Kompetr web application, contact us, or use a future Kompetr mobile application. Kompetr also enables organizers to publish games, logged-in players to discover and apply to join them, and players to communicate privately with authorized organizers about a game.
Who controls your personal data
The data controller is Jonasz Adamski, operating the Kompetr service. Privacy enquiries and requests may be sent to privacy@kompetr.com. General enquiries may be sent to hello@kompetr.com. Kompetr is currently operated by an individual and not by a registered company. These details will be updated if the legal operator of the service changes.
Scope of this policy
This policy applies to kompetr.com, the Kompetr web application, related account and support communications, invitation emails, and any future official Kompetr mobile application that refers to this policy. It does not apply to independent third-party websites, applications, payment pages, or services that have their own privacy policies.
Personal data we collect
Depending on how you use Kompetr, we may collect: account and profile data, such as your first name, last name, email address, password credentials in protected form, optional phone number, language, optional profile photo, and account settings; private game and group data, such as game or competition names, teams, schedules, invitations, attendance, availability, scores, player ratings, statistics, and game history; content you submit, such as chat messages, chat images, team names, notes, and support messages; subscription and transaction information, such as plan, subscription status, transaction references, invoices, tax information, billing country, and limited payment-related details received from Paddle, but not full card details; invitation information, including an invited person's email address and the identity of the user requesting or approving the invitation; and technical data, such as IP address, browser and device information, timestamps, logs, cookie identifiers, consent choices, and security or anti-abuse signals. For game discovery we process published competition/game details, sport and playing characteristics, venue/address label and coordinates, date, time, price and currency, capacity and available places, and recruitment deadlines; application identifiers, submission times, status, organizer decisions and game changes; and organizer-question text, conversation/game links, sender identity, message identifiers and timestamps, read records and notification metadata. Search locations and filters are also processed as explained below. A published venue/address label and its coordinates describe where the game is played, not a player’s personal location. For nearby-game searches, Kompetr processes the search centre and radius you select; if you choose “My location” and allow browser geolocation, the browser supplies device coordinates, which may use GPS or other device positioning. These search coordinates are not shown to organizers as your location. You can use a manually selected place instead. Search filters and the selected location are saved locally in your browser for convenience, and search coordinates are sent to Kompetr to find nearby games. Place-search text is processed by the location providers identified in the Recipients and service providers section.
Required and optional account information
Your first name, last name, email address, and password are required to create and secure an account. Without them, an account cannot be created and Kompetr's core functionality cannot be used. Passwords are stored only in an appropriately protected, non-plain-text form. A phone number and profile photo are optional, and not providing them does not prevent use of the core service. If a competition administrator does not provide a phone number, participants simply cannot contact that administrator by phone through the competition information section.
Phone numbers and administrator contact details
You may optionally provide your own phone number in your profile. An ordinary participant's phone number is not displayed to other participants. If you are the current administrator of a competition and have provided a number, it may be shown in that competition's information section to its authorized participants so they can contact you. It is not intended to be publicly visible outside that competition. Removing the number, leaving the competition, or ceasing to be its administrator removes it from active administrator-contact views. Please provide only your own phone number.
Where personal data comes from
We receive personal data directly from you when you register, create or update a profile, use Kompetr features, purchase a subscription, contact us, or choose cookie settings. We may also receive data from other users, for example when an administrator, co-administrator, or existing participant invites you, records attendance, enters a match result, or manages player information. Service providers such as Paddle, Google, Resend, and Cloudflare may provide transaction, analytics, delivery, consent, security, or technical information generated through your use of their services.
How we use personal data
We use personal data to create and manage accounts; provide private game-management features; process invitations and membership requests; manage administrators and co-administrators; record attendance, results, statistics, rankings, and game history; enable chat and profile features; provide Free, Pro, and Elite functionality; administer trials, subscriptions, renewals, cancellations, and customer support; send essential emails such as account verification, password reset, invitations, service notices, and billing messages; protect Kompetr against fraud, spam, bots, misuse, and security threats; diagnose errors and improve reliability; comply with legal, tax, accounting, and consumer-protection obligations; perform analytics where permitted by your consent; and, only if you opt in, send future product news, updates, and offers. We also use these data to publish and search game listings, show available places, process applications and organizer approval, manage withdrawals and game changes, record game-fee payment information entered by admins, deliver game-related notifications, and provide private questions and replies between a player and the authorized organizers.
Legal bases for processing under GDPR
Where the GDPR applies, we rely on: performance of a contract or steps requested before entering into a contract, when processing is necessary to create your account, provide Kompetr features, manage subscriptions, or respond to service requests; consent, for optional analytics, future marketing communications you request, and other activities where consent is required; legitimate interests, including operating and improving the service, securing accounts and systems, preventing abuse and fraud, handling support, maintaining useful private game records, and understanding service performance, provided those interests are not overridden by your rights; and compliance with legal obligations, including tax, accounting, payment, consumer-protection, law-enforcement, and data-protection requirements. Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object as explained below. Processing necessary to provide the game listing, search, application and organizer-message functions you request is based on performance of our service contract (Article 6(1)(b) GDPR). Necessary abuse prevention and handling of reports may rely on the legitimate interests described above (Article 6(1)(f)), subject to your rights. Acknowledging this Privacy Policy does not constitute GDPR consent. The optional device-location permission lets your browser provide coordinates when you request that feature; you can instead select a search location manually.
Invitations and information added by other users
Membership of a private competition normally requires an email invitation approved by an administrator or co-administrator. An existing participant may request that a new person be invited, but the invitation is sent only after approval. If we receive your email address for an invitation before you create an account, we use it to send and manage that invitation, protect the invitation process, and prevent misuse. If you do not accept, we retain invitation information only for as long as reasonably necessary for those purposes. You may contact privacy@kompetr.com to ask us to stop processing an invitation address, subject to legal and security exceptions. Game discovery provides a separate application route: logged-in users may apply to a published game without an email invitation. Approval by an authorized organizer is required, and joining that game does not itself make the applicant a member of the private competition.
Who can see information inside Kompetr
Profile details, profile photos, group information, attendance, results, statistics, rankings, game history, and chat content may be visible to other authorized participants in the same private game or competition, according to their role and the feature being used. Administrators and co-administrators may have additional permissions to manage participants, schedules, results, settings, and content. Users should not upload information about another person unless they are authorized to do so and the information is appropriate for the private group. Published listings are available to logged-in users through game discovery, including users outside the competition. They show the competition name, sport and playing characteristics, venue/address label and coordinates, date and time, price and currency, available places and recruitment deadline. This is a game directory, not a public player directory or general player search. When you apply or receive approval, the current competition owner and authorized admins can see your nickname, or first name if no nickname is set, optional profile photo, and application identifier, time and status to identify you and manage participation. The application view does not disclose your email address, phone number or full private profile. Approved guests may also appear in the game’s attendance, teams and results under the existing access rules; approval does not open the competition’s private information to the guest.
Chat messages, images, and operator access
Chat messages and images are protected in transit using TLS/HTTPS. Access to a chat image requires authentication and confirmation that the requester participates in the relevant conversation or competition. New files stored in Amazon S3 and database backups transferred to S3 request server-side encryption using AES-256 or AWS KMS, according to deployment configuration. Chat is not end-to-end encrypted: Kompetr processes message content, and appropriately authorized persons with infrastructure or database access may technically access it. Such access must follow least-privilege rules and be limited to justified operational, security, support, incident-handling, or legal-compliance purposes. Private conversations are not represented as being routinely read or actively moderated. Game-specific organizer conversations are a separate text-only feature. The player and the current competition owner and authorized admins can access the conversation while the game remains available in this feature; other applicants and ordinary competition members have no access merely because they participate. Kompetr processes the text and sender display name, optional applicant photo, conversation and message identifiers, game/application links, timestamps, read records and in-app notification metadata to deliver and manage it. This feature does not automatically expose either party’s email address or phone number and does not email the message text. Information you choose to type in a message is visible to its authorized recipients. The operator-access safeguards above also apply to these conversations.
Cookies and similar technologies
We use cookies, local storage, session storage, pixels, tags, and similar technologies for authentication, security, preferences, consent management, analytics, payment-related interactions, and core application functionality. Technologies strictly necessary to provide and protect the service may operate without consent where permitted by law. Optional analytics technologies are activated only after consent where required. You can review or change your choices through the privacy and cookie settings link available in the Kompetr interface. Further information is provided in the Cookies Policy.
Analytics and third-party services
If you consent to analytics cookies, we may use Google Analytics 4 to understand visits, navigation, device types, approximate location, and product usage. Kompetr's cookie settings record and apply your relevant consent choices. Google Search Console is used to monitor search visibility and technical website performance and does not itself place analytics cookies on your device through Kompetr.
Optional future marketing communications
Kompetr does not currently send newsletters or marketing messages. If you voluntarily select the separate marketing checkbox, Kompetr may send product news, updates, and offers in the future on the basis of your consent. Consent is optional: refusing it does not affect account creation or access to the service. You may withdraw it at any time through the newsletter setting in your account; if marketing messages are introduced, they will also provide an unsubscribe route. Withdrawal does not affect processing carried out before it. Marketing data is processed until consent is withdrawn or the activity ends; a limited consent record may be retained where necessary to demonstrate compliance. Before any external marketing email provider is used, this policy will identify that provider and its role.
Payments and Paddle
Paid subscriptions are offered through Paddle. Paddle acts as the merchant of record for transactions made through its checkout, meaning that Paddle handles payment processing, applicable taxes, invoicing, fraud prevention, refunds, and certain customer-service functions under its own terms and privacy notice. Kompetr receives information needed to activate and administer your subscription, such as your customer or transaction reference, selected plan, subscription status, billing country, currency, payment status, renewal or cancellation status, and limited invoice or tax information. Kompetr does not receive or store your full payment-card details.
Recipients and service providers
We disclose personal data only where necessary to operate, protect, support, or legally administer Kompetr. Recipients may include hosting, database, infrastructure, backup, monitoring, and deployment providers; Paddle for checkout, subscriptions, taxes, invoicing, fraud prevention, refunds, and its customer portal; Resend for transactional emails; Google Workspace for support and business communications; Google Analytics and related Google services where enabled and permitted; Cloudflare Turnstile for bot and spam protection; professional advisers such as lawyers or accountants where necessary; and public authorities where disclosure is legally required. Service providers may act as processors, independent controllers, or both, depending on the service and applicable law. We do not sell personal data. Game listing and applicant data and organizer conversations are shared with the audiences described above. Location search uses Kompetr’s server to send the entered search text to Photon (Komoot) and, where needed, Nominatim (OpenStreetMap) to resolve places. MapLibre displays maps loaded from OpenFreeMap; those direct map requests disclose technical request data such as IP address to the map service. If you open an external Google Maps link, the venue query is sent to Google and that service’s own privacy rules apply. These providers support location and map features; they are not recipients of game applications or organizer messages through those features.
Data retention
We retain personal data only for as long as reasonably necessary for the purposes described in this policy. Account and profile data is generally retained while your account is active. Private competition/chat messages and their associated images are automatically removed from the active system after 365 days by a daily retention process. Backups are retained separately for a limited period under the applicable backup-retention policy. Invitation data is retained for the period needed to deliver and manage invitations and prevent misuse. Private game records, results, statistics, and history may be retained while the relevant group remains active and may later be deleted or anonymized. Subscription, invoice, transaction, tax, accounting, fraud-prevention, and legal records may be retained for statutory limitation and record-keeping periods. Technical and security logs are retained for periods proportionate to operational and security needs. We may anonymize information instead of deleting it where it can no longer identify an individual. For game-specific organizer questions, the cleanup process removes messages at least 365 days old once the game is no longer current in that feature, together with related read records and message notifications/events. Conversation access ends earlier when the game is cancelled, removed or otherwise ceases to be current, normally no later than ten minutes after its scheduled start (or its scheduled end if earlier); loss of access is not immediate deletion. Account deletion removes messages authored by that account and, for a deleted applicant, all messages in that applicant’s organizer conversations, and detaches the account identity from retained application records. Application and game/payment history follow the existing game-history and lawful-retention rules rather than a new fixed period. Saved discovery filters, including the selected search coordinates and label, remain in your browser until replaced or browser storage is cleared. To prevent repeated introductory trials, we retain a keyed fingerprint of the normalized email address and the date eligibility was recorded, without keeping the raw email or deleted profile in this record. The record remains while the relevant account is active and for 730 days after account deletion; expired records are removed by a daily cleanup process. This fingerprint is pseudonymous personal data and is used only to check trial eligibility, not for marketing.
Account deletion
You may request account deletion through account settings, where available, or by emailing privacy@kompetr.com. We may ask you to verify your identity before acting on the request. Deletion removes or de-identifies account information from active systems, subject to technical processing time and lawful retention requirements. Chat content and private uploads are deleted in accordance with the retention rules above. Historical results, statistics, and game records may remain only in anonymized or de-identified form where reasonably necessary to preserve the integrity of a private group's history. Limited information may be retained for legal claims, security, fraud prevention, accounting, tax, payment disputes, or compliance.
Your data-protection rights
Where the GDPR applies, you may have the right to access your personal data, correct inaccurate or incomplete data, request deletion, restrict processing, receive certain data in a portable format, object to processing based on legitimate interests, and withdraw consent at any time. You may also lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). To exercise a right, email privacy@kompetr.com and describe your request. We may need to verify your identity and may refuse or limit a request where permitted by law. We will respond within the period required by applicable law.
Additional rights for residents of certain US states
Residents of California and certain other US states may have additional rights concerning access, correction, deletion, portability, and the use or disclosure of personal information. Kompetr does not sell personal information. Some analytics activities may be treated as sharing under particular state laws. Where applicable, you may manage consent through our privacy settings or contact privacy@kompetr.com. We do not discriminate against users for exercising applicable privacy rights.
International data transfers
Kompetr is available internationally, and our service providers may process personal data in countries outside the European Economic Area. Where the GDPR requires safeguards, transfers are based on an adequacy decision, approved Standard Contractual Clauses, another legally recognized transfer mechanism, or a permitted exception. We also use contractual, technical, and organizational measures designed to protect transferred data. You may contact privacy@kompetr.com for further information about applicable safeguards.
Automated decisions and profiling
Kompetr may use automated calculations to generate player statistics, rankings, comparisons, or balanced-team suggestions from information entered into the service. These product features do not produce legal or similarly significant effects concerning users. We do not currently use personal data to make solely automated decisions that produce legal or similarly significant effects under Article 22 GDPR.
Children's privacy
Kompetr is not directed to children under 13, and users in the European Economic Area must be at least 16 unless a lower age is validly permitted by the law of their country and any required parental authorization has been obtained. We do not knowingly collect personal data from a child who cannot lawfully provide it. If you believe that a child's personal data has been provided improperly, contact privacy@kompetr.com so that we can investigate and take appropriate action.
Security
We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. Measures may include access controls, authentication safeguards, encryption in transit, restricted administrative access, logging, backups, anti-abuse controls, and security updates. No internet service or storage system can be guaranteed to be completely secure. You are responsible for protecting your login credentials and notifying us promptly if you suspect unauthorized account access.
Changes to this policy
We may update this Privacy Policy to reflect changes to Kompetr, our providers, legal requirements, or privacy practices. The date at the top shows when the policy was last updated. Where a change materially affects users or requires renewed consent, we will provide additional notice or request consent as required by law.
Contact
Data controller: Jonasz Adamski, operator of Kompetr. Privacy and data-protection requests: privacy@kompetr.com. General enquiries: hello@kompetr.com. Kompetr has not appointed a Data Protection Officer because one is not currently required. Please do not send passwords, full payment-card details, identity documents, or other unnecessary sensitive information by email unless we specifically request a secure method for verification.