Privacy Policy
Last updated: 16 October 2026
Data controller
The controller is Matchball, Martin Mucha, sole trader, Košice, Slovakia, company ID 57 799 032, contact support@matchballapp.com. We process your personal data in accordance with the GDPR (EU) 2016/679.
What we collect
Name, email, date of birth, gender, country, profile photo (or chosen avatar) and details of your bookings, reviews and messages. For coaches also city, pricing, years of experience, licence number and training location. For coaches also company ID, tax ID, address and IBAN (for direct payments) and the verification documents they upload. Also photos you send in a private chat or group, records of rewards (mystery boxes) and invites, and credit records in groups. We do not collect phone numbers. From the phone you sign in on we store its device identifier in hashed form (not the advertising identifier), so that a blocked user cannot create a new account on the same phone. When you open an invite on matchballapp.com on an iPhone, we store a fingerprint (hash) of your IP address — not the address itself — together with your screen size, language and time zone, so the app can recognise the invite after installation and you do not have to type the code; we delete them after 24 hours and use them for nothing else.
Purpose
We use your data to connect players with coaches, process payments, enable communication, keep the service safe and meet our legal obligations.
Legal basis and retention
For each purpose we give the legal basis under Art. 6 GDPR and the retention period.
Account, profile, bookings, chat and payments → performance of a contract (Art. 6(1)(b)) → while you have an account.
Payment records and accounting → legal obligation (point c) → 10 years.
Coaches’ tax and identification data (company ID, tax ID, address, IBAN) and DAC7 reporting → legal obligation (point c) → 10 years.
Coach verification (licence, documents) → legitimate interest in safety and trust (point f) → document file 30 days after the verification decision; the record of the outcome while you have an account.
Photo checks, reports and moderation → legitimate interest and legal obligation under the Digital Services Act (points f, c) → a profile photo is visible only to its author until decided; report records while you have an account.
Phone notifications → performance of a contract (training reminders, messages) → while you have an account.
Location → consent (point a) → not stored.
Usage statistics (PostHog) → legitimate interest in improving the app (point f); you can turn them off in Settings at any time → until you turn them off or delete the account.
Crash reports (Sentry) → legitimate interest in service stability (point f) → as long as needed to fix the bug.
Recognising an invite on iPhone → legitimate interest (point f) → 24 hours.
Preventing abuse after an account is blocked (device identifier in hashed form) → legitimate interest (point f) → while you have an account; if the account is blocked, 3 years, even if you delete the account.
Invite and game rewards (mystery boxes) → performance of a contract and legitimate interest in preventing abuse (points b, f) → while you have an account.
Community chats → performance of a contract (point b) → messages 180 days.
Chat photos → performance of a contract (point b) → until the message is deleted, at most 1 year.
Credit in groups → performance of a contract and legitimate interest (points b, f) → while the group exists; see Backups.
Public coach profile with reviews → performance of a contract and legitimate interest (points b, f) → while you have an account.
Location
If you allow it, we use your approximate device location to show nearby coaches and local weather. We do not store your location or track you in the background. You can revoke the permission in your phone settings at any time.
Notifications
If you allow notifications, we store a device token (push token) so we can send you training reminders and messages. They are delivered by Expo via the Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android). You can turn notifications off in your phone settings at any time.
Payments
Payments are processed by Stripe Payments Europe. Card details never reach us — Stripe stores them. Coaches complete identity verification (KYC) directly with Stripe. If a coach opts for direct payment, we also store their bank account IBAN and show it to the player at booking so they can make the transfer.
Tax reporting (DAC7)
As a platform we are required by the DAC7 directive to report coaches’ identification and tax details, along with their Matchball earnings, to the tax authority once a year. This data is kept separate from the public profile and concerns coaches only.
Who we share with
Supabase (database and files, EU), Stripe (payments), Expo (notifications), Sentry (crash reports — we send only an account identifier, never your name or email), PostHog (“Usage statistics”, which you can turn off in Settings, EU servers — which screens and features you use, pseudonymously, i.e. with an account identifier, never your name, email, messages or payment details; you can turn them off in Settings; on the matchballapp.com website we count visits and link taps without cookies and without any identifier), Google (sign-in, if you use it, the map on Android, notifications on Android and automated screening of your profile photo and chat photos for inappropriate content via Google Vision SafeSearch), Apple (sign-in, if you use it, and weather forecasts — only the coordinates of the training location are sent), the Slovak register of individuals in sport (when a coach verifies a coaching licence, the IDFO identifier they entered is sent there) and the tax authority as required by DAC7. GitHub (website hosting and private backup), Expo (also for building and updating the app). We do not sell your data or use it for advertising.
Transfers outside the EU
The database and files (Supabase), statistics (PostHog), crash reports (Sentry) and payments (Stripe Payments Europe) are in the EU. Some providers may also process your data in the USA: Expo/EAS (notifications, app updates), Google (Vision for photo checks, Firebase Cloud Messaging, Google Play, sign-in), Apple (APNs, Sign in with Apple, weather), Stripe and GitHub (website hosting and backup). Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (SCC).
Community chats
Community chats (All Slovakia / All Czechia and your city chat) are visible to all their members. We add you to the country and city chat automatically based on the country and city in your profile; members see your name and profile photo next to your messages. You can leave a community at any time. Messages in community chats are deleted after 180 days; photos cannot be sent in them. Communities are moderated by a Matchball administrator.
Chat photos
You can send photos in private chats and in groups. We store them in private storage and only members of that conversation can see them. Every photo is automatically checked for inappropriate content after it is sent (Google Vision SafeSearch). If it looks inappropriate, an administrator reviews it and may remove it. Otherwise an administrator does not see a photo unless someone reports it. We delete the photo together with a deleted message and at the latest one year after it was sent.
Coach documents
Documents for coach verification (e.g. a coaching licence) are uploaded to private storage; you and the Matchball administrator who decides on verification can see them. We delete the document file 30 days after the verification decision (or earlier if you delete your account); only a record that verification took place and its outcome remains.
Credit in groups
A group can keep a shared credit (who paid in and who paid what). Entries (amounts, dates, member names) are visible to group members. Matchball does not process money through the credit; it only records it. Besides the database we back it up once a day (see Backups).
Public coach profile and reviews
A coach profile (name, photo, city, sports, pricing, reviews) is public, including on matchballapp.com, and may appear in search engines. For reviews, the public page shows the reviewer’s first name and the first letter of the surname (e.g. “Peter N.”), their photo and the text. An anonymous review is shown in the app without the author’s name and is not shown on the public web page. Player reviews are visible to coaches only.
Automated checks
A profile photo is automatically checked for inappropriate content after upload (Google Vision SafeSearch). Until a decision, only its author can see it. If the check fails or is unsure, a person (administrator) decides. A chat photo is checked after it is sent; if it looks inappropriate, an administrator reviews it. We make no other decision about you solely by automated means.
Rewards and invites
When you invite a friend and they complete registration, you both get an in-game reward (mystery boxes). For that we record who invited whom (invite code) and the rewards you received. Rewards cannot be purchased and have no monetary value.
Backups
The main database runs on the provider’s infrastructure in the EU (Supabase). We back up group credit with our own daily export (amounts, dates and member names, not emails or photos); a backup is kept mostly for 60 days. After you delete your account your name may remain in older credit backups until they expire; on request we remove it from them.
How long we keep it
Account data until you delete your account. Payment records and tax data for 10 years, as accounting law requires. When you delete your account, your personal data, photos and documents are erased. Messages you sent and reviews you wrote stay with the other person under the name “Deleted user”. Retention periods for each purpose are listed in Legal basis and retention.
Age
Matchball is for people aged 16 and over. A parent books training for a child from their own account.
Your rights
You have the right to access, correct, delete and port your data, to restrict processing and to object. You can delete your account in the app (Profile → at the bottom → Delete account).
Complaints
If you believe we handle your data incorrectly, you can complain to the Slovak Data Protection Authority (dataprotection.gov.sk) or the authority in your country of residence.
Contact
For privacy questions contact us at support@matchballapp.com.