This Privacy Policy describes how Sporler (“we”, “us”) processes your personal data when you use sporler.net. We follow the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG).
For our identity and contact details, see Imprint.
1. Data we collect
When you create an account:
- Email address (required for authentication)
- Username (you choose this; visible to other users)
- Optional display name
- If you sign in with Google: your Google account email and basic profile info as authorized by you
When you use the service:
- Predictions, ratings, watchlist entries, fighter follows, friend connections
- Timestamps of these actions
Automatically when you visit:
- IP address (logged briefly by Cloudflare for security/DDoS protection)
- Browser type, device type, language
- An essential session cookie (set when you sign in)
2. How we use it and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide accounts and authentication | Art. 6(1)(b) — performance of contract |
| Display picks/ratings to others (leaderboard, friends) | Art. 6(1)(b) — performance of contract |
| Send transactional emails (magic link, account) | Art. 6(1)(b) — performance of contract |
| Defend against abuse, fraud, security incidents | Art. 6(1)(f) — legitimate interest |
| Comply with legal obligations | Art. 6(1)(c) — legal obligation |
We do not use your data for advertising or sell it to third parties.
3. Sub-processors
We share limited data with the following providers, each bound by a Data Processing Agreement:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase Inc. | Database, authentication | EU (Stockholm) |
| Cloudflare Inc. | Hosting, CDN, DDoS protection, email routing | Global edge (may transit US) |
| Resend | Transactional email delivery | US (DPF-certified) |
| Google LLC | “Sign in with Google” OAuth (only if you choose this option) | US (DPF-certified) |
| SportsAPIPro | Combat sports data feed (we do not share your personal data with them) | — |
Transfers to US providers (Cloudflare, Resend, Google) rely on the EU-US Data Privacy Framework or, where applicable, the EU Standard Contractual Clauses.
4. Cookies
We use one essential cookie for authentication (your session). No analytics, advertising, or tracking cookies are used. Because the cookie is strictly necessary, no consent banner is required under §25(2) TTDSG.
If you disable cookies in your browser, you won't be able to sign in.
5. Data retention
| Data | Kept until |
|---|---|
| Account data (email, username, display name) | You delete your account |
| Predictions, ratings, follows, watchlist | You delete them, or delete your account |
| Authentication logs | 90 days |
| Cloudflare access logs | 7 days |
After account deletion, all your personal data is removed from our systems within 30 days, except where retention is required by law.
6. Your rights (GDPR / DSGVO)
You have the right to:
- Access the data we hold about you (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Delete your account and data (“right to be forgotten”) (Art. 17)
- Restrict processing under certain conditions (Art. 18)
- Portability — receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, email privacy@sporler.net. We'll respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. The competent German authority is your federal-state data-protection commissioner; you can find yours at www.bfdi.bund.de.
7. Security
Data is encrypted in transit (HTTPS/TLS via Cloudflare) and at rest (Supabase managed encryption). Access to production systems is restricted to authorized maintainers and audited. We do not collect or store passwords — authentication is via magic-link or OAuth (Google).
8. Children
Sporler is not intended for users under 16. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, contact us and we'll remove it.
9. Changes to this Policy
We'll post material changes at the top of this page with a new “Last updated” date and, where required by law, notify registered users by email at least 14 days in advance.
10. Contact
Privacy requests: privacy@sporler.net
Operator details: Imprint