Privacy Policy

The data controller is:

Matthieu Toulemonde, operating as a sole trader (autónomo), N.I.E. Y0175263-V
Calle de Belén 6, 28004, Madrid
Contact: ToldYaWC@toldya.social

When you sign up:

• Email address
• Password (stored only as a secure hash — we never see it in plain text)
• Username
• Your confirmation that you are 18 or over (see Section 8)

What you can optionally tell us during onboarding: your country, the team you support, and how you heard about Told Ya. Every one of these questions can be skipped, and skipping has no effect on your account.

What you create by using the Service: your takes, calls, points and record, who you follow, your groups and group messages, any photo you upload, and reports you submit.

Your email preferences: whether you have consented to our newsletter and to notification emails. Both are off unless you turn them on.

Collected automatically: technical data such as IP address, device and browser type; and usage data such as actions taken and timestamps.

We do not intentionally collect special-category data (health, religion, etc.). Please don't put sensitive information in free-text fields.

• Create and run your account, and provide the game — performance of a contract
• Settle calls, run leaderboards and groups — performance of a contract
• Send essential service emails (confirmation, password reset) — performance of a contract
• Keep the Service secure and prevent cheating or fraud — legitimate interests
• Understand where people hear about Told Ya, to improve it — legitimate interests
• Send you our newsletter, or notify you by email when your calls settle — consent, which you can withdraw at any time
• Comply with legal, tax and accounting obligations — legal obligation

The two email consents are separate and both start off. We will not add you to either because you signed up — only because you turned that specific one on. You can turn either back off at any time, or email us to do it for you.

We don't sell your data. We share it only with service providers ("processors") who help us run the Service, under contract and only as needed:

• Supabase — database, authentication and backend hosting. Data stored in region: West EU (Ireland)
• Vercel — website/app hosting and delivery.
• Resend — sending account and service emails.

We may also disclose data where required by law, to enforce our Terms, or to protect rights, safety and security.

International transfers: if any processor stores or processes data outside the EEA (for example in the US), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30–90 days, except where we must keep limited records to meet legal, tax or fraud-prevention obligations.

We use only essential cookies and similar storage strictly necessary to log you in and keep the Service working — these don't require consent. We do not use advertising or tracking cookies, and we do not run third-party analytics on this app.

Under GDPR you have the right to: access your data; correct it; delete it; restrict or object to processing; data portability; and withdraw consent at any time. To exercise any right, email ToldYaWC@toldya.social. We'll respond within one month.

You also have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es.

The Service is intended for users aged 18 and over — a policy choice given the competitive, social nature of the Service. We ask for an age confirmation at sign-up and do not knowingly allow under-18s to register. If we learn that someone under 18 has created an account, we will close it and delete the associated data.

We use industry-standard measures (encryption in transit, hashed passwords, access controls) to protect your data. No system is perfectly secure, but we work to keep your information safe and will notify you and the AEPD of any breach where legally required.

We may update this policy. If we make material changes we'll notify you (e.g. by email or an in-app notice) and update the "Last updated" date above.

Questions about this policy or your data: ToldYaWC@toldya.social.