Who we are
The data controller is Kacper Kępiński, trading as Kacper Kępiński IT, Michała Kleofasa Ogińskiego 5/100, 03-318 Warszawa, Poland, NIP 5222788066. Write to privacy@hopami.com about personal data or hello@hopami.com for other help.
About this policy
This policy describes the data used by Hopami’s website and account services. Descriptions of optional features apply when you use an available feature. Website game examples are illustrations, not live records of people or bookings.
Account and game data
Sign-in uses an email code, Google or Apple, not phone authentication. We receive your email and the identity information supplied by your chosen sign-in provider. Hopami processes your profile name, optional photo, district, sports and skill levels, games, participation, attendance and reliability, chat messages, safety reports, and payment instructions and payment status. Information comes from you, the sign-in provider and other participants or organizers recording game activity. Do not put sensitive information in your profile or messages.
Location and visibility
Your exact personal location is not stored. Coordinates may be transmitted to the server for proximity queries; venue locations are stored separately. Other players see profile and game information permitted by the game’s visibility rules, including your name, photo, district and reliability. Game chat is for participants; reports are available to authorized reviewers. Your sign-in email is not shown to players or organizers. Payment instructions can include an organizer’s bank account or BLIK details; authorized participants can see them. Hopami tracks payment status but does not process payments between players and organizers.
Why we use data
Account, game and purchase-entitlement processing is necessary to provide the requested service (GDPR Article 6(1)(b)). Security, abuse prevention, report review and ordinary support rely on legitimate interests in a safe, functioning service (Article 6(1)(f)), balanced against your rights. Rights requests and mandatory records rely on legal obligations (Article 6(1)(c)). Optional website analytics rely on consent (Article 6(1)(a)). Required account or form fields are needed to provide those functions; analytics are optional. Attendance records inform reliability; contact us to contest an incorrect record or request human review of a restriction.
Providers and transfers
Supabase hosts the app database and authentication in Frankfurt, Germany. Google and Apple handle sign-in when selected. RevenueCat manages Pro purchase entitlements with Google Play and the App Store; the stores process payment details. Resend uses the EU email region for website contact, receipt and verification-code mail. Cloudflare hosts the website, Turnstile bot checks and the durable request store. Cloudflare necessarily processes network information, including IP addresses, to serve and protect requests; no raw IP is retained in our form store. Keyed email/network counters expire after one hour. EU hosting does not mean that every provider operation stays in the EU. Provider access and transfers outside the EEA require an applicable legal safeguard, such as an adequacy decision or standard contractual clauses; ask us for details. Contact privacy@hopami.com for details of the providers and safeguards relevant to your data.
Optional website analytics
Only after Allow, eligible informational pages send a page-view count and language to PostHog EU through our server. No person or device IDs or visitor IP addresses are retained in this analytics flow; each event has a fresh random identifier that is not reused to follow a visitor. We do not forward full URLs, queries, referrers, form content or browser fingerprints. Contact, deletion and game-link pages are excluded. There is no advertising, session replay or tracking profile. Your choice is stored locally for six months. Change it in the footer privacy choices to stop future collection; previously sent counts cannot be linked back to you. Website counts are retained in PostHog for 12 months. This describes website counts only, not app analytics.
Website retention
Contact name, email, topic and message stay in the delivery queue until delivery succeeds, or at most 24 hours from submission; queued personal content is cleared after successful delivery. Minimal duplicate-prevention results expire after 24 hours. Delivered contact mail is kept in the support mailbox for up to 12 months, with manual cleanup. Resend also processes delivery records under its service settings; contact us for details of those settings.
A six-digit deletion verification code expires after 10 minutes. Pending verification data expires with it; after successful confirmation the challenge’s email and queued code are cleared. A consumed confirmation result is retained for 24 hours to make retries safe. The verified request and its email remain until a person resolves it, even if notification mail fails. Queued notification content is cleared after delivery acknowledgement. Resolution clears the email; only the request identifier, reference and resolution time remain for 90 days. Unresolved requests do not silently expire.
App retention and deletion requests
Account and game data are retained while needed to operate the account and game history; report records may be needed to investigate abuse or legal claims. The applicable period depends on the purpose and any legal need to retain a record. Backup copies follow their normal secure rotation rather than disappearing immediately after a request.
The website verifies email access and records a request for manual handling. It does not delete an account or confirm that data have been erased. A person will explain what happens next and any information that must be kept. You can still write to privacy@hopami.com. A person must check identity and relevant account/game obligations and explain any lawful retention; your statutory rights remain available.
Your rights and contact
Subject to the applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Write to privacy@hopami.com; we may request proportionate identity verification. You may complain to the President of the Polish Personal Data Protection Office (UODO) or your local supervisory authority. See the European Commission’s explanation of data rights. We update this page when processing changes and provide additional notice where required.