YOUR DATA.
YOUR CONTROL.

WHAT WE COLLECT

• • Account: email, display name, optional avatar.
• • Match data: opponents, scores, set details, points.
• • Match evidence: GPS (only when you tap GPS-confirm), table QR scans, photo (only when you tap photo-confirm).
• • Device fingerprint hash (anti-fraud, never displayed).
• • Communication preferences (push token, language).

WHAT WE DON'T

• • Sell or rent your data to third parties.
• • Track you across other apps or websites.
• • Collect a continuous location stream — only one fix per match.
• • Show targeted ads.

PHOTO EVIDENCE

Photos taken via the in-app camera for L4 verification are stored on our infrastructure. They are NEVER shown on your public profile unless you explicitly publish them via the gallery opt-in toggle.

YOUR RIGHTS (GDPR)

You have the right to access, rectify, port, restrict, and delete your personal data. Self-service is available in your account:

• • Export (Art. 20 — portability): /dashboard/settings → "Export my data". Returns a JSON dump of everything we hold on you.
• • Delete (Art. 17 — erasure): /dashboard/settings → "Delete my account". Requires password re-entry. Irreversible: all rows tied to your account cascade-delete (matches, ranking events, badges, orders, photos).
• • For anything else (restrict processing, object, withdraw consent), email privacy@sellito.it. We respond within 30 days.
• • You can also lodge a complaint with the Italian Garante per la Protezione dei Dati Personali (garanteprivacy.it) — your competent supervisory authority under GDPR.

DATA CONTROLLER

Street Pong is operated as an independent project by an individual based in Italy. For the purposes of GDPR Art. 4(7), the data controller can be reached at privacy@sellito.it. No DPO is appointed because we do not meet the thresholds of GDPR Art. 37 (small-scale, voluntary use, no special categories of data processed at scale).

PROCESSORS

We use these third parties to run the service. Each is bound by their own DPA and contractual safeguards (SCCs where applicable):

• • Vercel (US/EU) — website hosting + CDN.
• • Cloudflare (US/EU) — reverse proxy, DDoS protection, tunnels.
• • Brevo (EU) — transactional email (verification, order confirmation).
• • Firebase Cloud Messaging (US/EU) — push notifications (only if you enabled them in the app).
• • PayPal (US/EU) — EUR shop payments. We never see your card or PayPal credentials.
• • Minimax (Singapore) — AI photo verification on match evidence (hash + image bytes are sent; no PII).
• • Self-hosted infra — Postgres, Redis, MinIO on a server in Italy (Proxmox VE on premises).

RETENTION

• • Account profile: until you delete it.
• • Match data: until you delete your account (then anonymized for ranking integrity).
• • Evidence photos: 90 days for L4-AI-verified matches, then purged unless flagged for moderation.
• • Audit log (ModerationAction): 24 months, then purged.
• • Telegram bridge messages: 30 days rolling.
• • Server logs: 14 days rolling.

COOKIES

privacy.cookiesBody