Privacy Policy

Last updated · August 12, 2026 · Version 2026-08-12

1. Information We Collect

1.1 Information you provide

• Account details — name, username, email address, password, profile photo, favorite club, player positions, nationality, and any other details you add to your profile.
• Adult eligibility — your deliberately entered date of birth, accepted policy versions and time, assessment time, and self-declared eligibility result. DOB is kept in a private server-only record and is not copied to your public profile.
• Group & activity data — group descriptions, activity preferences, availability, RSVP status, attendance history, and chat or match notes you submit.
• Photos and media — profile photos, group logos and covers, and other images you choose to upload.
• Support requests — questions or feedback submitted to support channels.
• Website venue booking data — contact details, booking details, and payment status when you choose to book an eligible venue on futtos.app.

1.2 Information we collect automatically

• Usage data — app interactions, feature engagement, referring screens, crash/error diagnostics, and performance metrics.
• Device data — device type, operating system, language, time zone, mobile network, and device identifiers.
• Location data — the approximate area you choose for discovering games, and your precise location only if you grant location permission (used to suggest nearby groups, pitches, and games while you use the app — we never access your location in the background).

1.3 Information from third parties

• Authentication providers — tokens or profile basics when you sign in with Google or Apple.
• Group admins / teammates — if someone invites you or records your participation, they may provide your email or display name.

2. How We Use Information

We use your information to assess and enforce the 18+ access requirement, record policy acceptance, provide and personalize the Services, communicate, ensure safety, and market only if you opt in. Eligibility uses self-declared DOB and is not KYC or verified age.

2.1 Legal bases (EU/EEA/UK users)

Where the GDPR (or UK GDPR) applies, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and run your account and provide the core Services: authentication, group memberships, scheduling, RSVPs, live scores, stats, and voting.
• Legitimate interests (Art. 6(1)(f)) — to keep the Services safe and functioning: fraud/spam detection, content moderation, security, crash diagnostics, and improving features. We balance these interests against your rights and only rely on them where appropriate.
• Consent (Art. 6(1)(a)) — for optional marketing communications and for accessing your device location, camera, and photos. You can withdraw consent at any time (see Section 5), without affecting processing already carried out.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with the law, including child-safety reporting.

3. Sharing & Service Providers

We do not sell your personal data. We share data only when necessary to operate the Services:

• Google Firebase (Google LLC) — authentication, database (Cloud Firestore), file storage, cloud functions, hosting, and push notification delivery. This is where your account and content live.
• Google Maps — map display and place lookup for pitches and venues.
• Sentry (Functional Software, Inc.) — crash and performance reporting. We strip email addresses, usernames, and IP addresses from crash reports before they are stored; crashes are associated only with a pseudonymous ID.
• Expo (650 Industries, Inc.) — push notification delivery infrastructure.
• Midtrans — payment processing for eligible venue bookings made on futtos.app. Futtos does not receive or store your full card details.
• Group members — your profile, stats, and activity are visible to the groups and games you join. That's the point of the app.
• Legal & safety — when required by law or to protect users (for example, responding to valid legal requests or reporting child safety violations to authorities).
• Business transfers — in the event of a merger, acquisition, or asset sale, with notice to you.

4. Data Retention & Deletion

We retain account data while you actively use the Services. You can delete your account at any time:

• In the app — Profile > Settings > Delete Account. This immediately deletes your profile, authentication record, uploaded user files, memberships, private notifications, authored comments/messages/feed posts, and attributable participation data. Where you own a shared club, venue, or tournament, ownership is transferred to an existing co-admin or active member when available; otherwise the shared record is deactivated or retained without your identity so other participants and historical results are not unexpectedly erased.
• On the web — via our account deletion page, processed within 30 days.

We may keep minimal records where required for legal, accounting, fraud-prevention, dispute, or chargeback purposes (for example, anonymized moderation reports and transaction records).

5. Your Rights & Choices

Access & update — edit profile and group information in the app. Exact DOB is private and not directly editable; request correction at support@futtos.app. Public age is optional and server-derived; disabling it deletes the public value. Delete — use in-app controls, the web deletion page, or email support. You can also opt out of marketing and revoke device permissions.

5.1 Your rights under the GDPR (EU/EEA/UK)

If you are in the EU, EEA, or UK, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — delete your account and data, as described in Section 4.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests.
• Data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller where technically feasible.
• Withdraw consent — where processing is based on consent (e.g. marketing, device permissions), withdraw it at any time without affecting prior processing.

To exercise any of these rights, use the in-app controls or email support@futtos.app. We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority — for example, the data protection authority in your EU member state, or the ICO in the UK — though we would appreciate the chance to address your concern first.

5.2 Automated decision-making

The server calculates age from your self-declared DOB to enforce the 18+ contract requirement. A result below 18 denies access. This is not profiling, KYC, or verified age; contact support to correct inaccurate DOB information or contest a result.

6. Security

We use industry-standard safeguards such as encryption in transit, access controls, device integrity checks, and monitoring. No system is 100% secure — use a strong password and keep your device updated.

7. Adult-Only Service

Futtos is an adult-only service and no person under 18 may use it. Accounts assessed as under 18 are denied access. If you believe a person under 18 accessed Futtos, contact support@futtos.app so we can investigate and restrict the account. See also our Community Standards.

8. Where Your Data Is Stored

Your data is stored on Google Firebase infrastructure (primary region: Jakarta, Indonesia) and may be processed in other countries where our service providers operate. Where cross-border transfer mechanisms are required, we rely on our providers' safeguards such as Standard Contractual Clauses.

9. Changes to This Policy

We may update this policy to reflect new features, legal requirements, or business practices. We notify users through the app or email when material changes occur.

10. Data Controller & Contact

The data controller responsible for your personal data is PT. Mayuca Digital Studio, Jl. Raya Uma, RT 000, RW 000, Tampaksiring, Tampaksiring, Kabupaten Gianyar, Bali 80552, Indonesia. Questions or privacy requests: support@futtos.app.

For EU/EEA and UK users: you can direct any data-protection questions or requests to support@futtos.app. Where a representative under Article 27 of the GDPR is required, their contact details will be published here.

You also have the right to lodge a complaint with your local supervisory authority (see Section 5).