Privacy policy
Effective 23 October 2026
Bora FC helps groups organise their weekly futebol: who's in, who paid, teams, results and the MVP vote. This page explains what personal data we use, why, who we share it with and what you can do about it. We keep it short and collect only what the app needs.
Who is responsible
Bora FC is run by Gabriel Gomes Pacheco, Malta, who is the data controller for the personal data described here. Contact: hello@borafc.com.
What we collect
- Account: your name, email address and password. Passwords are stored only as a salted hash (scrypt); we can't read them. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Profile: your preferred position, if you set one.
- Groups and matches: the groups you join and your role, the matches you sign up for or drop out of, your place on the waitlist, whether you marked or were confirmed as paid, your team, the score, your goals and assists, no-shows, and your MVP votes.
- Ratings: group organisers can give players a strength level (1–5) to balance teams, which the app adjusts from results. Only that group's organisers can see it.
- Guests: if you bring a guest, the name you type for them.
- Card payments: when card payments are on, Stripe processes your card. We never see or store card numbers; we keep the amount, the date, the status and Stripe's reference for the payment.
- Technical data: a session cookie that keeps you signed in, and standard server logs (such as IP address and browser) kept by our hosting provider for security and troubleshooting.
- Usage statistics: anonymous, aggregated page views through Vercel Web Analytics, which uses no cookies and doesn't identify you.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, groups, matches, payments tracking, teams, results, stats and badges | Performing our contract with you (Art. 6(1)(b)) |
| Sending service emails: email confirmation, password reset, waitlist promotions, reminders, results | Performing our contract with you (Art. 6(1)(b)) |
| Balancing teams with organiser ratings; keeping the service secure; anonymous usage statistics | Our legitimate interests in fair games and a safe, working service (Art. 6(1)(f)) |
| Keeping payment records where the law requires it | Legal obligation (Art. 6(1)(c)) |
We don't sell your data, show ads or use your data to train AI models.
Who can see your data
- Members of your groups see your name, picture, position, the matches you join, payment status, teams, results, stats, badges and the leaderboard.
- Group admins also see your email address, to manage the group.
- Organisers also see the strength ratings used for balancing teams.
- Anyone with a match's share link sees the match details (title, time, place, how many spots are left), but no names.
Service providers
We use these companies to run Bora FC. They process data on our behalf and only for this purpose:
- Vercel (hosting and anonymous analytics; United States, with servers in Frankfurt, Germany)
- Neon (database; Frankfurt, Germany)
- Resend (sending emails; Ireland)
- Google (only if you choose "Sign in with Google")
- Stripe (card payments, when switched on). For payments, Stripe acts as an independent controller under its own privacy policy, and the organiser of the match receives the payment through their own Stripe account.
Where a provider is based outside the European Economic Area, transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Your account and match data: for as long as you have an account.
- When you delete your account, we straight away delete your email, password, sign-ins, profile, group memberships, ratings and MVP votes, and remove you from upcoming matches. Database backups roll over within 7 days.
- Past match line-ups keep an anonymous "Former player" in your place, so scores and other players' stats stay correct. It can't be linked back to you.
- Records of card payments are kept in that anonymous form, and Stripe and the organiser keep their own payment records as the law requires.
Your rights
You can, at any time:
- Access and take your data: download it as a file from your profile ("Download my data").
- Correct it: edit your name and position on your profile.
- Delete it: delete your account from your profile.
- Object or restrict how we use your data, for example to organiser ratings, by emailing hello@borafc.com.
We answer requests within one month. If you're unhappy with how we handle your data, you can complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt) or your local data protection authority.
Cookies
We use one essential cookie to keep you signed in. We don't use advertising or tracking cookies, so there is no cookie banner.
Age
Bora FC is for people aged 16 and over.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it applies. The date at the top shows the latest version.
Contact
Questions or requests about your data: hello@borafc.com.