Privacy Policy

This is an English translation provided for convenience. The German version at startelf.at/datenschutz is legally binding.

This privacy policy informs you about which personal data we process when you visit the website startelf.at and when you use the Startelf app (iOS and Android), for what purpose this happens and which rights you have.

1. Data controller

The controller responsible for data processing within the meaning of the GDPR is:

David Krachler
Oeverseegasse 24
8020 Graz, Österreich
E-mail: support@startelf.at

2. Hosting

The website and the app backend are operated at AllInkl and Hostinger on servers located within the EU. The provider processes data exclusively on our behalf (processing on behalf of the controller pursuant to Art. 28 GDPR).

3. Visiting the website

Server log files

When you visit the website, technically necessary data transmitted by your browser is processed: IP address, date and time of access, page accessed, volume of data transferred, referrer URL as well as browser and operating system identifier. This serves the secure and stable provision of the website.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest).

No cookies, no tracking

The website sets no analytics, marketing or tracking cookies and does not embed any web analytics services.

Fonts (Google Fonts)

The website loads fonts from Google Fonts (Google Ireland Ltd.). In doing so, your IP address is transmitted to Google when the page loads. Legal basis: Art. 6 (1) (f) GDPR. Further information: policies.google.com/privacy.

4. Using the app

Registration & sign-in

An account is required to use the app. Sign-in takes place via Apple Sign-In, Google Sign-In or with an e-mail address and password. Authentication is handled via Firebase Authentication (Google). Among others, the e-mail address, display name and a unique user ID are processed. The e-mail address is verified before access is granted.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Profile and player data

You can voluntarily provide profile details, such as position, strong foot, height, date of birth, jersey number, country, profile picture and absences. This data is visible within your teams.
Legal basis: Art. 6 (1) (b) GDPR.

Team, event and chat data

When creating and managing teams, events, acceptances/declines and chat messages (including shared photos, videos and files), the respective content is stored on our server and displayed to the members of the team.
Legal basis: Art. 6 (1) (b) GDPR.

Push notifications

For reminders and notices (e.g. new events, pending responses) we use Firebase Cloud Messaging (Google). For this purpose a device token is processed. You can deactivate push notifications at any time in your device settings.
Legal basis: Art. 6 (1) (b) and (f) GDPR.

Subscriptions & payments

Manager subscriptions are concluded via the stores (Apple App Store or Google Play); payment processing is carried out exclusively by Apple or Google. To manage and check the status of subscriptions we use RevenueCat, Inc. In doing so, a pseudonymous user ID, purchase and subscription status as well as product and expiry information are processed – no complete payment data (credit card or similar).
Legal basis: Art. 6 (1) (b) GDPR.

Security & abuse protection

To protect against abusive use and automated requests, we verify the integrity of the app via Firebase App Check (Play Integrity on Android, App Attest on iOS). In doing so, device and integrity attributes are processed, but no profile content. To limit the frequency of requests, the IP address may also be processed briefly.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest).

Error and crash diagnostics (Sentry)

For stability and troubleshooting we collect crash and error reports as well as technical device and app information via the service Sentry (Functional Software, Inc.). No automatic transmission of your IP address or other personal data takes place; no user context is transmitted. Sentry is operated in the EU region, and the data is stored in the EU.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable and error-free operation).

4b. Tournament management (tournament.startelf.at)

For the tournament management we process the same account data as in the app (sign-in via Firebase Authentication) plus the tournament data you enter: tournament name, location, schedule, teams, rosters with names and shirt numbers, results and scorers. The legal basis is performance of the contract (Art 6(1)(b) GDPR).

Public tournament pages: once an organiser publishes a tournament, its schedule, standings and bracket are accessible via a link without signing in. Whether player names are shown is decided by the organiser via a tournament setting; they are responsible for that publication. Publication can be withdrawn at any time, after which the link no longer works.

Abuse protection: public tournament pages are rate-limited per IP address. The IP address is processed briefly in memory for this purpose (legitimate interest, Art 6(1)(f) GDPR) and is not stored.

Purchases on the web: when subscribing to the tournament management, your name, e-mail address and payment and invoice data are transmitted to RevenueCat and Stripe; card details never reach our servers. The legal basis is performance of the contract, and for retaining invoices the legal obligation (Art 6(1)(c) GDPR).

Error diagnostics: errors in the tournament management are reported to Sentry (EU region). No user or IP data is transmitted; links to public tournament pages are redacted before sending.

5. Recipients / processors

To provide our services we use the following service providers:

• Google (Firebase Authentication, Cloud Messaging & App Check) – sign-in, push and abuse protection
• Apple – Apple Sign-In and payment processing in the App Store
• Google Play – payment processing on Android
• RevenueCat, Inc. – management of subscriptions
• Stripe, Inc. – payment processing for purchases on the website (name, e-mail, payment and invoice data)
• Sentry (Functional Software, Inc.) – error and crash diagnostics (EU region)
• AllInkl and Hostinger – operation of the website and backend

6. Transfer to third countries

Some of the aforementioned services (Google, Apple, RevenueCat, Stripe) may process data in the USA. The transfer takes place on the basis of the EU Commission's standard contractual clauses or – where certified – the EU-US Data Privacy Framework. Sentry is operated in the EU region; in this respect no transfer to a third country takes place.

7. Retention period

We store personal data only for as long as it is necessary for the stated purposes or as provided for by statutory retention periods. Account and content data is removed when you delete your account; server log files are automatically deleted after a short time.

8. Deleting your account

You can delete your account and the associated personal data at any time:

• In the app: Profile → Settings → Delete profile. The account and your personal profile data are removed.
• Without the app / by request: Write to us at support@startelf.at using the e-mail address of your account. We delete your account and the associated personal data and confirm the deletion to you.

In particular, profile data (name, e-mail, profile picture, profile details), team memberships as well as your chat/event references are deleted or anonymised. For reasons of data integrity, anonymised residual information (e.g. depersonalised author references to team content already created) may be retained; this no longer allows any conclusions to be drawn about your person. Subscription/purchase receipts may be subject to statutory retention periods. Server log files are in any case automatically deleted after a short time.

9. Your rights

Under the GDPR you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to the processing (Art. 21)

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Österreichische Datenschutzbehörde (dsb.gv.at).

10. Contact

For matters relating to data protection you can reach us at:

David Krachler · Oeverseegasse 24, 8020 Graz, Österreich
E-mail: support@startelf.at