Privacy Policy

Who we are

FanMatch helps people find bars showing the matches they care about. "FanMatch", "we", or "us" refers to the operator of fanmatch.app. Contact for privacy questions: support@fanmatch.app.

What we collect

• Your account email and, if provided, display name and avatar.
• Your supported country, favorite teams, and home metro if you choose to set them.
• RSVPs you create (match, venue, party size, optional 140-character note, anonymity choice).
• Friend graph entries (requests, accepted friendships, blocks) - only if you use the friends feature.
• Your approximate location, only if you grant browser location permission. It is used in-session for distance sorting and is not written to your profile.
• Approximate metro/city derived from your choices (e.g. "NYC", "LA").
• Basic technical data (device type, referrer, pages visited) for product analytics.
• Venue claim submissions and any proof you upload.
• Owner contact info (email, phone, business name) for venues you claim.

Third-party processors

We use the following processors. Each is bound by their own data protection terms. We do not sell data to anyone.

• Supabase / Lovable Cloud - database, authentication, file storage (e.g. claim proofs). Hosted in the United States.
• Resend - transactional email (sign-in, RSVP confirmations, owner reminders, optional follow-team digests). Used solely to deliver email you triggered or opted into.
• Stripe - payment processing for venue subscription passes. Card data is collected by Stripe directly; we never see or store full card numbers.
• PostHog - product analytics and session replay (≈10% session sample, with form inputs masked). Cookieless, memory-only persistence on our side.
• Google Maps / Google Places - geocoding and map tiles (subject to Google's terms).
• Cloudflare Turnstile - bot protection on signup and claim forms.

What we do with it

• Run the FanMatch app: show you nearby venues, confirm your RSVPs, contact you about your account.
• Send transactional email you triggered (sign-in, RSVPs, claim status).
• Send optional follow-team digests only if you've explicitly opted in. You can unsubscribe at any time via the link in every email or at /u.unsubscribe.
• Improve the product and fix bugs (product analytics and session replay).
• Prevent abuse (rate limits, fraud signals on claims).

What we do not do

• We do not sell your personal data.
• We do not share your email with venues unless you submit a claim or contact request.
• We do not run advertising or ad tracking.
• We do not surface anonymous RSVPs to friends, even with the social graph enabled.

Retention

• Profile, RSVPs, friend graph, follows: kept while your account is active.
• Account deletion: removed within 30 days of request.
• Payment receipts: retained as long as required by tax/accounting law (typically 7 years).
• Server logs and analytics: typically 90 days, in aggregated form afterwards.
• Unsubscribe records: kept indefinitely so we honor your choice.

Your rights (GDPR / UK GDPR)

If you are in the EU/EEA or UK, you have the right to access, correct, delete, restrict, port, and object to processing of your personal data, and to lodge a complaint with your supervisory authority. Our legal bases are: contract (running your account and RSVPs), legitimate interests (security, abuse prevention, product analytics), and consent (optional email digests and browser location). You can withdraw consent at any time.

To exercise any right, email support@fanmatch.app from the address on your account. We respond within 30 days.

Your rights (California - CCPA/CPRA)

California residents may request access to, correction of, or deletion of the personal information we hold, and may opt out of "sharing" or "selling". We do not sell or share personal information for cross-context behavioral advertising. Submit requests to support@fanmatch.app. We will not discriminate against you for exercising these rights.

Email (CAN-SPAM / CASL)

Every commercial or recurring email we send includes a one-click unsubscribe link and the sender's physical address. We act on unsubscribe requests within 10 business days. Transactional messages (sign-in codes, RSVP and payment confirmations) are operationally required and continue regardless of marketing preferences.

Location data

Browser location is requested only to sort venues by distance. It is used in your session and not stored to your profile. You can deny the prompt and pick a metro manually instead.

International transfers

Your data is processed in the United States by FanMatch and the processors listed above. Where required, transfers from the EU/EEA/UK rely on Standard Contractual Clauses and processor commitments.

Deleting your account

Email support@fanmatch.app from the address on your account and ask us to delete it. We will remove your profile, RSVPs, follows, friend graph entries, and any claims within 30 days. Aggregated, non-identifying analytics may be retained.

Security

Passwords are checked against known breach lists at signup and reset. Access to user data is restricted to staff with an operational need. No system is perfectly secure, so we ask you to use a strong, unique password.

Children

FanMatch is not intended for children under 13 and we do not knowingly collect personal information from them.

Changes

We may update this policy. Material changes will be announced in-app or by email. The "Last updated" date at the top reflects the latest revision.

Contact

Privacy questions or data requests: support@fanmatch.app.