Terms and Privacy Policy

1. Who we are and what this document is

1.1 These Terms of Service (the "Terms") form a binding agreement between you and the provider of the AllPlay service (the "Service").

1.2 By creating an account or using the Service you agree to these Terms. If you do not agree to them, you may not use the Service.

1.3 The Privacy Policy is a separate document. It is not part of this agreement and you are not asked to accept it as a contract. It tells you how your personal data is handled. You should read it, and we will ask you to confirm that you have.

1.4 Provider details. These disclosures are made under the Swedish Act on Electronic Commerce (lag (2002:562)) and Articles 11 and 12 of Regulation (EU) 2022/2065 (the "DSA").

1.5 AllPlay AB is in the process of being registered with the Swedish Companies Registration Office (Bolagsverket). A Swedish limited company becomes a legal person only once that registration is complete. Until then, the Service is provided by the person named in clause 1.4, who is your counterparty under these Terms. Once AllPlay AB has been registered, we intend to transfer the operation of the Service and this agreement to AllPlay AB. You agree that we may transfer this agreement to AllPlay AB once it has been registered, provided the transfer does not materially reduce your rights. We will notify you when the transfer takes effect and will publish the company's registration number and registered address.

2. What the Service does

2.1 AllPlay is a platform for finding, creating and joining football matches at sports facilities.

2.2 The Service includes: user accounts and profiles; a map and list of football pitches and venues; creating and joining matches; viewing other users' profiles; friend requests; teams and team membership; skill levels and participation ranks; match results, MVP votes and player ratings; uploading match highlight media; tournaments organised by a user or a partner organisation, with teams, fixtures, scores and standings; reporting and blocking; and push notifications.

Your profile also shows an ELO field. It is not currently calculated from your results: every account holds the same starting value. If we activate a rating system we will update the Privacy Policy first and tell you what it is based on.

2.3 We are a coordination tool, not an organiser. AllPlay does not organise, supervise, staff or insure matches, except where AllPlay is explicitly named as the organiser of a specific match. Matches happen between participants, on their own initiative and at their own risk. Clause 8 applies.

2.4 Verified Organiser status. Sessions run by partner organisations such as clubs, schools or municipalities are hosted by accounts we have granted Verified Organiser status. We grant it only after confirming the person's role with that organisation. It is shown on the session and the account, and we can withdraw it at any time.

Verified Organiser status confirms only that person's stated role with the partner organisation. It is not an identity guarantee, a background check, a criminal record check, or an endorsement of how that person behaves.

3. Age requirement

3.1 You must be at least 13 years old to create an account.

3.1a If you are under 18, you confirm that you have permission from a parent or guardian to create an account and use the Service. That confirmation does not make your parent or guardian a party to these Terms, unless they separately agree to them. We will not impose a payment obligation on a person under 18 without any additional authorisation that applicable law requires.

We ask you to give this confirmation at registration. We encourage you to show your parent or guardian the safety information in clause 8. Swedish law allows a child of 13 or over to consent to certain processing of their personal data for online services. That is a data protection rule, and it does not by itself mean a person under 18 can enter into every kind of contract.

3.2 We ask for your year of birth when you register and use it to check that you meet the minimum age. We do not ask for your full date of birth.

3.3 We do not verify your age beyond the check described in clause 3.2. We therefore cannot reliably tell which users are adults and which are minors.

Because of this, the protections concerning non-disclosure of your live location and the restrictions on user interaction described in clauses 4.1 to 4.3 apply to every user, and cannot be switched off by you, by us on request, or by a partner organisation. Optional permissions and preferences remain governed by clauses 4.4, 4.5 and 5.4.

3.4 If you are under 18, we strongly recommend that you tell a parent or guardian before attending a match, and that you follow the precautions in clause 8.4.

3.5 If we learn that an account belongs to someone under 13, we will suspend the account and delete the associated personal data, keeping only what is strictly necessary to prevent a new account being created or to meet a legal obligation.

3.6 A parent or guardian who believes a child under 13 has an account can contact us at support@getallplay.com and we will act on it.

4. Safety measures built into the Service

The following core safety protections apply to every user and cannot be switched off. Separately, you can choose how visible your profile is; that choice is described in clause 5.4.

4.1 Your live position is never shown to other users. Your device's position is used to work out which pitches and matches are near you, and to confirm you are within 500 metres of the venue when you check in to a match. It is not displayed to any other user, on any map, in any profile, or through any interface, and it is not stored as a location history.

4.1a What we keep from a check-in. When you check in, we record that the check-in happened and the time it happened. We do not store the coordinates used to perform the distance check or the distance itself. We do not intentionally write the coordinates to our application database. As with any internet request, they may appear temporarily in restricted infrastructure logs held by our providers, as described in clause 2.6 of the Privacy Policy.

4.2 What other users can see. Depending on your privacy setting under clause 5.4, other users may see your display name, username, profile picture, bio, city, skill level, ELO rating, rank, number of matches played and MVP count. When you join a match, the other participants in that match can see that you have said you will attend that venue at that time. That refers to a public sports facility and a stated future time. You can leave a match at any time.

4.3 Messaging. The Service does not currently include any messaging feature, either private one-to-one messaging or match chat. Interaction between users happens through joining the same match, friend requests, and team membership. If we add a messaging feature we will update these Terms and the Privacy Policy before it goes live.

4.4 Location is optional. You can use the Service without giving location access by choosing an area manually. We ask for location permission only when you use a feature that needs it, and we explain why at that point. Refusing or withdrawing permission does not restrict your access to the rest of the Service, except that checking in to a match requires confirming you are at the venue.

4.5 Notifications. We do not ask for notification permission when you register. Marketing messages require separate consent and are never bundled with messages about matches you have joined.

5. Your account

5.1 Give accurate information when you register and keep it up to date.

5.2 You are responsible for keeping your login secure and for what happens under your account. Tell us at support@getallplay.com as soon as you become aware of unauthorised access.

5.3 Do not impersonate anyone or misrepresent who you are or which organisation you are connected to. One account per person, unless we agree otherwise in writing.

5.4 Profile visibility. You can choose whether your profile is public or hidden, in Settings. A public profile can be found by other users through search and player discovery. A hidden profile is not returned in search or discovery; other participants in a match you have joined can still see your display name and picture, because that is necessary for the match to work.

6. Rules of conduct

6.1 AllPlay does not permit objectionable content or abusive conduct. Reports are assessed on their context and seriousness, and enforcement measures are applied proportionately, as set out in clause 7.5. By accepting these Terms you accept this policy.

6.2 You must not use the Service to:

• (a) harass, bully, threaten, intimidate or humiliate anyone;
• (b) post or send content that is hateful, discriminatory, violent, sexual or pornographic, or that sexualises any person;
• (c) approach, groom or attempt inappropriate contact with a minor;
• (d) post content that is unlawful or infringes anyone's rights, including intellectual property rights;
• (e) impersonate anyone or misrepresent your identity or affiliation;
• (f) create fake matches, manipulate ratings or ELO, falsify results, or otherwise abuse the integrity of the Service;
• (g) repeatedly fail to turn up, without notice, to matches you have joined;
• (h) collect, extract or scrape other users' personal data;
• (i) access or attempt to access any system, account or data without authorisation, or introduce malicious code;
• (j) use the Service commercially without our prior written consent; or
• (k) get around a block, suspension or safety measure.

6.3 Content or conduct involving or facilitating the sexual exploitation or grooming of a minor is treated as the most serious violation of these Terms. Where we reasonably conclude, following an appropriate review, that an account has been used in that way, we may permanently terminate the account and will report the matter where the law requires it or where it is necessary to protect a person. We may also suspend an account, preserve evidence, or follow instructions from law enforcement instead of terminating immediately, where that is the more appropriate response. Clause 7.6 applies.

7. Reporting, moderation and enforcement

7.1 This clause covers two different things: ordinary reports about conduct that breaches these Terms, and notices about allegedly illegal content under Article 16 DSA. Both use the same reporting interface.

7.2 How to report. Use the report function on user profiles and after matches, or email support@getallplay.com. Reporting is free.

You can use the ordinary report function to report conduct that breaches these Terms, such as abusive behaviour, fake matches or repeated no-shows. You can also submit a notice of allegedly illegal content under Article 16 DSA, through the same reporting interface or by email.

7.3 What a report should contain. For an ordinary report, tell us what happened, who was involved and where in the Service it happened.

For an Article 16 notice about allegedly illegal content, the notice should contain: a sufficiently substantiated explanation of why you consider the content illegal; a clear indication of exactly where the content is in the Service; your name and email address; and a statement that you believe in good faith that the information in the notice is accurate and complete. You do not need to give your name or email if the notice concerns an offence referred to in Articles 3 to 7 of Directive 2011/93/EU.

7.4 Priority for child safety. The report function includes a dedicated category for concerns about the safety of a minor. Reports in that category are given the highest priority and are reviewed ahead of all others.

7.5 What we do. We confirm receipt of a report without undue delay. We prioritise safety reports and aim to review all reports promptly. Where content or conduct breaches these Terms, we may, depending on the circumstances and proportionately to how serious the breach is: remove the content; issue a warning; restrict access to features; suspend the account for a period; terminate the account; refuse future registration; and notify a competent authority. We inform the person who reported the outcome and the redress available to them, to the extent appropriate and permitted by law. We may limit what we tell them in order to protect another person's privacy or an ongoing investigation.

7.6 Reporting crime. Where we become aware of information giving rise to a suspicion that a criminal offence involving a threat to someone's life or safety has taken place, is taking place or is likely to take place, we will promptly inform the competent law enforcement or judicial authority in the Member State or Member States concerned, including the Swedish Police Authority where appropriate, and give them the relevant information we hold, under Article 18 DSA. This applies regardless of our size.

7.7 Statement of reasons. Where Article 17 DSA applies, and we remove or restrict your content, restrict your access to features, or suspend or terminate your account, we will give you a statement of reasons setting out: what we did and its scope and duration; the facts we relied on, including whether we acted on a report or on our own initiative; whether automated means were used to detect the issue or to make the decision; the ground we relied on and why your content or conduct breached it; and how you can challenge it.

We may leave information out of a statement of reasons where disclosing it would be prohibited by law, compromise an investigation, reveal another person's personal data, make it easier to get around our safety systems, or create a risk to any person.

7.8 Complaints. If we take action against you, you can complain within six months of being notified, by replying to the statement of reasons or emailing support@getallplay.com. Your complaint will be reviewed by a person, not by an automated system alone, and where possible by someone not involved in the original decision. If we find the original decision was wrong we will reverse it and restore your content or account. We aim to decide complaints promptly.

7.9 Although we may not currently be legally required to provide the full internal complaint-handling system that applies to larger online platforms, we provide the procedure in clause 7.8 voluntarily.

7.10 How we moderate. We use automated tools to help detect and prioritise problem content, alongside human review. Significant measures against an account, such as suspension or termination, are subject to human review where reasonably practicable and wherever the law requires it. We do not make decisions producing legal effects, or similarly significant effects, based solely on automated processing within the meaning of Article 22 GDPR.

7.11 No general monitoring. We have no general obligation to monitor what we transmit or store, or to actively look for signs of illegal activity, under Article 8 DSA.

7.12 Blocking. You can block another user from their profile. You do not need to give a reason. Blocking stops direct interaction between you: the blocked user will not appear in your search or discovery results, you will not be able to view each other's profiles, and neither of you can send the other a friend request.

Be aware of what blocking does not do. It does not prevent either of you from independently joining or attending the same public match, and if you are both in the same match you will still see each other in the participant list and on the pitch. If someone's behaviour concerns you, block them and also report them under clause 7.2, so that we can act on it.

8. Playing football is at your own risk

8.1 Matches take place in the physical world, away from the Service. We are not there and we have no control over how participants behave.

8.2 You take part at your own risk. We do not organise, supervise or insure matches. We do not vet users, verify their identity, or run background checks. We are not responsible for how other participants behave, or for injury, loss or damage arising at or in connection with a match, except where liability cannot be excluded under mandatory law.

8.3 Football carries a risk of physical injury. You are responsible for judging whether you are fit to play and for having appropriate insurance.

8.4 Precautions we recommend. Go to matches at public facilities when other people are around. Tell someone you trust where you are going and when you expect to be back. If you are under 18, tell a parent or guardian. Leave any situation that feels unsafe, without needing to explain yourself. Say no to any suggestion to move somewhere else or to meet privately instead of playing. Report anything that worries you under clause 7, whether or not you are sure about it.

8.5 In an emergency in Sweden, call 112.

9. Sessions run by partner organisations

9.1 Sessions run by clubs, schools, municipalities or similar organisations are hosted by accounts with Verified Organiser status.

9.2 For those sessions, supervising the activity and applying any child protection framework that covers participants who are minors is the responsibility of the partner organisation under its own policies. We provide the coordination tool.

9.3 We record that split of responsibility in a written agreement with each partner organisation before organised sessions begin.

10. Content you post

10.1 You keep ownership of the content you create, including profile pictures and match highlight media.

10.2 You give us a non-exclusive, worldwide, royalty-free licence to host, store, copy, adapt for technical purposes such as resizing and format conversion, and display that content, solely for the purpose of running and providing the Service.

10.3 That licence ends when you delete the content or your account, with three exceptions: copies other users have already saved cannot be recalled; we may keep content where necessary for a safety investigation or to meet a legal obligation; and content persists in backups until those backups expire, as described in the Privacy Policy.

10.4 You are responsible for what you post. You confirm you have the rights needed to post it and that it does not break the law or these Terms.

Where you upload media showing other people, you confirm you have their permission to share it. Take particular care with media showing children: do not upload identifiable images or video of a child without the permission of that child's parent or guardian. Anyone who appears in media uploaded by another user can report it under clause 7.2 or contact us at support@getallplay.com to ask us to review or remove it.

10.5 We may review, filter, refuse or remove content that breaches these Terms. Clause 7.11 applies.

11. Intellectual property

11.1 The Service, including its original software, design, trade marks, logos, databases and the content we provide, is owned by us or licensed to us, and is protected by applicable intellectual property law.

11.2 We give you a limited, non-exclusive, non-transferable, revocable licence to install and use the app on a device you own or control, for your personal, non-commercial use, in accordance with these Terms and, where you got the app from the Apple App Store, the Usage Rules in the App Store Terms of Service.

11.3 You must not copy, modify, distribute, sell, sublicense, decompile or reverse engineer any part of the Service, except where that restriction is prohibited by mandatory law.

11.4 Pitch and map data is provided by OpenStreetMap contributors and licensed under the Open Database License. Some venue information is provided by Google Places.

12. Availability and changes to the Service

12.1 The Service is provided "as is" and "as available". We do not promise it will be uninterrupted, error-free, or that it will meet your particular requirements.

12.2 We may modify the Service where reasonably necessary to maintain or improve security, legal compliance, technical compatibility, performance or functionality; to respond to changes in third-party infrastructure we depend on; or to discontinue a feature that is no longer reasonably sustainable to operate. Changes are made at no additional cost to you, unless you separately agree to a paid service.

Where a change has more than a minor negative effect on a consumer's access to or use of the Service, we will give reasonable notice and provide the information and termination rights required by mandatory law. Changes needed urgently for legal or security reasons may take effect immediately.

13. Liability

13.1 Nothing in these Terms excludes or limits our liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by our negligence, or any other liability that cannot be excluded or limited under mandatory Swedish law, including mandatory consumer protection law.

13.2 To the extent permitted by applicable law, and subject to clause 13.1, we are not liable for indirect or consequential loss, lost profit, lost data or lost opportunity; for what other users do or fail to do, whether in the Service or at a match; for the accuracy or lawfulness of content posted by users; or for failures of third-party services, networks or devices outside our control.

13.3 Where you use the Service in the course of a business, and subject to clause 13.1, our total liability to you will not exceed the greater of what you have paid us in the twelve months before the event giving rise to liability and SEK 1,000.

Where you are a consumer, our liability is governed by mandatory applicable law. We do not apply a fixed monetary cap to consumers.

13.4 None of this affects your statutory rights as a consumer.

14. Indemnity

This clause applies only where you use the Service for business or commercial purposes. It does not apply to consumers.

Where it applies, and to the extent the law allows, you will cover losses we suffer as a direct result of your breach of these Terms or your unlawful use of the Service.

15. Changes to these Terms

15.1 We may change these Terms, including to reflect changes in the law, changes to the Service, or completion of the company registration referred to in clause 1.5.

15.2 Changes are published at getallplay.com and in the app, with a new date of entry into force.

15.3 Where a change is significant we will tell you by email or in the app at least fifteen days before it takes effect, and ask you to accept it. If you do not accept, you can close your account under clause 16.1 before it takes effect. Changes required urgently by law or for security reasons may take effect immediately.

16. Ending the agreement

16.1 You can close your account at any time using the account deletion function in the app.

16.2 We may suspend or terminate your account where you are in material breach of these Terms, where the law requires it, or where it is necessary to protect users. Unless immediate action is needed for safety or legal reasons, we will give you notice and a statement of reasons under clause 7.7, and you can complain under clause 7.8.

16.3 When the agreement ends, the licence in clause 11.2 stops and you should uninstall the app. Your personal data is handled as described in the Privacy Policy.

16.4 Clauses 10.3, 13, 14, 18 and 19 survive termination.

17. Apple App Store terms

This clause applies if you got the app from the Apple App Store, and is included to satisfy Apple's minimum end user licence terms.

17.1 These Terms are between you and us only, not with Apple Inc. We, not Apple, are solely responsible for the app and its content.

17.2 The licence in clause 11.2 is non-transferable and permits use of the app only on an Apple-branded product you own or control, as permitted by the Usage Rules in the App Store Terms of Service, except that the app may be accessed by other accounts associated with you through Family Sharing or volume purchasing.

17.3 We, not Apple, are solely responsible for maintenance and support. Apple has no obligation to provide any maintenance or support.

17.4 We, not Apple, are solely responsible for any product warranties, whether express or implied by law, to the extent not effectively disclaimed. If the app fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price of the app to you. To the maximum extent permitted by applicable law, Apple will have no other warranty obligation whatsoever with respect to the app.

17.5 We, not Apple, are responsible for addressing any claim from you or a third party relating to the app or your use of it, including product liability claims, claims that the app fails to meet a legal or regulatory requirement, and claims under consumer protection, privacy or similar legislation.

17.6 If a third party claims the app or your use of it infringes their intellectual property rights, we, not Apple, are solely responsible for investigating, defending, settling and discharging that claim.

17.7 You confirm that you are not located in a country subject to a US Government embargo or designated by the US Government as a terrorist-supporting country, and that you are not on any US Government list of prohibited or restricted parties.

17.8 Questions, complaints or claims about the app should go to support@getallplay.com.

17.9 You must comply with applicable third-party terms when using the app.

17.10 You and we agree that Apple and Apple's subsidiaries are third party beneficiaries of these Terms, and that on your acceptance of these Terms Apple will have the right, and will be deemed to have accepted the right, to enforce these Terms against you as a third party beneficiary.

18. Consumer rights

18.1 If you are a consumer, you have rights under mandatory Swedish and EU consumer protection law that these Terms do not affect.

18.2 Right of withdrawal. Where you enter into a distance contract with us, you have a right of withdrawal under the Swedish Distance Contracts Act (lag (2005:59)). That Act can apply to a digital service even where you do not pay money, where the service is supplied in exchange for personal data.

Where a statutory right of withdrawal applies, the withdrawal period is fourteen days from the day the agreement is concluded. You can exercise it by deleting your account in the app, or by sending a clear statement to support@getallplay.com. A model withdrawal form is available in the app under Settings, Legal, and at getallplay.com. Exercising the right ends your access to the Service, and we handle your personal data as described in the Privacy Policy.

The Service is currently free of charge. If we introduce paid features, we will give you the pre-contractual information that Act requires and a withdrawal option before you take on any payment obligation.

18.3 Complaints go to support@getallplay.com.

18.4 Dispute resolution. If we reject your complaint in whole or in part and you are a consumer, we will tell you in that individual case that you can take the matter to the National Board for Consumer Disputes (Allmänna reklamationsnämnden, ARN), Box 174, 101 23 Stockholm, www.arn.se. You can also get guidance from Hallå konsument, or from Konsument Europa if you live in another EU Member State.

18.5 The European Commission's online dispute resolution platform ceased operating on 20 July 2025 under Regulation (EU) 2024/3228 and is no longer available.

19. Law and jurisdiction

19.1 These Terms are governed by Swedish law. If you are a consumer resident in the EU, you also have the protection of the mandatory provisions of the law of your country of residence, and this choice of law does not take that away.

19.2 Where you are a consumer, jurisdiction is determined by mandatory applicable law. You may bring proceedings in any court available to you under that law, and we may bring proceedings against you only before a court permitted by mandatory law, which will normally be a court in the country where you live.

Where you use the Service in the course of a business, disputes go to the Swedish courts, with Stockholms tingsrätt as the court of first instance.

20. General

20.1 Severability. If any provision is invalid or unenforceable, the remaining provisions remain in force.

20.2 No waiver. Failing or delaying to exercise a right does not waive it.

20.3 Assignment. You may not assign your rights under these Terms. We may assign ours on a transfer of the business, subject to the Privacy Policy.

20.4 Entire agreement. These Terms are the entire agreement between you and us about the Service and replace all earlier terms and representations. The Privacy Policy is a separate information document and is not part of this agreement.

20.5 Language. These Terms are published in English and Swedish. Both versions have equal effect. If they diverge, the Swedish version prevails for users resident in Sweden.

21. Contact

1. Who is responsible for your data

1.1 The controller is Matija Cvitic, trading under the name AllPlay, Skillingagatan 68, 646 32 Gnesta, Sweden. Contact: support@getallplay.com. AllPlay AB is currently being formed and is not yet the controller.

1.2 Once AllPlay AB has been registered with Bolagsverket, we intend to transfer the operation of the Service to the company, at which point AllPlay AB will become the controller. Before that happens we will document the transfer of controllership, update our agreements with the providers listed in clause 4.3, notify you, and publish the company's registration number and registered address in an updated version of this Policy.

1.3 We have not appointed a data protection officer. We assessed the conditions in Article 37(1) GDPR and concluded they are not met, on the basis that large-scale regular and systematic monitoring of people is not our core activity and we do not process special category data, or data relating to criminal convictions and offences, on a large scale. We review that assessment annually. Data protection questions go to support@getallplay.com.

1.4 We process personal data under the GDPR, the Swedish Data Protection Act (lag (2018:218)) and, for storage of and access to information on your device, the Swedish Electronic Communications Act (lag (2022:482)).

2. What we collect, why, and for how long

2.1 Legitimate interests. Where we rely on Article 6(1)(f), our interests are keeping the Service safe, preventing abuse and fraud, securing our systems, and establishing, exercising and defending legal claims. We have weighed those against your rights and concluded the processing is necessary, falls within what users of a service that arranges physical meetings would reasonably expect, and has limited impact because we do not use the data for advertising or for sale to third parties. You can object under Article 21 GDPR, and we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms.

2.2 Automated evaluation and profiling. Some parts of the app calculate values from your activity automatically. We want to be precise about what actually happens, because this is the kind of statement that must be exactly true.

Your rank tier and division are calculated solely from the number of matches you have played. More matches played moves you up. It is a measure of participation, not of skill, and nothing else feeds into it.

Your ELO field currently holds the same starting value for every user and is not yet calculated from anything. If we activate a rating calculation, we will update this Policy first and tell you what it is based on.

Player ratings are given to you by other participants after a match, and are shown on your profile.

MVP votes are cast by other participants and counted on your profile.

Taken together these are profiling in the broad sense of Article 4(4) GDPR, because they involve automated evaluation of aspects of your activity. The practical consequences are limited: a higher or lower rank changes what is displayed on your profile. It does not determine whether you can use the Service, which matches you can join, or how we treat you if you are reported. It is not used to make decisions producing legal effects concerning you, or similarly significantly affecting you, within the meaning of Article 22 GDPR. Significant measures against an account, such as suspension or termination, are subject to human review where reasonably practicable and wherever the law requires it.

2.3 Special category data. We do not ask for special category data under Article 9(1) GDPR and we do not deliberately collect or infer data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation. Please do not put that kind of information in your profile, your bio, or in content you upload.

It may nonetheless reach us incidentally, most obviously where someone includes it in a safety report or in a message to support. Where that happens, we process it only where an exception under Article 9(2) GDPR applies. Depending on the situation that may be: because it is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)); because it is necessary to protect someone's vital interests in an emergency where they cannot give consent (Article 9(2)(c)); because you have given explicit consent (Article 9(2)(a)); or because the person concerned has manifestly made the data public (Article 9(2)(e)). We do not rely on a single ground for all cases, and we keep such data only as long as necessary for the purpose it arose in.

2.4 Reports containing allegations of criminal conduct. We do not ask for, and do not systematically collect, data about criminal convictions and offences. Most safety reports concern conduct that breaches our rules, such as abusive language, repeated no-shows or manipulating results, and are not about crime at all.

A report can nonetheless contain an allegation of criminal conduct, for example where someone reports suspected grooming, an assault at a match, or a threat. Where an allegation is specific enough to concern a particular offence, Article 10 GDPR applies and restricts how it may be processed.

Where that happens:

• We process the report only where EU or Swedish law permits it, including where we are required under Article 18 of the Digital Services Act to inform a competent authority of information giving rise to a suspicion of an offence involving a threat to a person's life or safety, and where processing is necessary for the establishment, exercise or defence of legal claims.
• Access is restricted to administrators handling that report.
• We do not use the allegation for any purpose other than handling the report, protecting users and, where applicable, passing the matter to the competent authority.
• We keep it only as long as necessary, as set out in clause 2.4a.

Where neither a legal obligation nor the legal claims ground permits continued processing, we do not retain the allegation beyond the limited initial assessment and any necessary transmission to a competent authority. We record internally which ground applies in each serious case.

2.4a How long we keep reports. We keep reports and the record of what we decided for up to 24 months from resolution. How long we actually keep a given report depends on how serious it was and whether the record is still needed for safety, legal claims or compliance. A minor report that was resolved without action is deleted sooner. A record relating to a serious safety incident is more likely to be kept for the full period.

2.5 What you have to give us. An email address and a display name are needed to create an account, and a year of birth is needed for the age check. Without them we cannot provide the Service. Location, notifications and analytics are optional. Refusing them costs you nothing except that particular feature. You can turn location and notification permissions off at any time in your device settings.

2.6 Location in more detail. Because location is the most sensitive thing we touch, here is exactly what happens.

When you look at the map or search for matches, your coordinates are sent with the query to find pitches near you. They are used to answer that query and are not written to your profile or to any other record.

When you check in to a match, your coordinates are sent so we can measure the distance between you and the venue. If you are within 500 metres, the check-in succeeds. We store the fact that you checked in and the time. We do not store the coordinates you sent, and we do not store the measured distance.

We do not keep a location history. No other user can see your position at any time.

Technical logs. We do not store coordinates in our application database, and they are not written to any table.

Coordinates are sent inside the body of ordinary network requests, never in the web address, so they do not end up in browser history, referrer headers or standard access logs. We have configured our systems not to log the contents of location requests. Where coordinates could still appear in a diagnostic log, for example in an error report, we treat those logs as restricted: access is limited to administrators, they are used only for security, fault diagnosis and abuse prevention, and we delete them within 30 days rather than keeping them for the full technical data period.

We do not send coordinates to our analytics provider, and no analytics event contains latitude, longitude or distance.

Legal basis. We rely on performance of the contract, because we process your coordinates only when you actively use a feature that needs them: looking for nearby matches, or checking in. Your device will also ask for operating system location permission. That permission is a technical gate, not the legal basis, and turning it off simply means those features are unavailable.

2.7 Media uploaded by other users. Other participants can upload photos and video from matches you played in, and you may appear in that content.

We do not use facial recognition or any other biometric identification, and we do not tag or index people appearing in media.

Whoever uploads content must have the right to share it under clause 10.4 of the Terms of Service, which requires permission from the people shown and particular care where a child appears.

If you appear in content you are unhappy with, you can report it in the app or email support@getallplay.com, and we will review it and remove it where appropriate. You can also object under Article 21 GDPR.

3. Data we get from sources other than you

3.1 This is the information required by Article 14 GDPR.

3.2 We receive personal data about you from:

• (a) Apple, where you sign in with Apple: a user identifier and, depending on your choice, either your email address or a private relay address;
• (b) Google, where you sign in with Google: a user identifier, your email address, your name and your profile picture;
• (c) other users, where someone reports you, rates you, votes for you as MVP, sends you a friend or team request, or names or shows you in content they upload.

3.3 We process that data for the purposes and on the legal bases in clause 2. Where Article 14 requires it, we inform you at the time of first contact and in any event within one month of getting the data.

We may delay or withhold that information only where an applicable exception under Article 14(5) GDPR or another legal restriction permits us to do so. Situations where that may apply include where telling you would seriously impair a safety investigation, where it would identify the person who reported something and put them at risk, or where disclosure is prohibited by law. We assess this case by case rather than treating it as automatic.

3a. Google user data (Sign in with Google)

This clause gathers, in one place, what happens to data we receive from Google when you choose Sign in with Google. It adds nothing to what clauses 2, 3, 4 and 6 already say; it restates it so that it can be read on its own.

3a.1 What we access. Only the basic sign-in scopes: openid, email and profile. From those we receive a Google user identifier, your email address, your name and your profile picture. We do not request, and cannot see, your Gmail, Drive, Contacts, Calendar or any other Google service.

3a.2 How we use it. The identifier and email address create your AllPlay account and sign you in on later visits. Your name and profile picture pre-fill your display name and profile picture so you are recognisable to other players; you can change or remove both at any time in the app, and a change in AllPlay does not change anything in your Google account. We also use the email address to contact you about the Service. We do not use any of it for advertising, and we do not use it to build a profile of you for any purpose other than running AllPlay.

3a.3 How we store it. It is stored in our database with the rest of your account, hosted by Supabase in the EU (Frankfurt), encrypted in transit and at rest. Access is limited to administrators and is used only for support, security and abuse prevention. Retention is the same as the rest of your account data in the table in clause 2: we keep it for the life of the account.

3a.4 Who we share it with. Nobody, other than the processors listed in clause 4.3 who host and operate the Service on our behalf under written instructions. We do not sell it, we do not share it for advertising, and we do not transfer it to any third party for their own purposes. Other users see only what your profile visibility setting allows — your display name and picture — never your email address.

3a.5 How to delete it. Delete your account in the app under Settings, then Delete account. That removes the Google identifier, the email address, the name and the picture, together with the rest of your account, as described in clause 6. Deletion is immediate and cannot be undone. If you no longer have the app installed you can ask us to delete the account by writing to support@getallplay.com, or read the full description at https://getallplay.com/delete-account. You can also revoke AllPlay's access from your Google account at https://myaccount.google.com/permissions; that stops future sign-ins but does not by itself delete the AllPlay account, so do both if you want the data gone.

3a.6 Contact. Questions about any of this, and requests under clause 7, go to support@getallplay.com. The controller's postal address is in clause 1.1.

4. Who we share data with

4.1 We do not sell your personal data and we do not share it for advertising.

Where a match is sponsored, the sponsor does not receive participant identities or individual activity data. They receive aggregate information only. If that ever changes, we will tell you separately and will not do it without a valid legal basis.

4.2 Other users. What other users can see depends on your profile visibility setting, and is described in clauses 4.2 and 5.4 of the Terms of Service. Your location is never shown to another user in any circumstance.

4.3 Providers acting on our instructions (processors). These providers process personal data on our documented instructions under agreements meeting Article 28 GDPR:

4.3a Providers acting as independent controllers or under their own terms. These companies decide for themselves how they process certain data, so they are not simply acting on our instructions. Their own privacy policies apply to that processing, alongside this one:

Their own privacy policies also apply to processing where they determine the purposes and means, and we recommend you read them. That does not affect our own responsibility for choosing and configuring those services, for what we disclose to them, for informing you, and for assessing international transfers.

4.3b Email and support. When you email support@getallplay.com, your message is handled by Google Workspace, which processes your email address, the content of your message and any attachments on our behalf. If we add other tools that process personal data, such as error monitoring or customer support software, we will list them here before they go live.

4.4 Map and pitch data. The underlying pitch and map data originates from OpenStreetMap contributors. The map images themselves are served by a tile provider, and when your device loads a tile it makes a request directly to that provider, which includes your IP address and the area of the map you are viewing. That is how web maps work everywhere; it is not something we can see or control. The tile provider's own privacy policy applies to that request. Map tiles are currently served by CARTO, using their dark-themed basemap. CARTO's servers receive your IP address and the map area you are viewing when a tile loads. We will update this Policy if we change provider.

4.5 Partner organisations. Where you take part in a session run by a partner organisation, we may tell that organisation that you are taking part, so they can run the session. We do not share any other activity and never share location.

The session page identifies the partner organisation and gives information about its role in handling participant data. Depending on the arrangement, a partner may act as an independent controller, as a joint controller with us, or as a processor acting on our instructions. We determine and document that role in a written agreement before the session begins, and provide any additional privacy information required.

4.6 Authorities. We disclose personal data where the law requires it, on a court order, and on a lawful request from a competent authority. Where clause 7.6 of the Terms of Service applies, we disclose the relevant information to the competent law enforcement or judicial authority, including the Swedish Police Authority where appropriate. Where we are allowed to, we will tell you.

4.7 Business transfer. If the business is merged, acquired or transferred, personal data may go to the acquiring entity, which will remain bound by this Policy or one that protects you no less. We will tell you before that happens.

4.8 Aggregate data. We may publish statistics that do not identify anyone. Those are not personal data.

5. Transfers outside the EU

5.1 Our primary database, file storage and analytics projects are configured in EU regions. Some providers operate global networks, support systems, logs or backups, which may involve processing outside the EU/EEA. Several of these providers also have parent companies in the United States, which may in principle be subject to laws allowing access requests.

5.2 Apple and Google process data globally as part of app distribution, sign-in and push notification delivery.

5.3 Where personal data is transferred to a third country, we rely on a European Commission adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses adopted under Article 46(2)(c) GDPR by Implementing Decision (EU) 2021/914.

5.4 You can ask us for a copy of the safeguards we rely on at support@getallplay.com.

6. Deleting your account

6.1 You can delete your account at any time in the app, under Settings.

6.2 When you delete your account, the following is deleted: your profile, including your name, username, email address, profile picture, bio, city, year of birth and skill level; your friendships and friend requests; your team memberships; your push notification tokens and queued notifications; your device records; and the match highlight media you uploaded.

6.3 The following is anonymised rather than deleted, so that matches other people played in remain accurate: your participation in past matches, including check-in records, match results, MVP votes, and the ratings you gave and received. After anonymisation these records no longer identify you.

6.4 The following is kept: safety reports made about you and the moderation record of what we decided, for up to 24 months from resolution, so that we can defend legal claims; and accounting records where Swedish law requires it.

6.4a Preventing a removed user from returning. Where we have terminated an account for a serious safety breach, we keep a one-way hash of the email address of that account, so that the same address cannot immediately be used to register again. We keep a pseudonymised one-way value derived from the email address using a keyed hash with a secret held only on our server, rather than the address in readable form. That value remains personal data, because it can be used to recognise a repeated registration attempt, and we protect it accordingly. Only administrators can access it, and we keep it for 24 months. The legal basis is our legitimate interest in protecting other users, in particular minors, from someone we have already removed. Where the termination relates to alleged criminal conduct, clause 2.4 also applies.

6.4b Teams and matches you created. If you are the captain of a team with other members, deleting your account transfers captaincy to another member rather than deleting the team, so that the other members do not lose it. If no other member remains, the team is deleted. Matches you created that have already taken place are anonymised as described in clause 6.3. Matches you created that have not yet taken place are cancelled, and the participants are notified.

6.4c Your sign-in identity. Deleting your account also deletes your authentication record, including any linked Sign in with Apple or Sign in with Google identity. Your username is released and may be taken by another user afterwards.

6.5 Content other users have already downloaded or saved cannot be recalled.

6.6 Deleted data remains in encrypted backups until those backups expire. Backup schedules differ between our database, file storage and hosting providers, so we state a single upper bound that covers all of them: backup copies may remain for up to 90 days. In practice our database backups expire sooner than that. During that window the data is not accessible in the app and is used only to restore a system after a failure.

7. Your rights

7.1 You have the rights below. Exercising them is free. We will respond within one month of your request. Where a request is complex, or where we receive a number of requests, we may extend that by up to two further months, and we will tell you within the first month and explain why.

7.2 Where we need to, we may ask you to verify your identity, so that we do not disclose someone's personal data to the wrong person.

8. Security

8.1 We use technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. These include encrypted transmission using TLS, authentication handled by a managed provider, row-level access rules in the database that limit each account to the data it is entitled to, administrative access granted on a least-privilege basis, logging of moderation decisions including who made them and when, and managed infrastructure that receives security updates and monitoring.

8.2 We will never ask you for your password.

8.2a Data protection impact assessment. The Service is used by people under 18, processes location data to deliver features, involves user-generated content and safety reports, and arranges meetings between users in the physical world. Because of that combination we are carrying out a data protection impact assessment under Article 35 GDPR. We review it when we add features that change the risk picture, in particular before activating any rating system, before adding messaging, before launching paid features, and before expanding to new markets.

8.3 If a personal data breach happens, we will notify IMY without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms, as required by Article 33 GDPR.

8.4 Where a breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, as required by Article 34 GDPR.

9. Children

9.1 The minimum age for an account is 13. We check your year of birth at registration.

9.2 Because we cannot verify age beyond that check, the safety measures in clause 4 of the Terms of Service apply to every user, whatever age they have given.

9.3 If we learn that an account belongs to a child under 13, we suspend it and delete the data. We keep a pseudonymised value derived from the email address, on the same terms as clause 6.4a, so that the same address cannot immediately be used to register again. Because the reason for the block is age rather than conduct, we keep it only until the person would reach 13, up to a maximum of 24 months, so that a child who was too young is not prevented from joining once they are old enough. We keep anything else only where a legal obligation requires it.

9.4 A parent or guardian can contact us at support@getallplay.com about a child's account, including to ask us to delete it.

10. Changes to this Policy

10.1 We may update this Policy. The current version is always available in the app and at getallplay.com, with the date it took effect.

10.2 Where a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect.

11. Contact