Privacy Policy
Matchday – Who's In? · Last updated: 4 September 2026
Matchday is an app for a group to share fixture lists and tell each other who's coming. It processes only what that requires. No ads, no tracking, no selling of data.
Who is responsible
Mathis Jakober
Email: mat.jakober@gmail.com
What data is processed
| Data | Purpose | Where |
|---|---|---|
| Email address and password | Account and sign-in. The password is stored as a hash only, never in plain text. The address is confirmed with a code sent by email at sign-up. | Supabase |
| Chosen display name and colour | So the group can see who answered | Device and Supabase |
| Group, membership, chosen calendars | The group's shared fixture list | Supabase |
| Answers (in/out), optional reason, highlighted matches | Shown to the other group members | Device and Supabase |
| Device push token | Notification when someone in the group answers | Supabase; passed to Apple or Google for delivery |
| Device language (de/en) | Notifications in your language | Supabase |
| Name and email address of invited people | Invitation by email; on acceptance they become account and membership | Supabase; sent via Brevo |
| Reminder settings, hidden calendars, usage time | Timing of reminders, display, hints | Device only |
Legal basis
Processing serves to provide the app, i.e. performance of the usage relationship (Art. 6(1)(b) GDPR). Whoever invites another person enters their name and address; the invitation email contains only the group name and the code, no free text. The invitee may ignore the invitation; the details are then kept until the invitation is deleted and used for nothing else (Art. 6(1)(f) GDPR).
What does not happen
- No advertising and no cross-app tracking
- No sharing or selling of data for advertising
- No location data, no contacts, no access to photos
- No analysis of usage behaviour
Recipients
- Supabase (Supabase Inc.) – database, accounts, sign-in and server functions. Servers located in Ireland (EU).
- Brevo (Sendinblue SAS, France) – delivery of confirmation and invitation emails. Receives recipient address and email content.
- Apple and Google – delivery of notifications. They receive the device push token and the text of each notification.
- calovo and fixtur.es – sources of fixture lists. The app fetches public calendar files from them; the service sees the device's IP address, nothing else.
- TheSportsDB – source of club crests. Queried by the server only, with team names; no user data is sent.
Who can see what
Within a group, all members see each other's name, colour and answers including reasons. The group creator additionally sees whether a member sees all or only highlighted matches. Nothing is visible outside your own group; the database enforces this with row-level access rules. Email addresses and push tokens are not readable by any member, not even the group creator.
Retention and deletion
Data is kept as long as the account exists. Signing out in the app removes all local data from the device. To delete the account and all associated data on the server, a short message to the address above is enough; deletion happens within 14 days. When someone leaves or is removed from a group, their answers disappear from the group.
Your rights
Access, rectification, erasure, restriction of processing, data portability and objection under the GDPR. An informal email to the address above is sufficient. You also have the right to lodge a complaint with a data protection authority.
Source code
The app is open source. What is actually stored and transmitted can be read here: github.com/jakober/matchday
Delete your account: in the app under Settings → Account, or like this without the app.