Privacy Policy

1. Introduction and Purpose

This Privacy Policy (hereinafter referred to as the "Policy") has been prepared to set out the principles and procedures governing the processing of personal data obtained through the Futba mobile application (the "Application"), pursuant to Regulation (EU) 2016/679 on the General Data Protection Regulation (the "GDPR") and the Turkish Personal Data Protection Law No. 6698 (the "KVKK"), along with any other applicable legislation.

The installation of the Application, its use in any manner, or access by any means shall be deemed to constitute acceptance of the terms set forth herein, having been read and understood in full.

2. Definitions

Personal Data: Means any information relating to an identified or identifiable natural person.
Data Subject: Means the natural person whose personal data is processed.
Data Controller: Means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
Processing: Means any operation or set of operations performed on personal data, whether or not by automated means, including but not limited to collection, recording, storage, organisation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, restriction, erasure, or destruction.
Explicit Consent: Means any freely given, specific, informed and unambiguous indication of the Data Subject's wishes relating to a particular matter.

3. Identity of the Data Controller

Pursuant to Article 13 of the GDPR and Article 10 of the KVKK, the Futba team shall act as the Data Controller in respect of all personal data processed through the Application (the "Data Controller"). The Data Controller may be contacted through the channels set forth in Section 13 of this Policy.

4. Categories of Personal Data Processed

The following categories of personal data shall be processed through the Application:

4.1. Identity and Contact Data

Email address (obtained automatically when signing in via Google or Apple through Firebase Authentication)
Authentication identifier (Firebase UID) — used strictly for system-level identification and shall not be disclosed to third parties
Username
First and last name (only where provided by the Data Subject)
Telephone number (only where provided by the Data Subject)

4.2. Profile and Demographic Data

Age, height, weight, preferred playing position
Short biography
City and district
Profile photograph or system-generated avatar

4.3. Location Data

Device location (GPS): Processed solely while the Application is actively in use, for the purpose of presenting nearby matches and user suggestions. No continuous background tracking shall be carried out.
Hometown location: A fixed location voluntarily selected by the Data Subject on a map. This location shall take precedence over device location.

4.4. Transaction Security Data

IP address
Device information (user-agent — operating system, browser/application version)
Date and time of sign-in
Firebase Cloud Messaging (FCM) notification token
Platform (Android / iOS)

4.5. In-Application Interaction Data

Information relating to matches created or joined, team assignments, selected venues
In-app chat content (match chat and one-to-one chat)
Friendship connections and pending requests
Statistical metrics such as completed match count and login-day count
Reports submitted about other users (for moderation purposes)

4.6. Usage Analytics and Crash Data

In-application usage data (screens viewed, session information, feature interactions) — processed via Firebase Analytics (Google LLC)
Crash and error records (device model, operating system version, technical traces relating to the moment of the crash) — processed via Firebase Crashlytics (Google LLC)
Subscription and purchase transaction records (product identifier, transaction status; card/payment instrument details shall under no circumstances be transmitted to the Data Controller) — processed via RevenueCat, Inc.

4.7. Financial Data (Match Payment Ledger)

IBAN and recipient name: Bank account details entered voluntarily and at their own discretion by the match organizer in order to facilitate the collection of the match fee from participants. This information is displayed solely to the confirmed (joined) players of the relevant match; it never appears in any public list, search result, or profile page, and is not transferred to any third party.
Payment mark records: Records marked as "paid" by the organizer constitute ledger entries based on the organizer's own declaration. No money transfer whatsoever takes place through the Application; the Application serves a record-keeping (ledger) function only and has no access to any banking/payment instrument details other than the IBAN text itself.
Deletion: The organizer may modify or permanently delete the entered IBAN at any time within the Application. Upon account deletion, the IBAN and recipient name are deleted automatically.

5. Purposes of Processing

Personal data shall be processed in accordance with the general principles set forth in Article 4 of the KVKK and the conditions established in Articles 5 and 6 thereof, strictly limited to the following purposes:

Creation of a user account, authentication, and session management
Performance of the core functions of the Application (listing nearby matches, match creation, matchmaking, chat, friendship connections)
Transmission of match-related information and reminder notifications (including nearby match, match reminder, friend request, kick, and match-fee payment notifications)
Tracking the collection of the match fee from participants (payment ledger): displaying the organizer's voluntarily entered IBAN solely to the participants of the relevant match and recording payment status — under Article 5/2 (c) of the KVKK (performance of a contract / at the data subject's request)
Ensuring community safety and reviewing reports of inappropriate content, harassment, or abuse (moderation)
Measuring Application performance, detecting technical errors, and conducting improvement activities
Fulfilment of legal obligations arising from applicable legislation and requests from competent authorities
Establishment, exercise or defence of legal claims in the event of a dispute

6. Legal Bases for Processing

Personal data shall be processed on the following legal bases:

Performance of a contract — Article 6(1)(b) of the GDPR; Article 5/2(c) of the KVKK: essential components of service provision.
Compliance with a legal obligation — Article 6(1)(c) of the GDPR; Article 5/2(ç) of the KVKK: obligations relating to notification, retention, and safeguarding required by applicable legislation.
Establishment, exercise, or defence of legal claims — Article 5/2(e) of the KVKK; Article 6(1)(f) of the GDPR as legitimate interest.
Legitimate interests of the Data Controller — Article 6(1)(f) of the GDPR; Article 5/2(f) of the KVKK: service security, fraud prevention, performance improvement.
Explicit consent — Article 6(1)(a) of the GDPR; Article 5/1 of the KVKK: relied upon only where none of the above legal bases apply.

7. Transfer of Personal Data

7.1. Transfer to Other Users

In view of the social nature of the Application, the following data shall be rendered visible to other users: username, name, profile photograph, city and district, position, completed match count, matches created/joined, and messages exchanged with users with whom contact is initiated. Email address, telephone number, precise GPS coordinates, and Firebase UID shall under no circumstances be disclosed to other users.

7.2. Transfer to Service Providers

In order to maintain the technical infrastructure of the Application, personal data shall be shared in the capacity of data processor with the following service providers:

Service Provider	Purpose	Data Location
Firebase Authentication (Google LLC)	Authentication	United States / EU
Firebase Cloud Messaging (Google LLC)	Notification delivery	United States / EU
Google Analytics for Firebase (Google LLC)	Usage analytics and performance measurement	United States / EU
Firebase Crashlytics (Google LLC)	Crash and error reporting	United States / EU
RevenueCat, Inc.	Subscription and purchase management	United States
Google Maps / Places API (Google LLC)	Map and location services	United States / EU
Supabase Inc.	Database hosting (PostgreSQL)	European Union
Fly.io, Inc.	Server hosting	Frankfurt, Germany
Cloudflare, Inc.	Content delivery network (CDN), DNS, security	Global

Where cross-border transfers are carried out, the safeguards required under Article 9 of the KVKK and Articles 44 to 49 of the GDPR shall be observed to the greatest extent possible. Personal data shall not be sold to third parties for marketing purposes.

7.3. Transfer to Competent Authorities

Where the transfer of data becomes mandatory by virtue of a court order, a request from a public prosecutor or law enforcement authority, or any other requirement arising under applicable legislation, only the data strictly covered by such request shall be transferred to the competent authority following appropriate legal review.

8. Account Deletion and Retention Periods

Futba users may permanently delete their account and all associated personal data from within the app at any time. Steps to delete your account:

Open the Profile tab at the bottom of the app.
Tap the Settings icon at the top right.
Tap Delete Account and confirm.

Upon deletion, your name, biography, avatar image, and chat history are removed without delay; if you signed in with Apple, your Apple session is additionally revoked. Anonymised statistical figures (such as total match count and age group) are retained in a form that cannot be linked to your identity. Deletion cannot be undone.

8.1. Deleting Specific Data Without Deleting Your Account

Futba allows you to delete certain data directly within the Application without deleting your account:

IBAN and recipient name (payment ledger): Match detail → the pencil icon on the COLLECTION (TAHSİLAT) card → Remove IBAN. Deletion is permanent and the information is immediately removed from all participants' screens.
Venue reviews: Profile → Settings → My Reviews, then delete the relevant review.
Profile details: Fields such as biography and profile photo/avatar may be changed or removed at any time from the profile editing screen.

For data not covered by these options, you may submit a deletion request under Article 11 of the KVKK via the contact channels set out in Section 13 of this Policy; requests are resolved within 30 (thirty) days at the latest. Deleted data is removed without delay, subject to the exceptions stated in the retention list below.

Personal data shall be retained for the period necessary for the purposes of processing, taking into account the minimum retention periods prescribed by applicable legislation:

Account data: Retained until a valid deletion request is received.
Completed matches: Retained until the relevant accounts are deleted, in order to provide participants' match-history and statistics functions.
Payment ledger (IBAN and recipient name): May be deleted by the organizer at any time; deleted automatically upon account deletion. Payment mark records are retained in a de-identified form to preserve the integrity of the other participants' ledgers.
Cancelled matches: Automatically deleted 7 (seven) days following the cancellation date.
Login history: Retained for a maximum of 12 (twelve) months.
Following account deletion: Name, biography, avatar image, and chat history shall be deleted without delay; statistical figures (such as total match count and age group) shall be retained in anonymised form only.

9. Rights of the Data Subject

Pursuant to Article 11 of the KVKK and Articles 15 to 22 of the GDPR, the Data Subject shall have the following rights:

To be informed whether their personal data are being processed
To request information relating to such processing
To ascertain the purposes of processing and whether the data are used in line therewith
To be informed of the third parties to whom the data have been transferred domestically or abroad
To request correction of data processed incompletely or inaccurately
To request erasure or destruction where the grounds for processing no longer exist
To request that rectification, erasure or destruction be notified to third parties to whom the data has been transferred
To object to a result produced solely by automated means that adversely affects the Data Subject
To claim compensation for any damage arising from unlawful processing
Right to data portability (GDPR Article 20)
Right to object to processing (GDPR Article 21)

Applications concerning the foregoing rights shall be submitted in writing to the contact details provided in Section 13, in Turkish or English, together with sufficient identifying information. Applications shall be concluded within the periods prescribed under the Communiqué on the Procedures and Principles for Application to the Data Controller, and in any event no later than thirty (30) days.

In the event that the application is rejected, not responded to, or the response is deemed inadequate, the Data Subject may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu) or, where applicable, with the competent supervisory authority in the relevant Member State of the European Union.

10. Data Security

Within the scope of Article 12 of the KVKK and Article 32 of the GDPR, reasonable technical and administrative measures shall be implemented to prevent unlawful processing of and access to personal data and to ensure their preservation. In this regard:

All communications between the Application and the server are conducted over encrypted HTTPS connections compliant with TLS 1.2 and above.
Passwords are not stored by the Data Controller; authentication is performed through the Firebase Authentication infrastructure.
Access to servers and databases is restricted to authorised service accounts only.
Sensitive configuration values are not retained in source code; secure environment variables and secrets managers are employed.
Input validation and rate limiting are enforced at all API endpoints.

Notwithstanding all technical and administrative measures taken, absolute security of any information system cannot be guaranteed. Should a security vulnerability be identified, the Data Subject is kindly invited to report it at the earliest opportunity to [email protected].

11. Children's Privacy

The Application is not intended for use by children under the age of 13. Should it be established that personal data belonging to a Data Subject under the age of 13 has been processed without the Data Controller's knowledge, the relevant account and associated data shall be deleted without undue delay. Parents or legal guardians with concerns on this matter are invited to contact [email protected].

12. Amendments to the Policy

This Policy may be updated from time to time at the sole discretion of the Data Controller. In the event of material amendments, Data Subjects shall be notified in advance through in-app notifications or electronic mail. The most current version of the Policy shall at all times be available at this URL. The "Effective Date" shall be revised upon each update.

13. Contact and Applications

Any enquiries concerning this Policy or applications relating to the exercise of the rights hereunder may be addressed through the following channels:

Email: [email protected]
Website: https://futba.net

← Back to home