FootyBadger Privacy Policy

Overview

FootyBadger processes personal data to provide accounts, football check-ins, supporter profiles, achievements, rankings, statistics, optional nearby discovery, and account support. We do not sell personal data, show behavioural advertising, or use a product analytics or crash-reporting SDK in the Android app.

Information We Process

• Account and profile details, including email address, display name, account identifiers, optional favourite club, and optional home place.
• Authentication information, including a password hash for email/password accounts or a Google or Facebook provider identifier for social login.
• Check-ins, attendance and visit history, achievements, XP, streaks, scores, rankings, badges, and related activity.
• Approximate or precise foreground location when you use a location feature.
• A random FootyBadger installation identifier submitted with game check-ins to prevent duplicate device check-ins. We do not use an advertising ID or Android hardware identifier for this purpose.
• Security signals such as reported location accuracy, mock-location status, emulator/developer-mode indicators, derived distance or travel checks, and IP/email request-rate-limit records.
• Operational request and service information used to run, secure, and troubleshoot FootyBadger.
• Your email address and message if you contact support.

Location

Approximate location is sufficient for nearby discovery. After you choose to enable foreground location, FootyBadger uses a one-time approximate reading to show nearby stadium and football-heritage opportunities. The same approximate discovery can support check-in availability alerts when you separately opt in to notifications.

Precise location is requested when you choose a verified check-in action. The Android app obtains a fresh precise reading so the backend can verify proximity and apply timing, travel, duplicate, and fraud-prevention rules. Approximate location alone is not treated as a verified check-in.

FootyBadger does not request background location, continuously track your location, register background geofences, or run a location foreground service. Location is not collected merely because the application starts.

Precise check-in attempt and success observations can include coordinates, time, reported accuracy, source, and GPS-integrity signals. Accepted football-heritage check-ins, and match-presence confirmations if that capability is used, can also temporarily retain the submitted coordinates with the verification result. Exact coordinates in these records are deleted or removed after 90 days by a daily cleanup, or sooner when an account reaches permanent purge. When a check-in or authenticated preflight is blocked, FootyBadger keeps derived fraud/security information such as distance, reason, accuracy, and device-integrity signals, but does not retain the submitted coordinates in that risk record.

Notifications

Check-in availability notifications are optional. FootyBadger explains the feature before requesting Android's notification permission, and denying it does not prevent normal account use. The alert runs only while the main app screen is in the foreground and uses approximate location to say that a stadium may be nearby; opening it leads to the separate precise-location verification flow.

The notification choice, permission history, channel state, and duplicate-alert keys stay on your device. FootyBadger does not register a Firebase Cloud Messaging token or store a backend push-notification token for this feature.

Login Providers

You can use an email/password account or choose Google Sign-In or Facebook Login. For Google login, FootyBadger receives and stores the provider account identifier, verified email address, and available display name. Google may include a profile-picture URL in its sign-in response, but FootyBadger does not currently store that URL.

Facebook Login requests the public_profile and email permissions. FootyBadger stores the Facebook account identifier, email address, and available display name. Google ID tokens and Facebook access tokens are used during verification; FootyBadger does not retain them as provider credentials.

Google and Meta process login information under their own policies. Deleting your FootyBadger account removes FootyBadger's provider linkage but does not delete your Google or Facebook account or provider-side records.

Why We Process Data

We process account, profile, authentication, check-in, and progression data to provide the service you request. We process location and security signals to provide nearby features, verify check-ins, protect rankings, prevent abuse, and keep accounts and the service secure. Optional notifications are processed only after your product choice and any required Android permission.

Retention

• Account, profile, check-in, and progression data is kept while the account is active and during the 30-day account-recovery window, then permanently purged if the account is not recovered.
• Exact coordinates retained for check-in verification become eligible for deletion or removal after 90 days and are processed by a daily cleanup, or sooner when account purge occurs first. The non-location visit or verification history can remain with the account.
• Check-in fraud/security records retain derived decision metadata, not submitted coordinates, for the account lifetime and recovery window, then are purged with the account.
• Email and IP records used to limit one-time-code abuse are deleted after 30 days, or sooner during permanent account purge when they match the account.
• Ordinary production application, request, and system logs stored by FootyBadger expire after 30 days.
• Google-managed control-plane audit logs can be retained for 400 days as a platform-fixed security exception. They record administrative/system activity rather than FootyBadger check-in history.

Production data is stored with a managed database provider. The production project has a configured six-hour database recovery-history window. Deleted information may remain recoverable within that window; it is not used for normal application processing and remains subject to deletion if recovery data is restored. No project-configured snapshot, scheduled-snapshot, or retained-branch mechanism was identified during the September 3, 2026 inspection that intentionally extends recoverability beyond that window.

Account Deletion

When you confirm deletion in FootyBadger Settings, your account is deactivated immediately: active sessions are revoked, normal access is blocked, and your profile and retained activity are removed from public, social, ranking, and calculation surfaces.

The underlying data is kept for a 30-day recovery window. If the account is not recovered, a daily production cleanup permanently removes the user row, profile, provider links, tokens, check-ins, activity, locations, progression, notification/device-linked records, and other user-linked active-system data. Only a random internal UUID remains in a separate one-column tombstone. It contains no account details or activity and does not function as a profile.

See the User Data Deletion page for the request and recovery process.

Service Providers and Sharing

FootyBadger does not sell personal data. We use service providers only where needed to operate the app: Google for optional sign-in, Android location services, cloud hosting/logging, and email; Meta for optional Facebook Login; and Neon for managed PostgreSQL storage. These providers process data according to their terms and privacy policies.

Security

We use measures including HTTPS, restricted production access, password and server-token hashing, encrypted Android session-token storage, secret management, bounded logging retention, and automatic privacy cleanup. No system can guarantee absolute security.

Your Choices and Rights

You can choose whether to use nearby location, precise check-in verification, Google/Facebook login, and notifications. You may ask to access, correct, export, object to processing of, or delete your personal data, subject to applicable law.

For privacy questions, rights requests, or account support, contact support@footybadger.com.