Privacy Policy

GROUND ("we", "us", "our") is operated by Nassim El Bouh, an individual based in France, who is the data controller responsible for your personal data collected through the GROUND mobile app and this website.

For any data-related requests, contact us at [email protected].

We collect the following categories of personal data:

• ·Identity: full name, username, profile picture, nationality, preferred language, birthdate
• ·Contact: email address
• ·Location: city, country and approximate GPS coordinates, collected only while the app is open and in use, never in the background
• ·Usage data: events you create or attend, groups and clubs you join, tournaments you enter, posts, comments and messages you send, rooms you join or host
• ·Voice data: if you speak in a voice room, your live audio is transmitted to other participants in real time, we do not record or store it
• ·Media you upload: profile pictures, banners, post photos/videos, event photos
• ·Device data: operating system type, app version, and a push-notification token
• ·Favourite clubs and national teams you select
• ·A waitlist email address, if you sign up for early access on this website

Your data is used solely to provide and improve the GROUND service:

• ·Creating and managing your account
• ·Displaying nearby events, grounds and courts based on your location
• ·Enabling communication in group chats, private messages, and voice rooms
• ·Publishing posts and social interactions on the feed
• ·Sending in-app and push notifications about events, groups, and messages relevant to you
• ·Ensuring the security and integrity of the platform

We do not use your data for advertising, and we do not build advertising profiles.

Under the EU GDPR and UK GDPR

• ·Contract performance, providing the service you registered for (account, events, messaging, voice rooms)
• ·Consent, location access and optional profile information you choose to provide
• ·Legitimate interest, platform security, fraud prevention, and service improvement

For US state privacy laws

We process your personal information to provide the service you requested. We do not sell personal information or use it for cross-context behavioural advertising.

Your personal data is retained for as long as your account remains active. Upon account deletion, we delete your profile and its content (posts, comments, likes, messages, memberships, notifications) and separately delete your login credentials, within 30 days. If you own a club, group, tournament, or place listing, you'll be asked to transfer or delete it first.

Anonymised, aggregated statistics may be retained indefinitely as they can no longer identify you.

If you are in the EU or UK

Under the GDPR / UK GDPR, you have the right to:

• ·Access, obtain a copy of the data we hold about you
• ·Rectification, correct inaccurate or incomplete data
• ·Erasure, request deletion of your account and all associated data
• ·Portability, receive your data in a structured, machine-readable format
• ·Restriction, ask us to limit processing in certain circumstances
• ·Objection, object to processing based on legitimate interest
• ·Withdraw consent, at any time for processing based on consent (e.g., location)

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g., CNIL in France, ICO in the UK).

If you are a resident of a US state with a comprehensive privacy law

You may have the right to know, delete, and correct your personal information. We do not sell personal information or use it for targeted advertising, so we will not discriminate against you for exercising these rights. Email [email protected] to exercise them.

GROUND uses the following third-party services that may process personal data:

• ·Supabase, our database, authentication, and file-storage provider.
• ·Railway, cloud hosting for our backend and admin systems (EU servers where possible).
• ·Expo, delivers push notifications (via Google Firebase Cloud Messaging on Android, Apple Push Notification service on iOS). Only your push token is shared.
• ·LiveKit, powers real-time voice in voice rooms. Your live audio is routed through LiveKit's infrastructure while you're speaking.
• ·Mapbox, renders the interactive map.
• ·Photon by Komoot, geocoding for location search. Only the search query text is transmitted.
• ·Google Places API, used server-side to search for and display venue information and photos.
• ·Apple / Google Sign-In, if you sign up with Apple or Google, we receive your name and email from that provider; never your password.
• ·MailerSend, sends verification codes and password-reset emails.

We do not sell your data to third parties. We do not use advertising trackers.

Some providers listed above may process data outside your country of residence, including in the United States. Where this involves transferring personal data out of the EU/UK, we rely on appropriate safeguards (such as Standard Contractual Clauses) to ensure your data continues to receive an equivalent level of protection.

All data in transit is encrypted via HTTPS/TLS. Passwords are hashed and never stored in plain text. Access to production systems is restricted to authorised personnel only.

In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by the GDPR.

GROUND is not intended for users under 16 years of age. By registering, you confirm that you are at least 16 years old. We do not independently verify age beyond the birthdate you provide at signup. If we become aware that a user under 16 has registered, we will delete their account and data without delay.

We may update this Privacy Policy from time to time. When we make material changes, we will notify users via in-app notification and update the effective date above. Continued use of GROUND after the update constitutes acceptance of the revised policy.