Privacy Policy

Rondo ("we", "us", "our") operates the Rondo web platform and app — a social clubhouse for football fans. Rondo is operated from Sweden and is the data controller for the personal data described here. Our contact address for any privacy matter, including exercising your rights, is rondo.club@outlook.com.

• Account information you provide when signing up, such as your email address, display name and, if you use social sign-in, the basic profile details that provider shares with us.
• Profile and preferences including your selected clubs, avatar, banner, biography, chosen title and onboarding choices.
• Content you create such as forum posts, feed posts, comments, votes, reposts, match ratings, player ratings, direct messages, matchday chat and uploaded images.
• Activity records used to run the game layer: your market value ledger, streaks, tier, trophies and referrals.
• Safety records such as blocks you set, reports you file, and reports filed about you, including a text snapshot of the reported content captured at the time of the report.
• Usage and device data such as pages visited, approximate interactions, browser type and — where you have consented — first-party analytics cookies.

• To provide the service you asked for — creating and securing your account, keeping you signed in, running forums, feeds, news, calendars, matchday and the market-value game. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep the community safe — screening text before publication, handling reports, applying blocks and suspensions, preventing abuse of the scoring mechanics. Legal basis: our legitimate interest in a safe platform, and compliance with our legal obligations (Art. 6(1)(f) and 6(1)(c)).
• To measure and improve the product — first-party analytics. Legal basis: your consent (Art. 6(1)(a)), given in the cookie banner and withdrawable at any time.

We use strictly necessary cookies to run the site and keep you signed in. With your consent we also set first-party analytics cookies — an anonymous visitor identifier and a page-view counter — to understand how the clubhouse is used. You choose your preference in the cookie banner shown on your first visit, and no analytics cookies are set before you accept. You can withdraw consent at any time by clearing cookies in your browser.

We do not use advertising cookies, cross-site tracking, or third-party analytics products. Fonts and stylesheets are served from our own servers rather than a third-party font CDN, so simply loading a page does not disclose your IP address to anyone else.

Account data and content are stored using our managed cloud backend with access controls and encryption in transit. We apply data retention routines that automatically remove certain temporary and cached data over time. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

We do not sell your personal information and we do not share it for advertising. It reaches only the following, each acting as a processor on our instructions or as an independent recipient of non-identifying requests:

• Supabase — our managed database, authentication and file storage provider. Your account, profile, content and safety records are stored there.
• Our hosting and content-delivery provider — serves the app and processes the connection data inherent in any web request, such as your IP address.
• API-Sports — the football data provider for fixtures, line-ups, squads, standings and statistics. We send it club and fixture identifiers, never your identity.
• News publishers and link/media services — headlines, article previews and thumbnails are fetched by our servers, not your browser, so your IP is not disclosed to the publisher.
• Third-party embeds — where a page embeds a YouTube or TikTok video, playing it contacts that provider directly and their own privacy policy applies.
• Authorities — where we are legally required to disclose.

Some of these providers may process data outside the EEA under the European Commission's standard contractual clauses.

• Account and content — for as long as your account exists. Deleting the account removes them as described below.
• Moderation reports — retained for twelve months after resolution, with the reporter's and the reported member's identities removed, so repeat patterns can still be recognised.
• Cached football and news data — refreshed and expired automatically; it contains no personal data about you.
• Analytics page views — stored against an anonymous session identifier and pruned by our retention routine.

You can delete your account yourself, at any time, from Settings inside the app. You do not need to email us and there is no deactivation step. You will be asked for your password and to type the word DELETE, and then:

• Deletion is immediate and irreversible. There is no recovery window and we cannot restore an account afterwards.
• Your profile, direct messages, votes, ratings, streaks, ledger, trophies, club memberships, saved articles, blocks and notifications are deleted outright. Your profile picture and banner are deleted too — they are pictures of you, so erasure removes them.
• Your posts and comments are anonymised by default — the content remains, meaning both the text and any images attached to it, so that conversations other people took part in stay readable and intact. Your identity is severed from it and the author is shown as "Former member"; surviving images are re-filed under a neutral location so they are no longer linked to your account. If you would rather the posts went too, choose the option to delete your content when you confirm — then the images go with them.
• Any moderation report involving you is kept for the twelve-month window described above, de-identified.

Under the GDPR you have the right to access your data, to correct it, to erase it, to receive it in a portable form, to restrict or object to certain processing, and to withdraw consent. In practice:

• Access and portability — Settings includes a data export that produces a machine-readable JSON file of everything we hold about you. It is available once every 24 hours.
• Correction — edit your profile, display name, avatar, banner and biography from your profile at any time.
• Erasure — the account deletion described above.
• Consent — refuse or withdraw analytics consent via the cookie banner.
• Anything else — email rondo.club@outlook.com and we will respond within one month.

If you believe we have handled your data wrongly you can complain to your local supervisory authority; in Sweden this is Integritetsskydds­myndigheten (IMY).

Rondo is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect their data.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.

Questions about this policy or your data? Email rondo.club@outlook.com.