Privacy Policy

1. Scope and Operator

This Policy explains how FootyBox (the "Service") handles user information. The contact point for privacy matters is listed at the end of this Policy. The operator's legal name, address, and other information required by applicable law will be provided without delay upon request through that contact point.

2. Information We Collect

Depending on the features you use, we collect the following information.

• Account and authentication information: email address, display name, authentication information, and account identifiers. When password authentication is used, passwords are hashed by the authentication provider and are not stored in plain text by the operator.
• Profile information: avatar and cover images, bio, favorite team, travel style, and other information you submit
• Content and activity: match plans, experience notes, photos, comments, seat, ticket and travel information, ratings, facility edits, likes, follows, reports, and other activity within the Service
• External authentication information: when you choose Google login, your name, email address, profile image, and external account identifier provided by Google
• Notification information: notification preferences, Web Push subscription endpoints, encryption keys, and browser user-agent information
• Technical and access information: cookies, local storage, IP address, pages viewed, referrer, access time, device, OS and browser information, language settings, approximate region, and other information needed for analytics
• Contact information: name, email address, organization, relationship to a rights holder, message content, and any materials submitted or referenced

3. Purposes of Use

• Providing the Service, verifying identity, authentication, and account administration
• Displaying and sharing attendance records, profiles, comments, facility information, and other content selected by users
• Delivering notifications and responding to inquiries, reports, and rights-infringement claims
• Detecting, investigating, and preventing misuse, Terms violations, and security incidents
• Measuring usage, diagnosing failures, maintaining and improving the Service, and considering new features
• Serving and optimizing advertisements, measuring ad performance, and preventing advertising fraud
• Translating Posted Content and providing other user-requested features
• Complying with law, exercising legal rights, and handling disputes
• Communications and processing incidental to the purposes above

4. Information Made Public

Public profiles, public experience notes, photos and comments, likes, follows, and similar activity may be visible to other users and internet users. Match plans, seat numbers, ticket information, and photos may reveal personal activity or location, so please review information before publishing it. Information provided as private will not be made public except as needed to provide the Service or as required by law.

5. Service Providers and Third-Party Disclosure

We engage service providers, including those below, to process information as needed for the purposes described in this Policy. We may also disclose information with user consent, when required by law, to protect life, physical safety, or property, or as otherwise permitted by law.

• Supabase: authentication, databases, and storage for images and other data
• Vercel: website delivery, hosting, and operational logs
• Google: Google login, usage analytics through Google Analytics, and advertising through Google AdSense
• OpenAI: translation of Posted Content when a user requests the translation feature
• Web Push providers and browser vendors: delivery of notifications when enabled by the user

6. Processing Outside Japan

Information may be stored or processed on servers outside Japan when we use external services. We seek to ensure appropriate handling through providers' published information, contractual measures, and other reasonable means. Each provider's privacy policy also applies to its processing.

7. Cookies, Local Storage, Analytics, and Advertising

The Service uses cookies, local storage, and similar technologies for authentication sessions, language preferences, interface state, misuse prevention, analytics, and advertising. In production, we use Google Analytics, and Google may collect access information using cookies or similar technologies.

The Service may use Google AdSense to serve advertisements. Third-party vendors, including Google, may use cookies or similar technologies to serve ads based on a user's prior visits to the Service or other websites. Google's advertising cookies enable Google and its partners to serve personalized or non-personalized ads based on users' visits to the Service or other websites. Users can opt out of personalized advertising through Google Ads Settings.

You can restrict cookies in your browser, but some features may stop working. You can disable analytics for this device and browser using the link below.

8. Retention and Deletion

We retain information for as long as needed for the purposes in this Policy, while an account remains active, or for a reasonable period required for legal compliance, misuse prevention, or dispute handling. Users can delete their accounts from the profile edit page. After deletion, information required for backups, security logs, legal retention, protection of rights, or misuse prevention may be retained separately with restricted use for only as long as necessary.

9. Security

We use reasonable safeguards, including access controls, encrypted communications, appropriate management of authentication information, and least-privilege access, to protect information from leakage, loss, or damage. No internet transmission or storage system can be guaranteed to be completely secure.

10. User Requests and Choices

• You can access and correct profile information from My Page.
• You can disable notifications through Service settings or your browser or device settings.
• To request notice of purpose, access, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision of retained personal data, contact us with information needed to verify your identity. We will respond in accordance with applicable law.
• You can request deletion of your account and related data from the profile edit page.

11. Minors

Users under 16 must use the Service with consent from a parent or guardian. Do not publish precise location information, ticket identifiers, or similar details about yourself or others.

12. Changes to This Policy

We may revise this Policy to reflect changes to the Service or applicable law. Material changes and their effective date will be announced through the Service or another appropriate method.

13. Contact

For privacy questions, data-subject requests, or other inquiries about this Policy, contact us at the address below.

FootyBox operator - footybox.gm@gmail.com