Privacy Policy
1. Data Controller
Controller / developer: Alfieri Design di Carlo Alfieri. VAT No.: 11191970968. Registered location: 20148 Milan (MI), Italy. Privacy and support email: calcetto@alfieridesign.com. Website: https://www.alfieridesign.com.
This Privacy Policy describes how CALCETTO processes the personal data of users of the mobile app and related services. CALCETTO allows users to organize small-sided football matches, manage groups, call-ups, availability, lineups, results, statistics, rankings, recent activity, notifications and CALCETTO PRO premium features.
2. Data We Process
Account data: email address, name, nickname, internal user identifier and password stored only in hashed form on the backend.
Optional profile data: photo/avatar, role or position, preferred foot, shirt number, description and other data voluntarily provided by the user.
Sports and usage data: group membership, call-ups, RSVP responses, teams, results, goals, assists, clean sheets, statistics, rankings, administrative ratings, MVP votes and group activity history.
Group and match data: group name and description, invitation code, dates, times, location, notes, organizational preferences, team settings and lineup constraints.
Technical data for push notifications: user identifier, installation identifier, platform, Expo device token and technical data required for delivery, if the user enables notifications.
Photos: access to the photo library is requested only when the user voluntarily chooses an image to use as an avatar. The selected photo is uploaded to the CALCETTO backend.
Pitch searches: city, area/neighborhood, radius and filters entered by the user are sent to the backend and used to query Google Places. CALCETTO does not require the device's GPS location for this feature.
Data stored locally on the device: authentication token in the device's secure storage. If the user enables “Remember email”, the email address is also stored locally; the app does not store the password.
Purchase and subscription data: when the user uses CALCETTO PRO on iOS, Apple processes the payment. CALCETTO and RevenueCat process the user's internal identifier, purchase history/status, product identifiers, information on activation, renewal, cancellation, expiration, any grace period, refund and purchase environment, as well as technical data required to verify the subscription. CALCETTO does not receive or store full payment card details.
Technical data processed by RevenueCat: may include technical information about the device or operating system, transaction data, Apple receipt and last use of the product, to the extent necessary to manage subscriptions.
3. Purposes and Legal Bases
| Purpose | Main data | Legal basis |
|---|---|---|
| Account creation and management | Email, name, profile, credentials | Performance of the requested service - Art. 6(1)(b) GDPR |
| Group and match management | Call-ups, RSVP, results, statistics, activity | Performance of the service - Art. 6(1)(b) GDPR |
| Operational notifications | Device token and technical identifiers | Performance of the service; activation subject to the user's choice/permission |
| Pitch search | City, area, radius, filters | Performance of the function requested by the user |
| CALCETTO PRO and subscriptions | Internal User ID, status and technical purchase data | Performance of contract - Art. 6(1)(b) GDPR; legal obligations where applicable |
| Security and support | Technical logs, identifiers, support requests | Legitimate interests - Art. 6(1)(f) GDPR |
| Tax/legal compliance | Strictly necessary transaction data | Legal obligation - Art. 6(1)(c) GDPR, where applicable |
4. Providers, Recipients and Processors
CALCETTO uses the following technical providers to deliver the service. Privacy roles may vary depending on the specific service and the relevant contractual terms.
| Provider | Service / data involved | Configuration |
|---|---|---|
| Render Services, Inc. (Render) | Backend/API hosting and technical service logs | calcetto-api service deployed in Frankfurt (Germany), HTTPS. |
| MongoDB, Inc. (MongoDB Atlas) | Application database: accounts, groups, matches, activity, push and technical PRO status cache | Deployment configured on AWS eu-central-1 (Frankfurt). |
| 650 Industries, Inc. (Expo) | Expo Push Service: push tokens and notification forwarding | Expo processes tokens and content required to deliver notifications. |
| Apple Inc. | App Store, In-App Purchase, APNs and iOS services | Apple manages payment, billing, receipts and subscriptions under its own terms. |
| RevenueCat, Inc. | Technical purchase and subscription management, PRO entitlement verification, renewals, restore and server notifications | Receives internal App User ID, technical information and transaction/purchase data. RevenueCat acts as a provider/processor for end-user data under its agreements and DPA. |
| Google LLC | Google Places / Maps Platform for the Find a Pitch feature | The backend sends the necessary search parameters; CALCETTO does not require native GPS permission. |
CALCETTO does not sell users' personal data. The verified software configuration for the current release does not include third-party advertising SDKs or third-party analytics SDKs integrated into the app.
5. International Transfers
The application backend and database are configured in the Frankfurt area, within the European Economic Area. Some providers are U.S. companies or may use affiliates/sub-processors outside the EEA. In those cases, transfers take place under the mechanisms provided for by the GDPR and the providers' contracts, such as adequacy decisions, the Data Privacy Framework and/or Standard Contractual Clauses. RevenueCat, Inc. is a U.S. company and processes End User Information on behalf of its customers under its Data Processing Addendum.
6. Data Retention
Account and profile data are retained for as long as the account remains active or as long as necessary to provide the service.
Sports, group and match data are retained as part of the group's history for as long as the group exists, unless deletion or another legitimate need applies.
Events in the “Recent Activity” feed are retained as part of the group's history. If an account is deleted, references to the user are anonymized if the group continues to exist; if no other real members remain, the group's history is deleted together with the group and matches.
Push registrations associated with the user are removed at logout/account change where possible, upon account deletion, or when the provider reports that the device is no longer registered.
The technical status of the PRO subscription is retained on the backend as a cache derived from RevenueCat verification and is updated upon purchases, restores, server notifications and periodic reconciliation.
Upon account deletion, CALCETTO queues deletion of the RevenueCat customer record associated with the user's internal ID. The Apple subscription is not automatically cancelled: any data and transactions retained by Apple remain subject to Apple's policies and obligations.
CALCETTO does not implement a separate application backup archive in its code. Any snapshots, backups or technical logs are managed by infrastructure providers in accordance with the applicable plan and retention policies.
Any data that must be retained to comply with legal obligations are kept only for the period required by applicable law.
7. Account Deletion
The user can delete the account directly in the app from Profile > Delete account. A web page is also available at https://app.alfieridesign.com/calcetto/delete-account-en.html. Deletion removes the account and associated personal data that CALCETTO is not legally required to retain. In groups that continue to exist, the user's references in historical activities are anonymized.
If the user has an active Apple subscription, deleting the CALCETTO account does not cancel subscription renewal. Before or after deletion, the user must manage or cancel the subscription through their Apple account settings.
8. Data Subject Rights
Where applicable, the user may exercise the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent provided for by Articles 15-22 GDPR by writing to calcetto@alfieridesign.com. The user may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): https://www.garanteprivacy.it.
9. Security
CALCETTO adopts technical and organizational measures proportionate to the risk. Passwords are stored in hashed form; production APIs use HTTPS/TLS and token-based authentication; server-side secrets are not embedded in the client. Authentication tokens on the device are stored using the operating system's secure storage. Server-side PRO status is verified through RevenueCat and cannot be self-assigned by the client.
10. Minors
CALCETTO is intended for users aged 16 or older. Anyone under 16 must not create an account or use the service.
11. Advertising, Analytics and Tracking
The verified release does not integrate third-party advertising or analytics SDKs and does not use data for behavioral advertising or cross-app/cross-site tracking. RevenueCat is used for subscription management and not for behavioral advertising. If analytics, crash reporting, advertising or other SDKs are introduced in the future, this Privacy Policy and the store disclosures will be updated before the relevant release.
12. Changes
This Privacy Policy may be updated in the event of changes to the service, providers or regulatory obligations. The updated version will be published in the app and on the website.
13. Useful Links
Terms: https://app.alfieridesign.com/calcetto/terms-en.html
Support: https://app.alfieridesign.com/calcetto/support-en.html
Account deletion: https://app.alfieridesign.com/calcetto/delete-account-en.html