Privacy policy

In short

• Vinky is for organising and joining sports matches with friends. We use your data for that, and only for that.
• No advertising, no selling of data, no tracking across apps.
• The names in your address book stay on your phone.
• You can delete your account at any time from the app.

Who is responsible for your data

Vinky is published by BAZ DEV, 12 Parc Jacques Chirac, 92500 Rueil-Malmaison, France, the controller of your data.

For any question about your data: bazdev.app@gmail.com, or in the app, Profile › Contact us.

The data Vinky uses

Your account

• Your phone number, to sign in with a code sent by text message.
• Your name, your profile photo if you add one, and your Vtag, the name your friends type to find you.
• The country of your number. The first time you sign in, the app suggests it from your IP address, which the IPinfo service reads once for this device.

Your matches

• The matches and series you create or join: their title, venue, date, the players invited, the answers, the waiting list and who came.
• The players not on Vinky you add, by their first name, and the venues you add to the catalogue.

Your contacts, if you allow it

• On your phone, each number in your address book becomes a fingerprint (a SHA-256 hash). Only these fingerprints are sent, to find which of your contacts are already on Vinky and to let you know when one of them joins.
• The names in your address book never leave your phone.
• A fingerprint is not encryption: someone holding the fingerprints could find the numbers by trying them all. They are therefore protected like the numbers themselves and read by the server only.

Your location, if you allow it

• It is used to show you the pitches nearby when you choose a venue. It is not stored.

Notifications

• A notification token and an identifier of this installation of the app, to send you invitations, reminders and news of your matches.
• With them, the app's version, iOS's version and the app's language on this device, to help you when you write to us and to know which versions are still in use.

Your messages to support

• When you write to us from the app: the subject, the message and the email address you give so that we can answer you, with your name, Vtag, number, the app's version, the iOS version, your iPhone's model and its language.

Crashes

• If the app crashes, or if an action fails unexpectedly, a technical report is sent to Firebase Crashlytics (Google): where in the code it happened, the app's last steps before it, the iPhone's model, the versions of iOS and of the app.
• It is linked to your account's technical identifier, to find the error when you write to us. It holds neither your name, your number nor your location, and it is kept for 90 days.

Security

• The server checks that requests really come from the Vinky app (App Check, with Apple's App Attest). Its technical logs are kept for 30 days.
• At sign-in, Google reCAPTCHA assesses, from information about your device and how the app is used, whether the request for a code really comes from a person, to prevent abusive text messages.
• The Google tools built into the app also send technical data about how they work (versions, errors), not linked to your account.

Why, and on what basis

• Running Vinky (your account, matches, invitations, notifications): the service you ask for when you create your account.
• Finding your contacts, using your location, sending you notifications: only if you allow it in iOS's prompts. You can change your mind at any time in your iPhone's Settings.
• Protecting the service from abuse (checking the app, sending limits): our legitimate interest in keeping Vinky safe.
• Fixing bugs (crash reports, versions in use): our legitimate interest in making the app work.
• Answering you when you write to us.

Who sees what

• The players of your matches see your name, photo and Vtag. Someone who types your exact Vtag sees the same.
• Your number is stored with your profile. The app shows it only to players who already have it in their contacts, but the players of your matches can technically read it.
• We do not sell or rent your data, and we share it with no one but the providers below.

Our providers

• Google (Firebase, reCAPTCHA): sign-in by text message and its protection against abuse, database, server functions, photo storage, notifications, app checks, crash reports. The database and the functions are hosted in the European Union (Belgium, the Netherlands).
• Apple: delivering notifications, app checks, maps and address search.
• IPinfo: the country suggested at sign-in, from your IP address, once per device (IP address data powered by IPinfo, under the CC BY-SA 4.0 licence).

Some of these providers may process data outside the European Union. They do so within the framework of the GDPR, notably the European Commission's standard contractual clauses.

How long

• Your data is kept as long as your account exists.
• When you delete your account (Profile › Edit › Delete my account), we erase your profile, photo, Vtag, your address book's fingerprints, your notification tokens and your messages to support.
• So that other people's matches stay right, your name stays in the matches you played, marked "Ex-Vinky". Your technical identifier may remain in what other players did (for example who added a player not on Vinky), without your name or number.

Your rights

You can access your data, correct it, have it erased, restrict its use, object to its processing or ask to receive it in a readable format.

• You change your name and photo in the Profile, and you delete your account from the app.
• For anything else, write to bazdev.app@gmail.com: we answer within a month.
• You can also contact a data protection authority: the CNIL in France (cnil.fr), the INPDP in Tunisia (inpdp.nat.tn).

Age

Vinky is meant for people aged 15 and over.

Changes

If this policy changes, we update the date at the top of the page, and we let you know in the app of any important change.