Privacy Policy
Redcard is a football (soccer) scores and match data app for fans. We process the minimum personal data needed to run the Service and we never sell it. The infrastructure (Vercel, Neon, the data provider) costs real money — if you like Redcard, you can support us with a donation or by subscribing to Plus. This page summarises what we collect, why, how long we keep it, and the rights you have.
For the legally-binding full version, read docs/PRIVACY.md on GitHub.
1. Who we are
Redcard is operated by Gonzalo Yacante (the "operator", "we", "us"). You can reach the operator at:
- Privacy: privacy@redcard.pro
- DPO: dpo@redcard.pro
2. What we collect
Email, password hash (bcrypt), date of birth (to comply with GDPR/COPPA/LGPD age gates), push token, followed teams and competitions, UI preferences. Cookie consent records for GDPR Art. 7(1).
We do not collect: location, contacts, advertising IDs, fingerprinting, third-party trackers, biometric data. Payment is handled directly by Stripe.
3. What we never do
- We don't sell data.
- No behavioral ads or retargeting.
- No tracking across other sites.
- No automated decisions with legal effects (GDPR Art. 22).
4. Your rights
Access, rectification, erasure, portability, objection, withdraw consent. To exercise them, write to privacy@redcard.pro from the email associated with your account. We reply within 30 days (GDPR Art. 12(3)); most requests are processed within 5 business days.
5. How long we keep your data
Account and email: until you delete + 30-day re-registration cooldown. Audit logs: 7 years. Cookie consent: 3 years. Sentry: 90 days. The retention worker runs every 24h and deletes accounts inactive for 730+ days with no active subscription.
6. Sub-processors
We share the minimum needed with Neon, Upstash, Stripe, Firebase, Sentry, Vercel, Cloudflare, Apple/Google (auth). All have a signed DPA. Full list + DPA status at docs/sub-processors.md .
7. International data transfers
Redcard is hosted in the US. For EU/UK users we use the EU-US Data Privacy Framework (DPF). For Brazil, LGPD SCCs.
8. Cookies
Full cookie inventory at docs/COOKIES.md . The consent banner appears on first visit (F15 v2).
9. Security
TLS, bcrypt, 2FA TOTP, WebAuthn passkeys, Redis-backed rate limit, Sentry source maps, Prometheus metrics, 24/7 on-call.
10. Breach notification
We notify the supervisory authority within 72h (GDPR Art. 33) and you individually within a reasonable timeframe (Art. 34).
11. Changes to this policy
When we update it, we bump the version (vYYYY-MM-DD.N) and re-prompt the consent banner.
12. Contact
Privacy: privacy@redcard.pro · DPO: dpo@redcard.pro