Privacy policy

MatchSpotter is built to know as little about you as possible. There are no accounts and no ads, and we sell nothing to anyone. This policy explains, in plain language, what data the MatchSpotter website (matchspotter.com) and the MatchSpotter apps for iPhone and Android do handle, why, and what you can do about it.

Who we are

MatchSpotter is an independent project and the controller of the personal data described here. Questions or requests about your data: hello@matchspotter.com.

Your location

On your device. If you allow location access (in the apps only while you use them), your position is used on your device to center the map, work out distances and sort matches. Your precise position is never sent to our servers or stored by us.

When you search for a place in the apps. To suggest places near you first, the app sends what you typed together with an approximate position, rounded to about 1 km, to matchspotter.com. Our server passes the search to Apple Maps to look up matching places. We don't save your searches. They only appear in short-lived technical logs (see Server requests).

If you don't share your location. The website and apps ask our server for a rough starting point. Cloudflare, our hosting provider, estimates it from your IP address (usually city or country level). We use it only to answer that request and don't save it.

On the website, place search runs through Apple's MapKit JS in your browser, so what you type is sent to Apple under Apple's privacy policy.

Usage analytics and crash reports in the apps

The apps use Google's Firebase services:

• Firebase Analytics: usage events such as screens opened, filters used and which club, stadium, competition or match you picked (but not the places or addresses you search for). These are linked to a random app-instance identifier, along with device model, operating system version, app version, language and an approximate region. The apps do not use advertising identifiers (no IDFA on iPhone, no advertising ID on Android) and do not track you across other companies' apps or websites.
• Firebase Crashlytics: crash reports (stack trace, device model, OS and app version, an installation identifier) so we can fix bugs.
• Firebase Performance Monitoring: how long app start-up, screens and network requests take, so we can keep the app fast.
• Firebase App Check: confirms requests come from a genuine copy of the app on a genuine device, using Apple App Attest on iPhone and Google Play Integrity on Android. This protects our servers from abuse.

Legal basis: our legitimate interest (GDPR art. 6(1)(f)) in understanding how the apps are used, fixing crashes, keeping them fast and protecting the service. The data is limited to what that needs, is not used for advertising and is not linked to your name or contact details.

Website analytics

The website uses Google Analytics 4 for anonymous usage statistics: pages viewed, the leagues, cities and stadiums people look at, approximate region and device type. GA4 sets first-party cookies. It also uses Cloudflare Web Analytics, which sets no cookies and does not identify visitors. Legal basis: our legitimate interest in seeing what people use so we can improve the site. If you'd rather not be counted, a browser tracking blocker, or Google's Analytics opt-out add-on, will stop GA4. If we ask for consent before loading analytics, your choice is the legal basis and you can change it at any time.

Maps and directions

Maps come from Apple MapKit (website and iPhone app) and the Google Maps SDK (Android app). To show the map, your device requests map tiles from Apple or Google, which see your IP address and, when your location is shown on the map, may process it under their own privacy policies. When you ask for directions, the app hands the destination to the maps app you choose (Apple Maps, Google Maps or Waze on iPhone, or your maps app on Android). That app's own privacy policy then applies.

Stored on your device

Your preferences (such as language, filters, sort order and recent searches) and the last loaded matches, so the app still works offline, are stored only on your device or in your browser.

Server requests

Every request to matchspotter.com passes through Cloudflare, which processes your IP address to deliver the site and app data, block abuse and limit request rates. To find and fix errors, our server keeps technical request logs in Cloudflare for up to 7 days. These can include the address requested (for example a place search and its approximate position), your IP address and network details. We use them only to run and secure the service, never to profile anyone, and they are then deleted automatically.

Who processes data for us

• Cloudflare: hosting, content delivery, security and the rough location estimate.
• Google: Firebase Analytics, Crashlytics, Performance Monitoring and App Check (apps), Google Analytics (website), Google Maps SDK and Play Integrity (Android).
• Apple: MapKit and Apple Maps place search, and App Attest (iPhone).
• Match and photo data: fixtures come from API-Football and fixtur.es, and stadium photos from API-Football and Wikimedia Commons. They supply data to us. None of your personal data is sent to them.

How long data is kept

• Your precise location never reaches us. Place searches, the approximate position and the IP-based location estimate are not saved, except in technical request logs, which are deleted after at most 7 days.
• Analytics event data (apps and website): kept in Google Analytics for the data-retention period set in our property (at most 14 months), after which only aggregated reports remain.
• Crash reports: 90 days (Firebase Crashlytics).
• Performance data: 30 to 60 days (Firebase Performance Monitoring).
• App Check tokens: expire within 7 days.
• Data on your device: until you clear it, delete the app's data or uninstall the app.

International transfers

Google, Apple and Cloudflare may process data outside the European Economic Area, including in the United States. These transfers rely on the EU-US Data Privacy Framework, which these companies are certified under, and on the European Commission's Standard Contractual Clauses in their data processing terms.

Your rights and choices

Under the GDPR you have the right to access, correct or erase your personal data, to restrict or object to its processing, and to data portability. Because we have no accounts, we usually can't connect data to you. The analytics identifier is random and stored only in the app. To object or ask a question, e-mail hello@matchspotter.com. You may also complain to your data protection authority.

• Location: allow, limit or revoke it at any time in your device settings. The apps work without it: search a place instead.
• Reset the analytics identifier: delete the app's data (Android: Settings › Apps › MatchSpotter › Storage › Clear storage) or uninstall and reinstall the app (iPhone and Android). The app then starts with a new random identifier.
• Stop analytics and crash reporting: uninstall the app. On the website, use a tracking blocker.
• Have it deleted: see Delete your data.
• Advertising ID settings on your device don't matter here, because MatchSpotter uses no advertising identifier.

Children

MatchSpotter is a general-audience service, not directed at children under 13, and we don't knowingly collect personal data from children.

Not affiliated

MatchSpotter is not affiliated with, endorsed by or sponsored by any league, club or competition. Club and competition names and logos are trademarks of their owners and are shown only to identify them.

Changes to this policy

If what we collect changes, we update this page and the date below before the change goes live.

Contact

Privacy questions or requests: hello@matchspotter.com

Some stadium locations come from OpenStreetMap contributors and from Wikidata.

Last updated: 17 September 2026