Privacy policy

Draft. This text must be reviewed by a lawyer for GDPR (EU), UK GDPR and KVKK (Turkey) before launch. — Last updated: 2026-10-22

Who we are

Sparrio operates the Sparrio mobile app and the website sparrio.online and is the controller of the data described here. Privacy and support requests: destek@sparrio.online. Postal address and registered company details: to be completed before launch.

Data we process in the app

Account: e-mail address, display name, year of birth (only the year; used to enforce the minimum age) and the sign-in provider (e-mail, Google or Apple). Your user ID is created by Firebase Authentication.

Optional: phone number, and your choice whether to share it (see Sharing); profile details such as bio, sports, level, district, language and profile visibility.

Location: you choose your country, city and district by hand. The app does not read GPS or precise location.

Activity and content: booking requests (venue, time, note, status), game listings and the applications you send or receive, follows, blocks, and reports you file.

Device: a push notification token (only if you allow notifications) and the time you accepted the terms.

Reviews and reports: reviews you write about venues (rating and text) and error reports you send (report type and description) are linked to your account. If you delete your account, your reviews are anonymised and your reports are deleted.

What we do not collect

Precise location, contacts, photos or media, health data, payment details (there are no payments in the app; any deposit is agreed with the venue outside the app), browsing history or audio.

Data we process on this website

This website is static and sets no cookies by default. Optional analytics (Google Analytics 4) runs only after you give consent on the cookie banner; see Cookies & analytics. The hosting provider may log IP addresses for security for a limited period.

Account on the website (optional): if you sign in or register here, we use the same Firebase Authentication account as in the app (e-mail address, display name, sign-in provider) and the profile fields you edit (display name, bio, visibility). There are no payments on the website; subscriptions are sold only in the App Store and Google Play.

Advertising

Advertising in the app is switched off by default. If we enable it, the app shows a small banner served by Google AdMob. For this, Google may process your device advertising identifier, approximate location (from your IP address), ad interactions and diagnostic data. In the EEA, UK and Switzerland the app first shows Google's consent form (User Messaging Platform); on iOS it also asks for tracking permission (App Tracking Transparency). You can change your choice under Settings → Privacy options. There are no ads on this website.

See Google's privacy policy and “How Google uses information from sites or apps that use our services”.

Business data from OpenStreetMap

The information cards of unclaimed venues in the app contain publicly available business data taken from OpenStreetMap (© OpenStreetMap contributors, ODbL 1.0): name, address, location, business phone number, website and opening hours. We use this data in line with the ODbL 1.0; see Data sources and licences.

Legal basis: legitimate interest (GDPR Art. 6(1)(f); Turkish KVKK Art. 5/2-f). The data is business information that has been made public and is used so that users can find venues near them.

For unclaimed OpenStreetMap venues we do not import or show mobile phone numbers (in Turkey, numbers starting with +905). Outside Turkey, only business numbers in international format (starting with +) are shown.

If you are the business owner or otherwise concerned, you can ask for the information to be corrected, hidden or deleted, or object to its processing: use “This is my business” or “Report wrong info” in the app, or write to destek@sparrio.online. We answer requests within 30 days at the latest; our target is a first review within 24 hours. A deleted venue is not imported again.

Legal bases

Contract performance (account, bookings and game listings), legal obligation and legitimate interest (age check, security, abuse prevention, moderation) and consent (notifications, advertising and analytics where required, sharing your phone number).

Who receives data

Venues see your name and the details of the booking request you send them. Your phone number is passed to a venue only if you tick a separate consent box when booking; in a game listing it is shown to an accepted applicant only if the author chooses to share it. Other signed-in users see your name and the profile and listing details you publish; a profile set to “followers only” is shown only to followers.

Service providers (processors): Google Firebase (authentication, database, cloud functions, push messages), hosted in the EU region europe-west1; Apple (Sign in with Apple, push delivery on iOS); Google (Google sign-in, AdMob if ads are enabled).

We do not sell personal data.

Retention and deletion

Account data is kept until you delete the account (Settings → Delete my account) and is then deleted from our servers. After deletion, past booking records remain with the venue without your user ID, phone number or note; reviews you wrote remain without your name; reports you filed remain without your identity. A moderation archive (up to 30 days) and a hashed ban list are kept for safety. Details: see the account deletion page.

Support e-mails are kept until the request is closed.

Your rights

Access, rectification, deletion, restriction, portability, objection and withdrawal of consent, and the right to complain to a supervisory authority. You can delete your account in the app or through the account deletion page. For other requests write to destek@sparrio.online.

Children

Sparrio is not intended for children under 13; registration is refused if the year of birth shows you are younger. Social features (game listings, applications, follows) are for users aged 18 or older.

Changes

We publish changes on this page with a new date.