1. Introduction
Smashd ("we", "us", "our") operates the Smashd mobile application and the website smashd.gg (collectively, the "Service"). This Privacy Policy explains how we collect, use, and share information about you when you use our Service.
We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
2. Data We Collect
We collect the following categories of personal data:
- Account information: name, email address, and phone number (used for SMS verification).
- Authentication data: OAuth tokens from Google or Apple Sign In.
- Gameplay data: match history, scores, SRP (Smashd Ranking Points), rank, and sport preferences.
- Profile data: username, avatar, and friend group memberships.
- Device & technical data: device model, OS version, and IP address (used for crash reporting and security).
- Usage analytics: in-app events and screen views (e.g., matches created, ranks achieved).
3. How We Use Your Data
We use the data we collect to:
- Create and manage your account.
- Run the ranked league: calculate SRP, assign ranks, and display leaderboards.
- Process match flows and score validations.
- Send push notifications (match updates, rank changes, disputes).
- Detect and prevent cheating, fraud, and abuse.
- Monitor app stability via crash reports.
- Understand product usage to improve the Service.
Legal bases under GDPR: contract performance (account and league services), legitimate interests (analytics, security), and your consent (push notifications).
4. Third-Party Services
We share data with the following processors:
- Supabase — database, authentication, and real-time infrastructure (EU region).
- PostHog — product analytics (EU region; no cross-app tracking; session replay disabled).
- Sentry — crash reporting and error monitoring.
- Google & Apple — OAuth authentication (Sign in with Google / Sign in with Apple).
- Stripe — payment processing for Season Pass purchases (billing data stored by Stripe, not us).
We do not sell your personal data. Each processor is bound by a data processing agreement and handles your data only as instructed by us.
5. Data Retention
We retain your personal data for as long as your account is active. When you delete your account, your personal information (name, email, phone number, avatar) is permanently erased or anonymised. Anonymised match history and SRP records may be retained indefinitely to preserve ranking integrity and leaderboard history.
6. Your Rights
Under GDPR, you have the right to access, rectify, erase, and port your personal data, as well as to object to certain processing. You can delete your account at any time from the app ("Settings → Delete Account"), which will trigger the erasure process described above.
For other requests, contact us at play@smashd.gg. We will respond within 30 days.
7. Children
The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
8. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. All data in transit is encrypted via TLS.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, via in-app notification. Continued use of the Service after changes constitutes your acceptance of the revised policy.
10. Contact
Smashd — play@smashd.gg