The data controller under the General Data Protection Regulation (GDPR) is:
Timo Thurmayr
Bahnhofstraße 29
83278 Traunstein, Germany
Email: info@sportorbit.com
| Data category | Specific data | Storage location | Purpose |
|---|---|---|---|
| Account | Email address, password hash | Supabase (authentication) | Sign-in, account management |
| Profile | Display name (optional, max. 30 characters) | Supabase database | Display on leaderboards |
| Follows | IDs of followed leagues, teams, sports, athletes | Supabase database | Personalized views |
| Game scores | High scores in mini-games (streak counts, point totals) | Supabase database + localStorage | Progress tracking, leaderboards |
| Activity streak | Daily streak counter, date of last active day | Supabase database | Gamification |
| Badges | Earned badge keys + date | Supabase database | Gamification |
| Local settings | Onboarding status, cache for news and game scores | localStorage (local to your browser only) | Performance, offline use |
Provider: Supabase Inc., San Francisco, USA. Emails and passwords are stored encrypted. Data transfer to the USA is based on the EU Standard Contractual Clauses. Privacy policy: supabase.com/privacy
This service fetches external RSS news feeds and returns them as JSON. When news is loaded, a request is sent to api.rss2json.com, which transmits your IP address. No personal user data is shared. Privacy policy: rss2json.com/privacy
To generate AI-written news summaries, headlines from RSS feeds are sent to the Anthropic API. This feature is available to administrators only. Your personal data is not transmitted as part of this process. Privacy policy: anthropic.com/privacy
System messages – such as the link to reset your password – are sent via Brevo. The following are processed: the recipient's email address, the time of sending, the subject and content of the message, and the delivery status (delivered, delayed, rejected). Brevo retains this information so that delivery problems can be traced. We do not send marketing or newsletter emails.
Provider: Brevo, operated by Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France. The servers are located exclusively within the EU (France, Germany and Belgium). A data processing agreement under Art. 28 GDPR forms part of their terms of service. Privacy policy: brevo.com/legal/privacypolicy
We count page views with GoatCounter to see which content is used. What is recorded: the page visited, the time, the referring page, browser and operating system name, approximate location at country level, language setting, and screen width. No cookies are set and no identifiers are stored in your browser, which is why we do not ask for consent. IP address and full user agent are not stored – they are used solely to group repeat views within up to eight hours, and are held in memory only. Individual people are not recognised across visits.
Provider: GoatCounter, operated by Martin Tournoij (Ireland). The data is stored on servers of Hetzner Online GmbH in Germany and Finland, i.e. within the EU. Privacy policy: goatcounter.com/help/privacy
The fonts used (Barlow Condensed, Inter) are served from our own server and are not fetched from Google Fonts. No connection to Google is established and no IP address is transmitted there.
SportOrbit does not use tracking cookies. The analytics described above (GoatCounter) work without cookies as well. For the app to function, the following data is stored in your browser's localStorage (locally only, never transferred to a server):
You can delete this data at any time via your browser settings (F12 → Application → Local Storage).
Account data is stored until account deletion. After account deletion, all linked data (follows, game scores, badges) is automatically deleted (ON DELETE CASCADE). localStorage data remains until manually cleared in your browser.
You have the following rights regarding your personal data:
Send requests to: info@sportorbit.com
All connections to the platform use HTTPS. Passwords are hashed by Supabase and never stored in plain text. Database access is protected by Row-Level Security (RLS) – each user can only access their own data.
SportOrbit provides sports data, standings, news, and knowledge games. There is no chat, no user-to-user communication, no betting or gambling features, and no publicly visible user-generated content. For these reasons we do not impose a strict minimum age on using the platform itself.
Creating an account with an email address is a separate matter and entirely optional. Under Art. 8 GDPR, consent to the processing of personal data requires the authorisation of a parent or guardian for children under the age of 16. Registration is therefore reserved for persons aged 16 or over under Section 3 of the Terms of Use.
⚠ The age limit is set, but it is not actively verified at registration: the form asks only for an email address and a password – there is neither an age entry nor any proof. Whether a text-based rule without verification is sufficient has not been legally reviewed and must be confirmed by qualified legal advice before going live.
We reserve the right to update this privacy policy as needed. The current version is always available at /privacy.html. The date of the last change is shown above.