Privacy Policy

1. Who we are and how to contact us

CAMPO is operated by:

For any question about this Privacy Policy or about how we handle your personal data, write to privacy@campo.club.

2. What CAMPO is, in privacy terms

CAMPO is a free football prediction service. Users register an account, join or create private groups, and submit predictions for upcoming football fixtures. We collect only the data we need to operate the service.

3. What data we collect

Data you provide when registering

• Email address
• Password (stored only in hashed form by our authentication provider)
• Nickname (publicly visible to other members of your groups and on the Hall of Fame)
• Full name (visible only to you on your own profile)
• Avatar selection from a predefined set

Data you generate by using CAMPO

• Predictions you submit (home and away goal counts per fixture)
• Groups you create, join, or leave
• Points you earn from scored predictions
• Trophies awarded for winning group competitions
• Group avatars you upload, if you create a group
• Language preference (DE or EN)
• Notification preference (on or off)

Data we generate automatically

• Account creation, update, and (where applicable) soft-deletion timestamps
• Server logs from our hosting provider, including IP address, the pages you access, and timestamps. These logs are kept for a short period for operational and security purposes.
• Internal records confirming that a transactional email has been sent to you (to prevent duplicate sends), without the content of those emails.

4. Why we process this data and on what legal basis

We process data for the following purposes:

To provide the service to you. Creating and maintaining your account, letting you join groups, recording your predictions, calculating scores, displaying leaderboards and the Hall of Fame. Legal basis: performance of a contract between you and us when you register and use CAMPO (Art. 6(1)(b) GDPR).

To send you transactional emails. Email verification on signup, password reset emails, group invitation links, prediction reminders, match-result notifications, and similar service messages. These emails are essential to the service and cannot be disabled at the account level except via the notifications setting where applicable. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To keep the service secure and reliable. Server logs, abuse prevention, and detection of unauthorised use of accounts. Legal basis: our legitimate interest in keeping CAMPO operational and safe (Art. 6(1)(f) GDPR).

To comply with legal obligations. Where the law requires us to retain certain data or to respond to authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Who can see your data

Other users

• Your nickname is visible to other members of any group you join, and on the global Hall of Fame if you appear in the top 50.
• Your avatar is visible to other members of any group you join, and on the global Hall of Fame.
• Your trophies are visible to members of groups you share.
• Your predictions are visible to other members of a group only after a fixture has been completed. Before kickoff, during play, and for cancelled fixtures, other members cannot see them. You can always see your own predictions.
• Your full name is visible only to you. Other users do not see it.
• Your email address is never visible to other users.

Service providers

We use the following providers to operate CAMPO. Each acts as a data processor on our behalf and is bound by appropriate data-processing agreements.

• Supabase (Supabase Inc., USA, with EU-region data hosting) — authentication, database, and file storage. Your account email, password hash, profile data, predictions, group memberships, and related records are stored on Supabase infrastructure.
• Vercel (Vercel Inc., USA) — application hosting. Requests you make to CAMPO are served via Vercel's infrastructure, which generates server logs as described above.
• Resend (Resend, Inc., USA) — sending transactional emails. Your email address and the content of those emails pass through Resend.
• Migadu (Migadu, Switzerland) — receiving emails sent to our contact address.
• API-Sports (API-Sports, France) — match data provider. We send no personal data to API-Sports; they provide us with fixture and result data, which we then use within CAMPO.
• Plausible (Plausible Insights OÜ, Estonia, EU) — privacy-friendly website analytics. Plausible measures aggregate usage such as page views and visitor counts. It uses no cookies, stores no IP addresses or other personal data, and does not track you across websites. Data is hosted in the EU.
• Sentry (Functional Software, Inc., USA, with EU-region data storage) — application error monitoring. When a technical error occurs, diagnostic information such as the error type and where it happened is sent to Sentry so we can fix it. We have configured Sentry not to store IP addresses or other directly identifying personal data.

Where providers are based outside Switzerland or the EU/EEA, transfers are protected by adequacy decisions or by Standard Contractual Clauses, as applicable.

Authorities

We may disclose data to public authorities where we are legally required to do so.

6. Where we store data

CAMPO uses EU-region data hosting for primary storage of user data via Supabase. Some operational data (such as email delivery records and server logs) may be processed outside the EU by providers based in the United States. In those cases the safeguards described in section 5 apply.

7. How long we keep data

Account data — for as long as your account exists. If you delete your account, see section 8.

Predictions, points, and trophies — retained for as long as the groups they belong to are meaningful to other members, including after you delete your account. See section 8.

Server logs — kept by our hosting provider for a short period for operational and security purposes, typically up to a few weeks.

Transactional email delivery records — kept for a short period to prevent duplicate sends.

We do not retain personal data longer than necessary for the purposes for which it was collected, unless we are legally required to do so.

8. Account deletion

You can delete your account at any time from the settings page.

Deletion is a soft delete: your account is deactivated, you can no longer log in, your profile is hidden from other users, and your data is no longer used by the service. Some data tied to the integrity of groups you participated in — predictions you made, points you earned, trophies held by other members of those groups — is retained so that other users' competition history remains coherent.

If you want this retained data to be deleted entirely, write to privacy@campo.club. We will review the request and where possible carry out a full deletion, subject to the technical and legal considerations explained above and to any legal retention obligations.

9. Your rights

Depending on your country of residence, you have the following rights with respect to your personal data:

• Access — to know what data we hold about you and to receive a copy of it.
• Rectification — to have inaccurate data corrected.
• Erasure — to ask us to delete data we hold about you, subject to the limits described in section 8 and to any legal retention obligation.
• Restriction — to ask us to limit the way we process your data in certain situations.
• Objection — to object to processing based on our legitimate interest.
• Data portability — to receive your data in a structured, commonly used, machine-readable format.
• Withdrawal of consent — where processing is based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing already carried out.

To exercise any of these rights, write to privacy@campo.club. We may ask you to verify your identity to prevent disclosure of your data to someone else.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you are in the EU/EEA, you can complain to the supervisory authority in your country of residence.

10. Cookies

CAMPO uses only essential cookies needed to keep you signed in (authentication session cookies). We do not use advertising cookies or cross-site tracking technologies. Because we set only essential cookies, no cookie consent banner is shown.

To understand how CAMPO is used, we use Plausible, a privacy-friendly analytics service. It sets no cookies, stores no IP addresses, and does not track you across websites, so no consent is required. We also use Sentry to monitor technical errors, configured to exclude IP addresses and other directly identifying data. Both are listed under "Service providers" above.

If we add non-essential cookies in the future, we will update this Policy and, where required, ask for your consent first.

11. Children

CAMPO is not intended for children under 18. Do not create an account if you are under 18. If we become aware that we have collected data from a child under 18 without parental consent, we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available at campo.club/privacy with the "Last updated" date at the top. If we make a material change we will notify registered users by email.

13. Contact

For any question about this Privacy Policy or about how we handle your personal data, write to: