Privacy Policy

Athzi is run by Harsh Gautam, a natural person, from Poznań, Poland. He is the controller of your personal data under the General Data Protection Regulation (GDPR) and Polish data protection law. Contact: support@athzi.com (all privacy requests). Security issues: security@athzi.com. Athzi is a free service. There is no data protection officer, as the law does not require one for a service of this kind.

• Account data: name, email address, username, date of birth, country • Profile data: city, bio, favourite sports, skill level, profile photo and, if you make one, your Athzi avatar (the character and look you chose, and the two pictures made from it) • Content and activity: posts and their photos, comments, reactions, games you create or join, messages and game chat, bookings, reviews • Coach data: if you register as a coach, your coaching details and any certificate you upload to be checked for the Verified badge • Technical data: IP address, device and browser type, and the sign-in session that keeps you logged in • Location: the city or place you choose. The app uses your device location only if you allow it, to show games and coaches near you. It is not stored on your profile; it is saved only when you choose to, for example as the place of a game or when you share your location in a chat. Your email, name, date of birth and username are needed to create an account; without them we cannot provide Athzi. Everything else is optional.

• Running your account, games, messages, coaching bookings and notifications — performance of our agreement with you (Art. 6(1)(b) GDPR) • Checking coach certificates for the Verified badge — our legitimate interest in letting players trust the coaches they book (Art. 6(1)(f)) • Keeping Athzi safe: blocking prohibited words in posts, comments and profiles, preventing spam and fake accounts (captcha at sign-up), acting on reports — our legitimate interest in a safe platform for its users, including young people (Art. 6(1)(f)) • Counting website visits without cookies, to see which pages are used — our legitimate interest in keeping the site working well (Art. 6(1)(f)) • Crash and error reports, to find and fix faults in the app and website — our legitimate interest in a working, secure service (Art. 6(1)(f)) • Device location, to show what is near you — your consent, which you can withdraw in your device settings at any time (Art. 6(1)(a)) • Complying with the law, e.g. answering lawful requests from authorities — legal obligation (Art. 6(1)(c)) Where we rely on legitimate interest, we have weighed it against your rights; you can object at any time (section 7). We do not send marketing. Automated checks. Text in posts, comments and profiles is checked automatically against a list of prohibited words, and text that fails the check is not saved. Photos and messages are not checked automatically; you can report them and we review every report. No other decisions about you are made by automated means alone. If you think a check got it wrong, write to support@athzi.com and a person will review it.

• Other users see your public profile, posts, games and reviews. With a private profile, only people you approve see your posts. • Service providers that process data for us: – Supabase: database, sign-in and photo storage – Vercel: website hosting, and visit counting without cookies (Vercel Web Analytics) – Sentry (servers in the EU): crash and error reports from the app and website, so we can fix them; these hold the error, device and app version, and an account number only, never your name, email, messages or what you type – Resend: emails you send us through the in-app contact form – Expo, Google (Firebase) and Apple: delivery of push notifications – Google and Apple: sign-in, if you choose "Continue with Google" or "Continue with Apple" – GIPHY: the GIF search in chats; it receives what you search for and, like any website, your IP address, and the GIF you send is shown from its servers – Cloudflare (Turnstile): the anti-spam check at website sign-up – Google Maps, Apple Maps (on iPhone), OpenStreetMap and CARTO: maps and place search • Authorities, when Polish or EU law requires it. We do not sell your data and do not share it with advertisers.

Several of these providers are based in the United States. Where your data is transferred outside the European Economic Area, it is protected by the EU–US Data Privacy Framework for certified providers, or by the European Commission's Standard Contractual Clauses.

We keep your data while your account exists. You can delete your account in Settings or at athzi.com/delete-account. Deletion is immediate and cannot be undone; at that moment we delete your account, profile, avatar, photos, posts, comments, reactions, games and join requests, messages and game chat you sent, reviews, coaching bookings and coach certificate. After that: • A one-way cryptographic code (hash) of your email is kept for 30 days, only so we can show a clear message if you try to sign in to the deleted account. It cannot be turned back into your address and is removed automatically after 30 days. • Copies in our providers' backups are overwritten within 90 days.

Under the GDPR you have the right to: • Access your data and get a copy (Art. 15) • Rectify inaccurate data (Art. 16) • Erase your data (Art. 17) • Restrict processing (Art. 18) • Data portability (Art. 20) • Object to processing based on legitimate interest (Art. 21) • Withdraw consent at any time, without affecting what was done before (Art. 7(3)) Write to support@athzi.com; we reply within 30 days. You can also complain to the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

The website uses only what it needs to work: • Sign-in cookie (set by Supabase): keeps you logged in • Browser storage: your language, light or dark theme, that you have seen the cookie notice, the email you last signed in with, your recent searches and map position • Cloudflare Turnstile: on the sign-up page only, to tell people from bots These are strictly necessary, so they do not need consent. Visit counting (Vercel Web Analytics) uses no cookies and does not identify you. We use no advertising or tracking cookies. The mobile app keeps your sign-in session and settings on your device.

We protect your data with encryption in transit (TLS), encrypted database storage, access rules that let each person reach only their own private data, and regular security reviews. No service on the internet is 100% secure. If you find a vulnerability, please write to security@athzi.com.

Athzi is for people aged 16 and over. Your date of birth is checked at sign-up. Users aged 16 and 17 get extra protection: their profile stays private, only people they are connected to can message them, and booking a coach is available from 18. We do not knowingly collect data from anyone under 16; if you believe a child under 16 has given us data, contact us and we will delete it.

When we change this policy, we update the date at the top. For significant changes we will tell you by email or in the app before they take effect. If a change needs your consent, we will ask for it.