Privacy Policy
At Goya, we take the protection of your personal data seriously. This policy explains what data we collect, why, how it is used, and what your rights are — whether you use the Goya website or the Goya mobile apps (iOS and Android).
1. Who is responsible for your data?
The data controller is:
Thibault Lamour micro-enterprise, registered with INSEE on April 19, 2020, under SIRET number 883 011 280 00012, with its registered office at 19 route des Aulnays, 50330 Gonneville-Le Theil.
For any question regarding your personal data, contact us at: help@usegoya.com
2. What data do we collect?
Account data
- Email address, password (encrypted), or login credentials via Google / Apple (Sign in with Google, Sign in with Apple)
- Full name, username (unique handle)
- Profile picture (optional)
Profile data
- City of residence
- Sports practiced / interests
- Profile visibility settings (public or friends only)
Location data
- GPS coordinates of your position (with your explicit permission), used to show nearby sports events on the map
- Manually entered city for event search
Social and activity data
- Your friends list, sent/received friend requests
- Sports challenges created, sent, accepted, or completed, including progress
- Participation in sports events
- Interactions (follows, activity visible to your friends)
Technical data
- IP address, device type, operating system (for security and proper functioning)
- Strictly necessary technical cookies (login session persistence) — see section 8
Content you create
- Events you publish (if you are an organizer): title, description, location, date, image, indicative price
- Messages or proof submitted when claiming an organizer profile
Goya does not collect any health data, any banking data (Goya does not process payments directly — see section 3), and does not request any sensitive information within the meaning of Article 9 of the GDPR.
3. Payments and transactions
Goya lists sports events organized by third parties. Displayed prices are provided for informational purposes only. Goya does not collect, process, or store any banking or payment data: any paid registration for an event happens directly with the third-party organizer, outside the Goya platform.
4. Why do we use your data?
| Purpose | Legal basis |
|---|---|
| Account creation and management | Performance of contract (Terms of Service) |
| Displaying nearby events | Consent (geolocation) |
| Social features (friends, challenges) | Performance of contract |
| Service improvement, internal statistics | Legitimate interest |
| Security, fraud prevention, moderation | Legitimate interest / legal obligation |
| Essential communications (account confirmation, security notices) | Performance of contract |
| Activity-related notifications (challenges, friends, events) | Consent (configurable in settings) |
4 bis. Profiling and automated ranking
Goya calculates an internal score (not publicly disclosed) based on your activity — number of events attended, challenges completed, number of friends, account age — in order to establish a ranking within the "Community" section. This score is used solely for a playful ranking display and does not result in any automated decision producing legal effects or significantly affecting you within the meaning of Article 22 of the GDPR. This ranking does not affect your access to the service, your rights, or the pricing or conditions offered to you.
5. Who has access to your data?
Your data is never sold. It may be shared with:
- Other users, based on the information you choose to make public (profile, event participation)
- Our technical subprocessors, who process data on our behalf, strictly within their assigned task:
- Supabase Inc. — database hosting, authentication, image storage
- Mapbox Inc. — interactive maps and geocoding
- Google LLC and Apple Inc. — only if you choose to sign in via these services
- Photon / OpenStreetMap (Komoot) — city search service, without transmitting identifying personal data
- Competent authorities, only when legally required
6. How long do we keep your data?
| Data category | Retention period |
|---|---|
| Account data (email, profile) | Lifetime of the account + 30 days after deletion (security buffer) |
| One-time location data | Not persistently stored — used only in real time to display the map |
| Event participation history | Lifetime of the account |
| Challenges, friendships | Lifetime of the account, or immediate deletion if either party deletes their account |
| Technical security logs | 12 months maximum |
| Organizer claim supporting documents | 3 years after the request is processed (evidentiary period) |
Upon account deletion, your identifying personal data is deleted or anonymized within 30 days, unless a longer retention period is legally required.
7. International transfers
Some of our subprocessors (Supabase, Mapbox, Google, Apple) may process data outside the European Union. In such cases, these transfers are governed by appropriate safeguards (European Commission Standard Contractual Clauses, or an adequacy decision).
8. Cookies
Goya only uses strictly necessary cookies for the service to function (maintaining your login session via Supabase Auth). We do not use any advertising cookies or trackers for marketing profiling purposes.
9. Your rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure: request deletion of your account and data
- Right to data portability: receive your data in a structured format
- Right to object and right to restriction of processing
- Right to withdraw consent at any time (e.g. disable geolocation)
You can exercise these rights directly from your account settings (Profile page), or by contacting us at help@usegoya.com.
You also have the right to lodge a complaint with your local data protection authority (in France, the CNIL: www.cnil.fr).
9 bis. Data Protection Officer
Given the size of our activity, we are not legally required to appoint a Data Protection Officer (DPO). Any request regarding your data can be sent to help@usegoya.com.
10. Security
We implement technical and organizational measures to protect your data (password encryption, strict access control via database-level security policies, HTTPS connections).
11. Minors
Goya is not intended for individuals under [TO BE COMPLETED — e.g. 16] years of age. If you believe an account was created by a minor under this age, please contact us immediately.
12. Changes
This Privacy Policy may be updated. The last update date is shown at the top of this page. In case of substantial changes, we will notify you through the app.
13. Contact
For any questions: help@usegoya.com