Legal

Privacy Policy

Effective 21 April 2026 · Last updated 21 April 2026

MoveTogether.now is a sports matchmaking service run by MoveTogether.now VOF (“MoveTogether.now”, “we”, “us”). This policy explains what personal data we process when you use our app or website, why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch implementing act (UAVG).

1. Who we are

The data controller is MoveTogether.now VOF, registered in the Dutch Chamber of Commerce (KvK) under number 99874237. You can reach us at team@movetogether.now.

We have not appointed a Data Protection Officer because we are not legally required to. For any privacy question, write to the address above.

2. What data we process

We only collect what we need to run the matchmaking service.

2.1 Account data

  • Email address — to create your account, send password reset codes, and send operational notices.
  • Name or display name — shown on your profile and to other players you match with.
  • Password — stored as a salted hash; we never see the plaintext.
  • Date of birth — collected to verify you are at least 16, as required for social services under GDPR as implemented in the Netherlands.
  • User IDs — numeric identifiers we assign to your account. A public user ID appears in your profile URL so other users can link to your profile.

2.2 Profile and event data

  • Profile photo and optional event photos you upload.
  • Sports you play and your self-declared skill level.
  • Event descriptions, comments, and messages you post within the app.
  • Vibe ratings and match results you submit after a session.
  • Reports and feedback you send us about other users, events, or the app.

2.3 Location data

  • Approximate or precise location, only when you grant the app permission, so we can show nearby events and let you pin a location for an event. You can revoke this permission in your device settings at any time.
  • Event locations you pin, which are visible to other users who can see that event.

2.4 Device and technical data

  • Push notification token issued by Apple or Google, so we can send you notifications about matches and events.
  • Firebase installation ID (a random identifier tied to your app install, not to your device hardware) used to deliver push messages.
  • Crash logs and diagnostic information if the app crashes — technical stack traces, OS version, app version. We do not read the contents of your screen.
  • Authentication tokens stored on your device to keep you signed in.

We do not collect special-category data (health, religion, sexual orientation, biometrics, etc.). Please do not put such data in free-text fields.

3. Why we process it and on what legal basis

Under Article 6 GDPR, every processing activity needs a legal basis. Ours are:

PurposeData usedLegal basis
Create and maintain your account; let you sign in Email, password hash, name, IDs Performance of a contract (Art. 6(1)(b))
Match you with players and show you nearby events Location, sports, skill level, profile Performance of a contract (Art. 6(1)(b))
Send push notifications about matches and events Push token, installation ID Performance of a contract (Art. 6(1)(b))
Verify that you are 16 or older Date of birth Legal obligation (Art. 6(1)(c)), UAVG Art. 5
Moderate content and investigate reports; keep the service safe Reports, comments, photos, logs Legitimate interest in a safe service (Art. 6(1)(f))
Fix bugs, prevent abuse, and keep the service stable Crash logs, diagnostic data Legitimate interest (Art. 6(1)(f))
Respond to your questions, feedback, or legal requests Contact details and the content of your message Legitimate interest (Art. 6(1)(f)) or legal obligation (Art. 6(1)(c))

We do not use your data for advertising, profiling for marketing, or automated decisions with legal effect. We do not sell personal data.

4. Who we share it with

We share data only with service providers that help us run the app. They act as processors under written agreements and only do what we tell them:

  • Google Firebase (Google Ireland Limited) — push notification delivery (Firebase Cloud Messaging) and crash reporting.
  • Google Maps (Google Ireland Limited) — to show the map and let you pick locations. When a map is displayed, Google processes your IP address and coarse location under its own terms.
  • Hosting and database providers in the EU/EEA, for storing your data and running the backend.

We also share information with other users of the app in the ways the app visibly does so — for example, your display name, profile photo, sports and skill level are visible to people you match with, and your event details are visible to users who can see that event. Your email address is never shown to other users.

We will share data with public authorities if we are legally required to (for example, a valid court order). We publish no data to search engines.

5. How long we keep it

  • Active accounts: for as long as your account exists.
  • Deleted accounts: when you delete your account in Settings, your profile is removed from the app within a few hours and your personal data is erased from our production database within 30 days. Backups are overwritten on a rolling basis within 90 days.
  • Events you created or joined: anonymised after your account is deleted, so co-participants’ own history stays intact.
  • Reports, blocks, and moderation records: kept up to 24 months after the related account is deleted, so we can handle repeat offenders and complaints.
  • Crash logs and server logs: up to 90 days.
  • Backups: up to 90 days.

6. International transfers

Our servers and primary storage are located in the European Economic Area (EEA). Some of our sub-processors (Google) may transfer limited data outside the EEA. When they do, transfers are covered by the European Commission’s Standard Contractual Clauses, plus additional technical safeguards where needed, in line with the Schrems II ruling.

7. Security

We use HTTPS for all traffic between your device and our servers, hash passwords, keep authentication tokens on your device in secure storage, and restrict production access to a small number of people. No online service is perfectly secure; if we ever discover a personal-data breach that is likely to affect you, we will notify you and the Dutch Data Protection Authority as required by Articles 33 and 34 GDPR.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

  • Access — ask for a copy of the data we hold about you.
  • Rectification — ask us to correct inaccurate data. You can change most profile fields yourself in the app.
  • Erasure — ask us to delete your data. You can delete your account in Settings → Delete Account, or by writing to us.
  • Restriction — ask us to limit processing in certain cases.
  • Portability — ask for a machine-readable copy of the data you gave us.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — where we rely on consent (e.g. location permission), you can withdraw it at any time in your device settings.

To use any of these rights, write to team@movetogether.now. We will reply within one month.

You can also lodge a complaint with the Dutch supervisory authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the supervisory authority in your country of residence.

9. Children

MoveTogether.now is not intended for people under the age of 16. We ask for your date of birth at sign-up and block accounts that do not meet this age. If you believe a child under 16 has created an account, let us know at team@movetogether.now and we will remove it.

10. Changes to this policy

We may update this policy when the service or the law changes. The “Last updated” date at the top shows when. For material changes we will also notify you in the app or by email.

11. Contact

MoveTogether.now VOF
KvK: 99874237
Email for privacy matters: team@movetogether.now
Support: support@movetogether.now

Read the Terms of Service →