BIBSPrivacy Policy
In short. BIBS helps you organise your group's football games. To do that we use your name, email address, profile picture (if you add one), the teams you belong to, your attendance and the skill ratings set by team admins. We do not sell data, show ads, use trackers or track you across other apps or websites. You can delete your account at any time, right inside the app.
1. Who we are
The controller of your personal data under Regulation (EU) 2016/679 (“GDPR”) is:
IORDAN ROBERT-ADRIAN PERSOANA FIZICA AUTORIZATA (a Romanian sole trader)
Tax ID (CIF) 51961705, Trade Register No. F202501276007
Registered office: Strada Baia de Arama, Nr. 1, Bl. B2, Corp B2, Etaj 5, Ap. 28, Sector 2, Bucuresti, Romania
Data protection email: privacy@getbibs.app
This policy covers the BIBS mobile app (iOS and Android), the server (API) behind it and this website. We have not appointed a Data Protection Officer because our activities do not meet the criteria of Art. 37 GDPR; send any question to the address above.
2. Data we process
| Category | What exactly | Source |
|---|---|---|
| Account data | Name (max. 80 characters), email address, password (stored only as a bcrypt hash, never in plain text), whether the email is confirmed, preferred language (ro/en), optional nickname, account creation and last sign-in dates. | You, at sign-up and in your profile. |
| Sign in with Google / Apple | The stable account identifier (“subject”) of your Google or Apple account, and the name and email the provider shares. With Apple you can choose to hide your real email (Apple relay address). | Google or Apple, when you choose that method. |
| Profile picture and team logo | The uploaded image (max. 4 MB). Before storing it we strip its metadata (EXIF including GPS location, camera serial numbers, XMP, comments). | You (photo library or camera), only if you choose to upload. |
| Team data | Teams you belong to, your role (Player, Admin, Admin+), status, preferred position, in-team nickname, signup priority, join date, per-team notification preferences. | You and the team admins. |
| Skill ratings | A score from 0 to 5 per team, used to split sides fairly; re-evaluation requests and admin votes. | Team admins; requests come from you. |
| In-app activity | Signing up for and withdrawing from session lists, generated sides, coin tosses, match clock, match history and attendance stats, team announcements, ideas and requests sent to admins. | Your use of the app and that of other members. |
| Invitations | The invitee's email address, who invited them, the proposed role, an optional message, invitation status. | The member who sends the invitation. |
| Sessions and devices | For each signed-in device: device name, user agent, IP address at sign-in, last-used date; for notifications: Expo push token, platform (iOS/Android), app version, device language. | Generated automatically by the app and server. |
| Subscription | For each team: subscription state (trial, active, cancelled, expired), product purchased, current period, store (App Store / Google Play), RevenueCat transaction identifiers and the paying user. We never receive or store your card details; payment is processed entirely by Apple or Google. | Apple / Google via RevenueCat. |
| Audit log | Significant administrative actions (role changes, ratings, removals, side generation, subscription, account deletion): who, when, what changed. | Generated automatically by the server. |
| Technical logs | For each request to the server: method, path, response code, duration, IP address and user agent. Passwords, tokens and authorisation headers are masked automatically and never reach the logs. | Generated automatically by the server. |
| Correspondence | Messages you send to support and our replies. | You. |
What we do not collect: device location, phone contacts, health data, advertising identifiers (IDFA/AAID), browsing history, payment card data. The app contains no analytics, advertising or crash-reporting SDKs. We do not ask for special-category data (Art. 9 GDPR) and ask you not to enter it into free-text fields (e.g. a reason for absence).
The data requested at sign-up (name, email, password or a Google/Apple account) is needed to create your account; without it we cannot provide the service. Profile picture, nickname and other optional fields are up to you.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account, authentication (including with Google/Apple), email confirmation, password reset | Account data, sessions | Performance of a contract - Art. 6(1)(b) |
| Running the group: teams, invitations, signup lists, splitting sides, matches, history, announcements, requests and ideas | Team data, activity, invitations, picture | Performance of a contract - (b) |
| Skill ratings and balanced side generation | Ratings, attendance | Performance of a contract (a core feature of the service you joined) - (b); the group's legitimate interest in balanced games - (f) |
| Emailing an invitation to someone who has no account yet | Invitee's email | Legitimate interest of the inviting member and ours in letting people join the group - (f) |
| Push notifications and service emails (signups open, sides ready, match day, announcements, invitations) | Push token, email, language | Performance of a contract - (b). Push notifications are only sent if you allowed them in your operating system. |
| Team subscriptions, free trial, restoring purchases | Subscription data | Performance of a contract - (b); accounting and tax obligations where applicable - (c) |
| Security: preventing unauthorised access, rate limiting, detecting token reuse, the “signed-in devices” list | Sessions, IP, user agent, technical logs | Legitimate interest in protecting accounts and the service - (f) |
| Audit log (who changed a rating, a role, etc.), resolving group disputes and support requests | Audit log | Legitimate interest of the group and ours in transparency and accountability - (f) |
| Answering your messages and handling GDPR requests | Correspondence | Performance of a contract - (b); legal obligation - (c) |
| Establishing or defending legal claims | Data relevant to the case | Legitimate interest - (f) |
Where we rely on legitimate interest, we have assessed that it does not override your rights; you may object at any time (see section 10). We do not use data for marketing; if we ever send commercial messages, we will ask for your consent first.
4. Who sees what in the app
- Members of your teams see your name, nickname, picture, position, signups, the side you were placed in and the match history of that team.
- Team admins (Admin, Admin+) additionally see skill ratings, submitted requests and ideas, invitations and the team audit log.
- Skill ratings are visible to regular players only if the team admins turn that option on (it is off by default).
- Profile pictures and logos are served from a hard-to-guess web address; anyone who has the exact address can open it.
- The controller (IORDAN ROBERT-ADRIAN PERSOANA FIZICA AUTORIZATA) and people it authorises may access data strictly for support, security and legal compliance.
5. Data about other people
Admins can add guest players (people without a BIBS account) to lists with a name, a rating and a position, and can invite people by email. When you do so, please add only what is needed (e.g. a first name) and let the person know. An invited person receives a single invitation email and can ask for their data to be deleted by writing to privacy@getbibs.app.
6. Recipients and providers (processors)
We do not sell or rent personal data. We disclose it only to providers that help us run the service, under data processing agreements (Art. 28 GDPR), and only as far as needed:
| Provider | Role | Data | Location |
|---|---|---|---|
| MongoDB, Inc. (MongoDB Atlas) | Hosted database | All app data | European Union (Frankfurt region, Germany) |
| Server (API) hosting provider | Runs the BIBS server | Data passing through the server, technical logs | European Union |
| File storage provider (S3-compatible) | Stores profile pictures and logos | Images | European Union |
| Transactional email provider (SMTP) | Sends confirmation, password reset and invitation emails | Email address, name, message content | EU / USA (see section 7) |
| Expo (650 Industries, Inc.) | Push notification service, relaying to Apple (APNs) and Google (FCM) | Push token, notification text | USA |
| RevenueCat, Inc. | Manages subscriptions bought through the App Store / Google Play | Team identifier, purchase and renewal data | USA |
Independent controllers. Apple and Google process data on their own behalf when you download the app, pay for a subscription, use “Sign in with Apple / Google” or receive notifications on your device; their own privacy policies apply to that processing.
Authorities. We disclose data to public authorities only when the law requires us to.
Transfer of the service. If the BIBS service is assigned or sold to another person or business, data may pass to the new controller, who will be bound by this policy; we will tell you in advance.
7. Transfers outside the European Economic Area
The database is hosted in the EU. Some providers (Expo, RevenueCat and, depending on the choice, the email provider) are based in the USA, so some data may be transferred there. We make such transfers only with the safeguards of Chapter V GDPR: the adequacy decision for the EU-U.S. Data Privacy Framework, for certified providers, or the European Commission's Standard Contractual Clauses (Art. 46 GDPR) with supplementary measures (encryption in transit, data minimisation). You can ask us for a copy of the relevant safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and profile | While the account is active. When you delete your account, identifying data is removed immediately (see section 9). |
| Password reset links | Valid for 30 minutes; deleted automatically within one hour of expiry. |
| Email confirmation links | Valid for 48 hours; deleted automatically within one hour of expiry. |
| Email invitations | Valid for 14 days. Invitations concerning you are deleted when you delete your account. |
| Sign-in sessions (including IP and user agent) | Up to 60 days after the last refresh, then deleted automatically. |
| Push tokens | Until you sign out on the device, delete your account, or Apple/Google report the token as invalid. |
| Audit log | 2 years, then deleted automatically. When you delete your account, your name is removed from entries. |
| Server technical logs | At most 30 days. |
| Team match history | While the team exists. After account deletion the history is no longer linked to your account (see section 9). |
| Subscription data | While the team exists; accounting records as long as the law requires (usually 5 or 10 years under Romanian Accounting Law 82/1991). |
| Support correspondence | Up to 2 years after the last message, unless needed to establish or defend a legal claim. |
| Backups | Overwritten on a rolling basis; deleted data disappears from backups within at most 30 days. |
9. Deleting your account
You can delete your account in the app: More → Your profile → Account → Delete your account. You can also ask by email. Full details, including what is kept and why, are on the Account deletion page.
In short, on deletion: your name becomes “Former player”, your email is replaced with an unusable address, your password and Google/Apple links are removed, your picture and nicknames are deleted, you leave every team, your invitations and devices are deleted and you are signed out everywhere. An internal identifier with no identifying data remains so other players' history stays correct. Lists of games already played may still show the display name you had at the time.
Subscriptions: deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it in the store settings.
10. Your rights
Under Art. 15-22 GDPR you have the right to:
- access your data and get a copy;
- rectification - you can correct much of it directly in the app (name, nickname, picture, email);
- erasure (“right to be forgotten”);
- restriction of processing;
- data portability - receive the data you provided in a structured, commonly used format (e.g. JSON);
- object to processing based on legitimate interest;
- withdraw consent where processing is based on consent (e.g. notification permission, from your phone settings), without affecting earlier processing;
- not be subject to a decision based solely on automated processing (see section 15).
Write to privacy@getbibs.app from the address linked to your account. We reply free of charge within one month (extendable by two more months for complex requests, in which case we will tell you). We may ask for information to confirm your identity.
You also have the right to lodge a complaint with the Romanian supervisory authority, Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the authority of the country where you live or work.
11. Minimum age
BIBS is intended for people aged 16 or older. We do not knowingly create accounts for anyone under 16 and we do not collect parental consent. If you learn that a child under 16 has created an account, write to us and we will delete it. Admins must not add children under 16 as guest players.
12. Push notifications
The app asks for permission to send notifications; you can refuse or withdraw it at any time in your phone settings. You can also choose which notifications you receive per team (signups open, sides ready, match day, announcements). Notifications are sent through Expo to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) and contain short texts about team activity, such as the team name and kick-off time. We do not send advertising notifications.
13. Cookies and trackers
This website uses no cookies, trackers, pixels or analytics. The website's hosting provider may technically record IP addresses and browser details in its own logs for security.
The app uses no cookies, advertising identifiers or tracking SDKs and does not track you across other apps or websites. On your phone we store locally only what is strictly necessary: authentication tokens (in the system's secure storage - Keychain / Keystore) and preferences such as theme, language and the selected team.
14. Security
- All communication between the app and the server is encrypted (HTTPS/TLS).
- Passwords are stored only as bcrypt hashes; emailed tokens and refresh tokens are stored only as hashes.
- Access tokens are short-lived; reusing an old refresh token automatically ends the session.
- Data access is scoped by team and role; request rate limits protect against attacks.
- Image metadata (including GPS location) is stripped on upload.
- You can review and sign out signed-in devices from your Profile.
No system is perfectly secure. If a personal data breach poses a risk, we will notify ANSPDCP and, where the risk is high, you, in line with Art. 33-34 GDPR.
15. Automated decisions
The app automatically splits players into sides using skill ratings and can toss a coin automatically. These operations organise a friendly game, can be adjusted by admins and have no legal or similarly significant effect on you; we do not carry out profiling within the meaning of Art. 22 GDPR.
16. Changes
We may update this policy. The last-updated date is shown at the top. We will tell you about significant changes in the app or by email before they take effect.
17. Contact and complaints
Any question about your data: privacy@getbibs.app. General support: support@getbibs.app. Postal address: IORDAN ROBERT-ADRIAN PERSOANA FIZICA AUTORIZATA, Strada Baia de Arama, Nr. 1, Bl. B2, Corp B2, Etaj 5, Ap. 28, Sector 2, Bucuresti, Romania.