Privacy Policy - Biathlon Fantasy

1. Data controller and contact

Biathlon Fantasy is the data controller for the personal data described in this policy. If you have questions about this policy or your personal data, contact us at contact@fantasy-biathlon.com.

Biathlon Fantasy and Cross-Country Fantasy are made by the same creator and share one account system, so the same account can be used in both games.

2. Information we collect

We collect and store information necessary to operate the service, including:

Account and game data

Email address
Username (the team name shown to other players) and the country you choose for your team
Fantasy teams and game-related data, such as athlete picks, transfers, chips, points, badges and login streaks
League participation and rankings, including mini leagues, friends and head-to-head matches
Chat messages you send in mini leagues, reports you make about messages or team names, and players you block
If you buy a supporter badge in the iOS app: transaction ID, product, price, currency, App Store country, purchase date and refund status. Apple handles the payment and we do not receive your payment details.

Technical and security data

Sign-in method (email and password, Google or Apple) and when your account was created
Security checks from Firebase App Check, which confirm that requests come from a genuine version of the game
Error reports and diagnostic logs, linked to your account when you are signed in, with device or browser details. For failed sign-ins, only the domain of the email address is logged.
Push notification tokens, with device platform and language, if you allow notifications
Usage analytics, only if you consent (see Analytics)

On this website

Email address, if you join the launch waitlist
Your cookie consent choice and, if you accept statistics cookies, analytics data

3. Purposes and legal bases

We use personal data for the following purposes, based on the EU General Data Protection Regulation (GDPR):

Providing your account and the game. Running your account, teams, leagues, rankings, chat, friends and head-to-head matches, sending notifications you have turned on, and delivering supporter badges you buy. Legal basis: performance of a contract, because the data is needed to provide the game you signed up for (Article 6(1)(b)).
Security, abuse prevention and maintaining the service. Verifying requests with App Check, handling reports and blocks, limiting misuse, fixing errors, keeping backups and keeping the records described under Data retention. Legal basis: our legitimate interest in keeping the game secure, fair and working (Article 6(1)(f)).
Analytics. Understanding how the game and this website are used. Legal basis: your consent (Article 6(1)(a)).
Launch waitlist. Sending launch updates to the email address you signed up with. Legal basis: your consent (Article 6(1)(a)).

4. Analytics

We use Firebase Analytics in the game and Google Analytics on this website to understand how the service is used and to improve functionality. Analytics only runs if you consent. In the game you can change your choice at any time under Account, and on this website through the cookie settings.

We do not send your account ID, email address, team name, team contents, athlete picks or chat messages to analytics.

5. Authentication

We use Firebase Authentication to manage user accounts and sign-in functionality. You can sign in with email and password, or with your Google or Apple account. If you use Google or Apple, we receive the email address that provider shares with us. Passwords are handled by Firebase Authentication and are not stored in our database.

6. Cookies and local storage

The game uses local storage and similar technologies to keep you signed in, remember settings such as your language and analytics choice, and store game data on your device so it loads faster.

On this website we use a consent tool (Cookiebot) so that you can manage your cookie preferences, and analytics cookies are only set after you give consent.

You can change or withdraw your consent at any time using the cookie settings link. The list below is generated automatically and shows the cookies currently used on this website.

7. Chat and user-generated content

Messages sent through the in-app chat feature are not end-to-end encrypted and may be stored or processed for moderation, abuse prevention, and security purposes. Messages are shown to the members of the mini league together with your team name and team country.

If you report a message or a team name, we store the report with your account ID, your team name and a copy of the reported content so it can be reviewed.

8. Data retention

We retain account information and game-related personal data for as long as your account remains active.

When you delete your account, we delete your login, profile, teams, league memberships, friendships, unfinished head-to-head matches and notification tokens. Where your team still appears in leaderboards or cups, it is shown as "Deleted user". Some information is kept:

Chat messages you have sent stay in the league chat with the team name you used. Contact us if you want them removed.
Results of completed head-to-head matches, which include your team name at the time.
A record that your account ID has been deleted, without your email address or team name, so your team can be shown as "Deleted user".
Moderation reports, diagnostic logs and supporter purchase records, where needed for security, abuse prevention, refunds or dispute resolution.
Deleted data can remain in database backups for up to 30 days.

If you join the waitlist on this website, we keep your email address for launch updates until the waitlist is no longer needed or you ask us to remove it, whichever comes first.

9. Account deletion

You can delete your account at any time under Account in the app, or ask us to delete it by contacting us.

Because Biathlon Fantasy and Cross-Country Fantasy share one account system, deleting your account also deletes it in Cross-Country Fantasy. Deletion cannot be undone. What is kept after deletion is described under Data retention.

10. Third-party services

The service relies on these third-party providers:

Google: Firebase services for authentication, data storage, backend functionality, hosting, push notifications, security and analytics; Google services for sign-in and application security.
Apple: Sign in with Apple if you use it, App Attest and DeviceCheck for App Check on iOS, and payments for supporter badges in the iOS app.
Sentry: error reporting.
Cookiebot: cookie consent on this website.
Buy Me a Coffee: if you choose to support the game from the web version, you are sent to Buy Me a Coffee, which handles that payment.

These providers may also process information in accordance with their own privacy policies.

11. International data transfers

Game data is stored in Google Cloud Firestore in the EU, and our server functions run in the EU. Error reports are stored in Sentry's EU data region. Waitlist email addresses from this website are stored in the United States.

Some services, such as Firebase Authentication, Analytics and Cloud Messaging, and Apple's services, may process data outside the EU/EEA, including in the United States. In those cases the providers rely on safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

12. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected (rectification)
Have your data deleted (erasure)
Ask us to restrict processing of your data in certain situations
Receive your data in a portable format, where processing is based on consent or contract
Object to processing based on our legitimate interests
Withdraw your consent at any time where processing is based on consent, without affecting earlier processing
Lodge a complaint with a data protection authority, for example in the country where you live

To use your rights, contact us at contact@fantasy-biathlon.com. You can also delete your account in the app and change your analytics and cookie choices yourself at any time.