Privacy

Clemens Boehmer, reachable at hello@sosta.club. More details in the imprint.

Account: your e-mail address (for the sign-in code, and at most one reminder per step if your sign-up gets stuck, e.g. an expired link).

Profile: your PSN ID and, if you enter it, your home town and country.

Matches: score, match time, mode, clubs, stats, your corrections and the photos you take of the TV.

Opponents: your opponents' player IDs (gamertags) as shown on your photos, and your notes about them. Only your account sees this data.

Recognition: one log entry per photo (screen type, confidence, duration, model, token usage) to measure quality and cost.

Feedback: what you send via “Feedback & bugs”, with page, browser, app mode and optionally a screenshot.

Technical: server logs of our hosts (IP address, time, requested address), kept briefly for debugging and abuse prevention.

To provide the app: login, logging matches, showing analyses (Art. 6(1)(b) GDPR, contract).

We process opponents' IDs because the app cannot do its job without them (your record against an opponent). Our and your legitimate interest prevails, as the IDs are shown on screen anyway, are never displayed publicly and are not shared with other users (Art. 6(1)(f) GDPR).

Anonymous page statistics, to see which parts of the app are used (Art. 6(1)(f) GDPR).

Security, cost control and improving recognition (Art. 6(1)(f) GDPR).

Your home town counts towards the city and country tables only if you enter it yourself (Art. 6(1)(a) GDPR); you can remove it at any time.

Supabase (database, login, photo storage), region: EU (Frankfurt, eu-central-1).

Vercel (app hosting), region Frankfurt.

Vercel Web Analytics counts page views without cookies. According to Vercel, visits are told apart only by a short-lived hash that is discarded after 24 hours; page addresses are sent without parameters such as login or invite codes. We see totals (pages, countries, devices), not individual people.

Anthropic (USA) reads your photos to recognise score and opponent. According to Anthropic, API data is not used for training. The transfer to the USA relies on the EU-US Data Privacy Framework or standard contractual clauses.

Resend (sending login and info e-mails).

Data processing agreements under Art. 28 GDPR are in place with all providers. We don't sell data and use no advertising trackers.

Only technically necessary ones: login session, time zone (for the week streak) and an invite code if you arrive via an invite link. In the browser the app remembers small things like the camera mode or whether you've seen the photo guide. No advertising cookies.

As long as your account exists. If you delete a match, a photo or your account, the data is removed; backups at the host expire within a few days. Server logs are deleted automatically after a short time.

You have the right to access, rectification, erasure, restriction, data portability and objection. Export (JSON, CSV) and deleting all your data are one click away in your profile.

Questions and requests to hello@sosta.club. You can lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

SOSTA is in a closed beta. Features and this text may change; we announce significant changes in the app.