Privacy policy

Who we are

DealMeIn is operated by Atop AS (Norway), the data controller for personal data processed through the app and the console. You can reach the data controller at dealmein@atop.no.

What we collect

Account profile: email address (sign-in, transactional email and identification towards your clubs), display name, an optional profile photo (from your Google account if you share it, or one you upload), an optional bio, and settings such as language and theme.

Sign-in: handled by Firebase Authentication with a Google account or email and password. We never see or store your password.

Push notifications: one Expo push token per device so we can deliver notifications about tournaments, messages and news from your clubs, plus your notification preferences per club and category.

Club and tournament activity: which clubs you belong to, your role, an optional nickname, and your game history — sign-ups, buy-ins, rebuys, placements, points and prizes, along with league standings.

Club area: club owners can set an AREA for the club (a place name and the area's centre point — never a street address). If “Use my position” is used, the position is sent once to look up the area; only the area is stored. “Nearest me” sorting in Find clubs happens locally on your device — your position is never sent to us and never stored.

Subscription: if you have Premium, we store a reference to the customer and subscription record at Stripe. Card details exist only at Stripe — never with us.

Feedback: the content of feedback you send, attributed to your account so we can reply.

Diagnostics (optional): crash reports and anonymous usage analytics can be toggled under Privacy in the app. No game history or message content is included in analytics.

What we do not collect

We do not track your location — the app does not request location permission, and browser position is used only in the moment you ask for it. We do not collect contacts, photos, microphone audio or device identifiers beyond the push token. We never buy or sell personal data, and we do not serve ads.

Why we collect it

Run your account: sign-in, profile, club membership and tournament play. Deliver notifications: the push and email you turned on. Payments: manage the Premium subscription through Stripe. Improvement: optional crash and usage diagnostics. Compliance: respond to access, export and deletion requests, and keep an audit log of administrator actions.

Who we share it with

We share data only with the processors we depend on to run the service, and only on our instructions:

Supabase (database and file storage — EU, Stockholm) · Vercel (hosting of the console and API) · Google Firebase Authentication (sign-in; Google shares your email, name and profile photo when you sign in with Google) · Expo (push notification delivery) · Stripe (payment processing for Premium) · Brevo (email delivery) · OpenStreetMap Nominatim (club-area place searches are forwarded without your identity).

We never share data for advertising, profiling or any other purpose.

How long we keep it

Account data is kept while your account is active. Tournament and league history is kept while the club exists, so history stays accurate for the other members. The audit log of administrator actions is deleted after 365 days. Feedback is kept as long as we need it to reply to you.

Account deletion (anonymisation)

You delete the account yourself: Profile → Delete account → "Delete my account", in the console or in the app. Deletion happens immediately and signs you out. You do not need to ask us.

If you own a club, transfer ownership to another member first. Otherwise the club would be left with no owner.

On deletion your sign-in is detached from the account and the profile is anonymised rather than hard-deleted: email address, display name, profile photo, bio, push token and your notification and privacy settings are cleared, and the name is replaced with "Slettet bruker" (deleted user). The account is marked as anonymised. If you sign in again later, you start with a completely new, empty profile.

One thing remains: the name you played under is stored on the tournament results and league tables as of the night they were recorded, and those rows are left untouched. The club's history and points depend on them. If you want those names removed too, we do it manually within 30 days on explicit request — it leaves gaps in the club history, so we only do it when you ask.

Data export

You can export your own data at any time from the app: Settings → Export my data. The export is a JSON file with your profile, memberships, results and feedback.

Your rights

Under the GDPR and the Norwegian Personal Data Act you have the right to access (use the data export), rectification (edit your profile in the app), erasure (see above), restriction of processing, data portability (the JSON export), objection, and withdrawal of consent — for example by turning diagnostics off under Privacy.

If you believe we are mishandling your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet) — but we would rather you email us first at dealmein@atop.no so we get a chance to fix it.

Cookies

The console uses technical cookies only: your sign-in session and your language and theme choices. No advertising or tracking cookies, and no third-party analytics on the web pages.

Beta

DealMeIn is a public beta, provided as-is with no service-level agreement. Features may change, and we give reasonable notice before anything drastic happens to your data.

Changes to this policy

We may update this policy as the service evolves; the date at the top changes when we do. Material changes are announced in the app or console.

Contact

Questions about this policy or the data we hold about you: dealmein@atop.no. Postal address: Atop AS, Norway (available on request).