Privacy Policy

1. Data We Collect

1.1 Data you provide

When you create an account via Google Sign-In, we automatically collect:

• Full name — displayed on your public profile;
• Email address — used for authentication and communications;
• Profile picture — displayed on your public profile and in groups.

You may also voluntarily provide additional information such as a sports nickname, preferred position, and availability for matches.

1.2 Automatically collected data

When you use the Platform, we automatically collect:

• Usage and navigation data — pages visited, features accessed, clicks and session duration;
• Device data — device type, operating system, app version, language and time zone;
• Technical identifiers — app installation identifier (not linked to personally identifiable data);
• Performance data — errors, crashes and load times for product improvement purposes.

We do not collect geolocation, phone contacts, camera, microphone or any other sensitive data without your explicit permission.

2. How We Use Data

We use the collected data for the following purposes:

• Authentication and security — verify user identity and protect accounts against unauthorized access;
• Platform features — create and display player profiles, manage groups and matches, process invitations;
• Communication — send notifications about groups, matches and important Platform updates;
• Product improvement — analyze how users interact with the Platform to identify issues and improve features;
• User support — respond to questions, complaints and data deletion requests;
• Legal compliance — comply with obligations under the LGPD, Marco Civil da Internet and other applicable laws.

We do not use your data for third-party targeted advertising, nor do we sell personal data to advertisers.

3. Third-Party Services

The Platform integrates third-party services for authentication, storage, analytics and distribution. Each service has its own privacy policy:

4. Public Profiles

Vai de fut allows players to have a public profile accessible via link (e.g. vaidefut.app/player/[id]). The public profile displays exclusively the following fields:

• Name (or nickname, if configured);
• Profile picture;
• Sports statistics (matches, goals, attendance);
• Preferred position.

Never publicly displayed: email address, phone number, location or any other sensitive data. All fields outside the above list are filtered on the server before any rendering.

You can request removal of your public profile at any time by emailing contato@vaidefut.app.

5. Subscription and Payment Data

If you purchase a Premium subscription or digital items (such as Soccer Coins), the transaction is processed exclusively by the respective app store (Apple App Store or Google Play Store). We use RevenueCat to manage subscription status and entitlements.

Data processed in connection with subscriptions includes:

• Subscription status (active, expired, cancelled);
• Product identifier and subscription tier;
• Purchase and expiration dates;
• Transaction identifiers (for verification with app stores);
• Entitlement status (which premium features you have access to).

We do not receive, collect or store your credit card numbers, billing address or other payment details. Payment processing is handled entirely by Apple or Google. RevenueCat receives anonymous subscriber identifiers from the stores and does not have access to your payment information.

Subscription data is retained for the duration of your account plus 90 days after account deletion, for audit and legal compliance purposes. After this period, all subscription-related data is deleted.

6. Data Sharing

We do not sell, rent or trade personal data. We share data only in the following situations:

• Service providers — with the third parties described in Section 3, strictly for the contracted purpose and subject to confidentiality obligations;
• Legal obligation — when required by law, court order, regulatory authority or to protect our legal rights;
• Explicit consent — when you expressly authorize sharing for a specific purpose.

In the event of a merger, acquisition or asset sale, your data may be transferred to the new owner, who will be required to respect this Policy or obtain new consent.

7. Data Retention and Deletion

We retain your data for as long as necessary to provide the service or comply with legal obligations. Retention periods are:

• Account data — while the account is active. After account deletion, we remove personally identifiable data within 30 days;
• Analytics data — retained for up to 14 months in aggregated and anonymized format;
• Security logs — retained for up to 6 months for fraud investigation and security incident purposes;
• Tax and contractual data — according to the minimum period required by Brazilian law.

8. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction. These measures include:

• TLS/HTTPS encryption in transit for all communications;
• Authentication delegated to OAuth 2.0 providers (Google), without password storage;
• Access control with the principle of least privilege for production data;
• Continuous monitoring of suspicious access attempts;
• Session tokens with automatic expiration.

In the event of a security incident affecting personal data, we will notify users and the Brazilian Data Protection Authority (ANPD) within the timeframes set forth by the LGPD.

9. Children's Privacy

The Platform is intended for users 13 years of age or older. We do not knowingly collect data from children under 13.

Users between 13 and 17 years of age must have authorization from a parent or legal guardian to use the Platform. If we become aware that we have collected data from a child under 13 without verifiable parental consent, we will take steps to remove that information immediately.

Parents or guardians who identify that data from children under 13 has been collected without consent should contact us at contato@vaidefut.app.

10. Your Rights (LGPD)

Under the Brazilian General Data Protection Law (Law No. 13,709/2018), you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you;
• Correction — request correction of incomplete, inaccurate or outdated data;
• Deletion — request deletion of personal data processed based on your consent (see Section 7);
• Portability — request transfer of your data to another service provider;
• Objection — object to data processing in certain circumstances;
• Withdrawal of consent — withdraw your consent at any time, without affecting the lawfulness of prior processing;
• Information about sharing — know which entities your data has been shared with.

To exercise any of these rights, send a request to contato@vaidefut.app clearly identifying the right you wish to exercise and the email associated with your account. We will respond within 15 business days.

You may also file a complaint with the Brazilian Data Protection Authority (ANPD) at gov.br/anpd.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in the product, third-party services or legal requirements.

When we make material changes, we will notify you through:

• A prominent notice in the app on your next session;
• Email notification to the address associated with your account;
• Updating the "Last updated" date at the top of this page.

Continued use of the Platform after the effective date of changes constitutes acceptance of the updated Policy. If you do not agree with the changes, you should close your account before the effective date.

12. Contact

For questions, requests or complaints about this Privacy Policy or the processing of your personal data, contact our Data Protection Officer (DPO):

We respond to privacy requests within 15 business days and account deletion requests within 30 business days, as required by the LGPD.