Operator

The data controller is Samuel Domin. Contact: samko.domin@gmail.com.

Scope of processed data

When logging in via Google OAuth 2.0 we process: email address, name and profile picture URL. This data is stored only in temporary PHP session on the server (not in database or files) and is removed upon logout or session timeout. For local login we process username and password hash (bcrypt). When using the application we process sports data about players from public rankings.

Purpose and legal basis for processing

We process data based on legitimate interest (Art. 6(1)(f) GDPR) – ensuring application functionality and access control. Email and name are used for user identification, profile picture for display in the interface.

Retention period

Google login data (email, name, picture) is stored exclusively in temporary PHP session on the server and is automatically removed upon logout or session expiration (maximum a few hours). Local user data (name, password hash) is stored in the users.json file on the server. Player data from public rankings is stored in a MariaDB database on a separate virtual server within Google Cloud Platform.

Recipients and processors

Email, name and profile picture URL are received from Google LLC as an identity provider. This data is not provided to any other third parties. The application runs on Google Cloud Run (us-central1 region). The MariaDB database runs on a separate virtual server within Google Cloud Platform.

Data subject rights

You have the right to access, rectification, erasure, restriction of processing and objection. You may exercise your rights by emailing samko.domin@gmail.com.