Privacy Policy

Information You Provide: - Account: Name, email address, password - Profile: Photo, sports, skill level, bio - Communications: Messages sent via in-app chat - Match Data: Results, Elo ratings, competitive history - Support: Information provided when contacting us Information Collected Automatically: - Location: Precise GPS when using map features (only while app is active) - Usage Data: Features used, matches created, invitations sent - Device: Type, OS, device identifiers, app version - Push Tokens: Stored privately and never accessible to other users Third-Party Login: - Apple or Google Sign-In: We receive only your name and email

• Provide Services: Account management, sports map, match invitations, real-time chat, Elo rankings - Personalise: Show relevant nearby athletes based on sport and location - Security: Detect abuse, enforce Terms of Service - Improve: Analyse performance and fix issues - Communicate: Send match notifications and service updates - Legal Compliance: Meet applicable legal obligations We do not use your information for advertising. We do not sell your personal data to any third party.

With Other Users: Your public profile (username, sports, skill level, tier, approximate map location) is visible to other TRIBEX users. Chat messages are visible only to conversation participants. Push tokens, precise location, email, and private data are never visible to other users. With Service Providers: - Firebase (Google) — authentication, database, cloud functions - Cloudinary — profile photo storage - RevenueCat — subscription management - Expo — push notification delivery All providers are contractually bound to protect your data.

Location is central to the TRIBEX experience. We use it to display your approximate position on the sports map and help you discover nearby athletes. Privacy protections: - Your precise GPS coordinates are never stored directly — we apply a server-side geographic offset (~500m) before saving your position - Other users see only a general area, never your exact location - Location is accessed only while the app is active, never in background - You can revoke location access at any time in device settings

• All data is encrypted in transit using TLS 1.3 - All data is encrypted at rest in Firebase/Google Cloud - Push notification tokens are stored in private, access-controlled subcollections — never exposed to other users - Sensitive operations are processed server-side via authenticated Cloud Functions - Profile photo uploads use server-signed credentials — no unsigned uploads are accepted - Access to your data is controlled by strict Firestore security rules - Webhook endpoints use HMAC authentication

We retain your data as long as your account is active. When you delete your account, we permanently erase within 45 days: - Your user profile and all personal information - All chat conversations and messages - All match history and events - All in-app notifications - Your profile photo from our servers - Your Firebase authentication account Aggregated, anonymised data may be retained for analytical purposes.

All Users: - Access, Correction, Deletion, and Portability of your data - Delete your account via Settings → Manage Account → Delete Account EU / EEA / UK Users (GDPR): - Object to or restrict processing - Withdraw consent at any time - Lodge a complaint with your local data protection authority Legal bases: Contract, Consent, Legitimate Interests Brazilian Users (LGPD): Access, correction, deletion, portability, and consent revocation. California / US Users (CCPA): Right to know, delete, and opt out of sale (we do not sell your data). Contact: legal@playtribex.com

We send push notifications for match-related events. Your push token is stored in a private, encrypted subcollection accessible only to our servers — never to other users. You can disable notifications at any time in device settings.

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover such data, we will delete it immediately. Contact: legal@playtribex.com

TribeX is based in Portugal (EU). Data may be processed on servers in the EU and United States (Google Cloud, Cloudinary). International transfers are protected by Standard Contractual Clauses approved by the European Commission.

Our website uses cookies for session management and performance. Our mobile app does not use advertising cookies. You can control cookies through your browser settings.

We will notify you of material changes via the app or email. Continued use after the effective date constitutes acceptance.

TribeX, Lda. Email: legal@playtribex.com Website: https://playtribex.com