Privacy Policy

Information You Provide: - Account: Name, email address, password - Profile: Photo, sports, skill level, bio - Communications: Messages sent via in-app chat - Match Data: Results, Elo ratings, competitive history - Support: Information provided when contacting us Information Collected Automatically: - Location: Precise GPS when using map features (only while app is active) - Usage Data: Features used, matches created, invitations sent - Device: Type, OS, device identifiers, app version - Push Tokens: Stored privately and never accessible to other users Third-Party Login: - Apple or Google Sign-In: We receive only your name and email Groups and Tribes: - Group name, description, sport, city, and privacy setting - Group image (stored via Cloudinary) - Member roles and tier assignments within groups - Match schedules, venue names and addresses, and participant confirmations - Group chat messages - Team draw results and history - Join requests and invitations sent or received - Invite codes generated for groups - Reports submitted about groups, messages, or members

• Provide Services: Account management, sports map, match invitations, real-time chat, Elo rankings - Personalise: Show relevant nearby athletes based on sport and location - Security: Detect abuse, enforce Terms of Service - Improve: Analyse performance and fix issues - Communicate: Send match notifications and service updates - Legal Compliance: Meet applicable legal obligations We do not use your information for advertising. We do not sell your personal data to any third party. Groups: - To create and manage groups and their members - To facilitate fair team balancing via the Elo tier system - To send notifications about group activity (invitations, matches, draws, role changes) - To process and review content reports - To display nearby public groups based on location

With Other Users: Your public profile (username, sports, skill level, tier, approximate map location) is visible to other TRIBEX users. Chat messages are visible only to conversation participants. Push tokens, precise location, email, and private data are never visible to other users. With Service Providers: - Firebase (Google) — authentication, database, cloud functions - Cloudinary — profile photo storage - RevenueCat — subscription management - Expo — push notification delivery All providers are contractually bound to protect your data. Groups: - Public group information (name, sport, city, member count) is visible to all authenticated users - Private group member lists are visible only to group members - Group chat messages are visible only to group members - Venue information (field name and address) is visible to all confirmed match participants

Location is central to the TRIBEX experience. We use it to display your approximate position on the sports map and help you discover nearby athletes. Privacy protections: - Your precise GPS coordinates are never stored directly — we apply a server-side geographic offset (~500m) before saving your position - Other users see only a general area, never your exact location - Location is accessed only while the app is active, never in background - You can revoke location access at any time in device settings Groups additionally use location to set the group's geographic position for discovery by other users. City names are stored as provided by the user via OpenStreetMap/Nominatim search. Group coordinates are used only for proximity-based discovery.

• All data is encrypted in transit using TLS 1.3 - All data is encrypted at rest in Firebase/Google Cloud - Push notification tokens are stored in private, access-controlled subcollections — never exposed to other users - Sensitive operations are processed server-side via authenticated Cloud Functions - Profile photo uploads use server-signed credentials — no unsigned uploads are accepted - Access to your data is controlled by strict Firestore security rules - Webhook endpoints use HMAC authentication

We retain your data as long as your account is active. When you delete your account, we permanently erase within 45 days: - Your user profile and all personal information - All chat conversations and messages - All match history and events - All in-app notifications - Your profile photo from our servers - Your Firebase authentication account Aggregated, anonymised data may be retained for analytical purposes. Groups: - Group data is retained while the group exists - When a group is deleted by the Owner, all associated data (messages, matches, member records) is permanently deleted within 24 hours - Reports are retained for 90 days for moderation purposes

All Users: - Access, Correction, Deletion, and Portability of your data - Delete your account via Settings → Manage Account → Delete Account EU / EEA / UK Users (GDPR): - Object to or restrict processing - Withdraw consent at any time - Lodge a complaint with your local data protection authority Legal bases: Contract, Consent, Legitimate Interests Brazilian Users (LGPD): Access, correction, deletion, portability, and consent revocation. California / US Users (CCPA): Right to know, delete, and opt out of sale (we do not sell your data). Contact: legal@playtribex.com Groups: - You may leave any group at any time - Group owners may delete their group and all associated data at any time - Deleting your account will remove you from all groups automatically

We send push notifications for match-related events. Your push token is stored in a private, encrypted subcollection accessible only to our servers — never to other users. You can disable notifications at any time in device settings. Group notifications you may receive: - Group invitations - New match scheduled - Match confirmation reminders - Team draw results - Role changes within a group - Join request status updates - Member joined/left notifications (for owners and admins)

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover such data, we will delete it immediately. Contact: legal@playtribex.com

TribeX is based in Portugal (EU). Data may be processed on servers in the EU and United States (Google Cloud, Cloudinary). International transfers are protected by Standard Contractual Clauses approved by the European Commission.

Our website uses cookies for session management and performance. Our mobile app does not use advertising cookies. You can control cookies through your browser settings.

We will notify you of material changes via the app or email. Continued use after the effective date constitutes acceptance.

TribeX, Lda. Email: legal@playtribex.com Website: https://playtribex.com