Privacy Policy

1. Who is responsible for your data

The personal data controller is ИП FPFVFN, IIN 950113351472, address: Казахстан, Караганда, мкр Байкена Ашимова.

Questions about your data and requests to show, correct or delete it go to hello@oina.futbol.

2. What data we collect

Account. First name, last name and date of birth; from the date we show other people only your age. If you sign in with a phone number — the number. If you register with email — the email address and password. We never see the password itself: the sign-in service stores only its hash, from which the password cannot be recovered.

Player profile — all optional. City, positions on the pitch, preferred foot, height, weight, your own ratings of your speed, endurance and accuracy, a short bio, a photo or a ready-made picture instead of one.

If you organise matches — optional. Phone, WhatsApp and Telegram for contact, and a phone number for paying the match fee.

How you use the service. Matches you have created and joined, your team in a match, and marks of whether you showed up. Pitch bookings: which pitch, the date, time and price.

Who you would play with again. After a match you can mark players you would like to play with again. We store whom you marked and after which match, and when we told you that one of them had joined a match again.

Guests. When you sign up a friend without an account for a match, you enter their name. That person has not registered with us, so only add people who agree to it. A guest can ask us to delete their name — section 9 explains how.

Sign-in codes. When we send a code to WhatsApp, we record the number it was sent to and whether it was delivered. We do not store the code itself anywhere. To stop anyone from flooding someone else's phone with codes, for one day we keep which account requested a code for which number, and a hash of the IP address instead of the address itself. We do not save the messages you send to our WhatsApp number.

Notifications. If you have turned on push notifications, we store your browser's subscription address and the keys used to encrypt notifications.

Match alerts for a city. If you tapped “Notify me about matches”, we store the browser's subscription address, the encryption keys, the chosen city, the language and the time of the last notification. The subscription is not linked to your account, even if you are signed in: we only know that some browser is waiting for matches in that city.

City from the IP address. When you first open the site, we determine your city from your IP address to show nearby matches right away. We do not save the IP address for this; the site's hosting provider keeps request logs under its own rules.

Usage statistics. We count which pages are opened and which actions are taken, to understand what works and what does not. We use the PostHog service for this. We do not record the screen, do not collect clicks automatically and do not send it your name, email or phone: the service knows a signed-in person only by an internal account number. Like any website, PostHog receives technical details of the request, including the IP address: it is used to determine the city, and the address itself is not stored.

Error reports. If something breaks on the site, a report goes to the same PostHog: what the error was, on which page and where in the code. The contents of forms and requests are not included, and if an email or phone number appears in the error text, we cut it out before sending.

3. Why we collect it

• so that you can sign in and use your account;
• to put together match line-ups and show who is coming;
• so that the organiser and participants can contact each other;
• to send sign-in codes and match notifications — including that a player you wanted to play with again has joined a match;
• to understand what works in the service, and to find and fix what breaks.

We do not sell data and do not show ads.

4. Who can see your data

• Everyone, including people without an account: your first name, last name and photo — in match line-ups and on the pages of matches you organise.
• Signed-in participants of the same match: your player profile — positions, preferred foot, height, weight, skill ratings — and how many matches you have attended. Your city and age are not shown to them.
• Signed-in users on the pages of your matches: your organiser contacts and payment number, if you have provided them.
• Only you: your email, sign-in phone number, date of birth and whom you marked as someone you would play with again. The marked player is not told.

Oina administrators have access to the whole database — they need it to keep the service running and to carry out your requests to correct or delete data.

5. Who we share data with

Some of the work is done by third-party services. They process data on our behalf and only for that work:

• Supabase — stores the database and files and handles account sign-in;
• Vercel — hosts the website;
• Meta (WhatsApp) — delivers sign-in codes and receives the number the code is sent to;
• PostHog — counts usage statistics and collects error reports; its servers are in the European Union;
• Resend — delivers emails with codes for confirming your email and resetting your password; receives the email address and the message text;
• Cloudflare — during registration and sign-in checks that the form is filled in by a person, not a program; receives technical details of the browser and the IP address;
• your browser's push notification service — Google, Apple, Mozilla or Microsoft, depending on the browser — delivers notifications if you have turned them on or subscribed to match alerts for a city.

These services are located outside Kazakhstan, so data is transferred abroad.

6. Cookies and browser storage

• session cookie — to keep you signed in;
• city cookie — to show matches in the chosen city;
• cookie and browser storage of the statistics service — an anonymous identifier PostHog uses to tell one visit from another;
• browser storage — the chosen colour theme.

There are no advertising cookies.

7. How long we keep data

For as long as you have an account. When you delete it, your account and profile data are erased immediately — section 9 explains exactly how. The log of code requests is kept for one day and then erases itself. A city match alert subscription is kept until you unsubscribe; if the browser stops accepting notifications, we erase it ourselves. If the law requires us to keep something longer, we keep it exactly as long as the law requires.

8. Your rights

• to find out what data about you we keep;
• to correct it — almost everything can be changed in your profile;
• to withdraw consent and delete your account;
• to turn off notifications — in your profile settings;
• to unsubscribe from city match alerts — with the “Unsubscribe” button on the home page or by blocking notifications in your browser.

For anything else, write to hello@oina.futbol.

9. How to delete your account and data

You can delete your account yourself on the “Delete account” page (it will ask you to sign in if you are not signed in). Deletion is immediate and permanent:

• your profile and player card, photo, email and phone number, your places in match line-ups and the guests you brought, your notifications, notification subscriptions and the log of sent sign-in codes are erased;
• past matches you organised remain — other people played in them, and their attendance is counted from them. Instead of your name they say “the organiser deleted their account”;
• while you have upcoming matches you organise, you cannot delete your account: first cancel them — participants will be notified — or hold them;
• usage statistics are kept under an internal account number; after deletion that number is not linked to anyone;
• the city match alert subscription is not linked to your account — you can unsubscribe from it on the home page.

If you cannot sign in, write to hello@oina.futbol from the email address the account is registered to, with the subject “Account deletion” — we will delete it manually within 30 days and reply once it is done. If the account was created with a phone number, sign in with it: the code will arrive in WhatsApp, and you can delete the account yourself. If you no longer have access to the number, write to the same address which number it was — we will work out how to confirm the account is yours.

If you were added to a match as a guest, write your name and which match it was — we will remove your name from the line-up.

10. Age

The service is intended for people aged 16and over. If you are younger, register only with your parents' consent.

11. Changes

If the policy changes, we will update the version date at the top of the page. We will announce significant changes on the site.