Rank MP
1. Data controller
The controller of your personal data in connection with the Rank MP mobile application (the “App”) and the website rankmp.app is:
- Owner
- David Ruiz Martínez
- Tax ID (NIF)
- 49533819F
- Address
- C. Turell n.1
- Contact email
- support@rankmp.app
- Website
- https://rankmp.app
This policy has been drafted in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services (LSSI-CE).
2. Data we collect
| Category | Data |
|---|---|
| Account | Email address, password (stored as a hash; we never have access to it in plain text) and email confirmation status. If you use Sign in with Apple, Apple gives us a user identifier and the email you choose to share (it may be a private Apple relay address) and, the first time, your name if you choose to share it. |
| Profile | First and last name, nickname (optional), age (we store the approximate year of birth derived from it), favourite sports and your experience level in each, dominant hand (optional), profile photo or avatar (optional) and App language (Spanish, English or Catalan). |
| Profile quiz | If you choose to answer it, your answers to questions about how you play (for example, your favourite shot or how you experience matches) and whether you want them shown on your profile. |
| Sports activity | Groups you belong to and their photo, members of those groups, matches you record or take part in (including live matches and their score while they are being played), results, confirmations and disputes, ELO ranking and its history, statistics, seasons, tournaments, weekly and monthly awards, and the profile frames linked to those awards. |
| Comments and reactions | What you write after a match (including the “press conference” with the Rank MP mascot), the mood you choose and the emoji reactions you leave on your group’s matches. |
| Moderation | Comment reports you send or receive (who reports, which comment and the reason) and the list of users you have blocked. |
| Notifications | Your device’s notification token (Expo/Apple) and a technical delivery log for each alert (sent, error), so we know whether they reach you. |
| Invitations | Your groups’ invite links and codes and, if you are an admin, pending join requests. |
| Communications | The messages you send us at support@rankmp.app and their content. |
| Technical data | Technical data needed to operate and secure the service (for example, IP address, device type, operating system and server error logs), processed by our providers. |
Rank MP does not access your location, contacts, microphone or camera, and does not collect health data. It only accesses your photo library when you choose a photo for your profile or a group, and only the photo you select.
Mandatory data
To create and use a Rank MP account you must provide:
- Email (or Sign in with Apple)
- First and last name
- Age
- At least one favourite sport and your experience level in it
Nickname, profile photo, dominant hand and the quiz are optional. Without the mandatory data you cannot complete registration or use the App.
Visibility of your data
Your profile information and sports activity are not public to anyone on the Internet. They are only visible to the other members of the groups you belong to. Within a group, its members can see:
- Your first and last name, nickname, age, photo or avatar, dominant hand, favourite sports and experience level.
- Your quiz answers, only if you have chosen to show them (you can change this at any time from your profile).
- Your ELO ranking and its history, your statistics, the matches and results you take part in, and live matches while they are being played.
- The comments, moods and reactions you post on matches.
- The group’s awards and profile frames, both the positive ones (for example, “most wins”) and the humorous ones (for example, “most losses” or “biggest ELO drop”), which are calculated automatically from the results.
Please note: before joining a group, bear in mind that this information will be visible to its members. Anyone with a group’s invite link can join it directly; with the code, an admin approves the request.
3. How we collect data
- Directly from you: when you create your account, complete your profile and the quiz, create or join groups, record matches and write comments or reactions.
- From Apple: if you use Sign in with Apple, the data described in section 2.
- Generated by using the App: the ELO ranking, statistics, awards and frames, and season and tournament standings are calculated from the recorded results.
- From other users: when another member of your group records a match (or starts it live) in which you are a participant, or adds you to a tournament.
- Automatically: the notification token, your device language (to choose the App’s initial language) and the minimum technical data generated by using the App and the services that support it.
4. What we use data for
- Creating and managing your account, and verifying your identity when you sign in (including email confirmation).
- Providing the service: groups, invitations, recording and confirming matches, live matches, ELO ranking, statistics, awards, seasons, tournaments, comments and reactions.
- Showing your profile and sports activity to the other members of your groups.
- Showing you the App, notifications and emails in the language you choose.
- Sending you transactional emails: account confirmation, password recovery and communications about your account.
- Sending you push notifications about your activity (for example, a match you need to confirm, a live match in your group, a comment on your match, new members or the week’s awards), if you have granted permission on your device.
- Handling your support requests and rights requests.
- Protecting the App against abuse, fraud and security incidents, and keeping it stable and reliable.
- Complying with the legal obligations that apply to us.
The ELO ranking, awards and frames are calculated automatically and are based solely on recorded results. They do not produce legal effects concerning you or similarly significantly affect you, so they are not automated decisions within the meaning of Article 22 GDPR. We do not use your data to build advertising profiles.
5. Legal basis for processing
| Purpose | Legal basis |
|---|---|
| Account, authentication and provision of the service | Performance of a contract: Art. 6(1)(b) GDPR (the App’s terms of use). |
| Mandatory profile data (email, first and last name, age, sports and experience) | Performance of a contract: Art. 6(1)(b) GDPR, as they are necessary to create your account and provide the service. |
| Optional data (nickname, photo, dominant hand, quiz and its visibility) | Consent: Art. 6(1)(a) GDPR. You can change or delete them at any time from your profile. |
| Comments, reactions and live matches | Performance of a contract: Art. 6(1)(b) GDPR, as features you choose to use within your group. |
| Transactional emails | Performance of a contract: Art. 6(1)(b) GDPR. |
| Push notifications | Consent: Art. 6(1)(a) GDPR, which you give by accepting the operating system permission and can withdraw at any time in your device settings. |
| Security, abuse prevention and service improvement | Legitimate interest: Art. 6(1)(f) GDPR, in keeping the App secure and working. |
| Handling requests and exercising rights | Art. 6(1)(b) and 6(1)(f) GDPR, and Art. 6(1)(c) when we must meet a legal obligation. |
| Compliance with legal obligations | Legal obligation: Art. 6(1)(c) GDPR. |
6. Data shared with external providers
To provide the service we use providers acting as processors (Art. 28 GDPR): they only process your data on our instructions and under a data processing agreement.
| Provider | Role | Data processed |
|---|---|---|
| Supabase | Authentication, database, photo storage and server functions | Account, profile, quiz, photos, sports activity, comments and reactions. |
| Expo (650 Industries, Inc.) | Sending push notifications | Device notification token and the text of each alert. |
| Resend | Sending transactional emails | Email address and content of the message sent. |
| Netlify | Hosting of the rankmp.app website | Technical data about your visit (for example, IP address) in its server logs. |
Your data may also reach:
- Other members of your groups, who see the profile and sports activity information described in section 2.
- Apple, which handles Sign in with Apple if you use it, delivers push notifications to your iPhone (APNs) and, through the App Store, processes your download data as an independent controller.
- Public authorities or bodies, when a legal obligation requires it.
We do not sell your personal data or share it with advertisers.
7. Supabase
We use Supabase for authentication —sign-up, sign-in and email confirmation through Supabase Auth—, account management and storing in its database your profile, quiz, groups, matches (including live matches), results, ELO ranking, statistics, awards, seasons, tournaments, comments and reactions. It also stores your profile photo and group photos in its private storage, and runs the server functions that send notifications and delete accounts.
- Project region
- West EU (Ireland), eu-west-1
- More information
- Supabase privacy policy
8. Push notifications (Expo and Apple)
We send push notifications through Expo’s notification service, which delivers them to your iPhone via Apple’s service (APNs). We notify you, for example, when you have a match to confirm, when a live match in your group starts or ends, when someone comments on your match, when someone new joins the group or when the week’s awards are out. Each alert is written in the language you have chosen in the App. They are only sent if you accept the notification permission on your device.
- Data
- Device notification token, the content of the alert and the technical delivery result.
- How to turn them off
- In your device’s notification settings, or from Settings → Notifications in the App. When you sign out, your device stops receiving that account’s alerts.
- More information
- Expo privacy policy · Apple privacy policy
9. Resend
We use Resend to send transactional emails: account confirmation, password recovery and communications about your account, in the language you choose. We do not use them for advertising.
- Sender
- no-reply@rankmp.app
- Data
- Your email address and the content of the message sent, together with technical delivery data.
- Support
- support@rankmp.app
- More information
- Resend privacy policy
10. Analytics and advertising
Rank MP currently does not use any analytics or tracking tools (such as Google Analytics, Firebase Analytics, Mixpanel, PostHog or Sentry) and does not track you across third-party apps or websites.
Rank MP may add advertising in the future. There is currently no specific advertising provider in place. If one is added, the advertising services may involve data processing under their own privacy policies and the app’s settings, and this policy will be updated to reflect it before they are switched on.
11. Data retention
- While your account is active, we keep the data needed to provide the service.
- Content reports: we keep them while they are reviewed and, afterwards, for as long as needed to handle repeat offences or complaints.
- After you delete your account, we delete or anonymise your personal data without undue delay and, in any case, within one month of your request, except as set out below.
- Legal obligations: we may keep blocked, and available only to the competent authorities, data that the law requires us to retain for the applicable limitation periods.
- Support: we keep your communications with us while your request is being handled and, afterwards, for the legal limitation periods for possible liabilities.
- Backups: data may temporarily persist in our providers’ backups until they are overwritten.
12. Security
We apply reasonable technical and organisational measures to protect your data: encrypted communications over HTTPS/TLS, hashed passwords, access control to systems and choosing providers that offer adequate security guarantees.
No system is completely invulnerable. If a security breach occurs that poses a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency within 72 hours and, where the risk is high, we will also notify you.
13. Your rights under the GDPR
- Access: find out whether we process your data and get a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on legitimate interest.
- Withdraw your consent, without affecting the lawfulness of prior processing.
To exercise them, write to support@rankmp.app from the email linked to your account. We may ask for additional information to verify your identity. We will reply within one month, extendable by two further months if the request is complex, and exercising your rights is free of charge.
If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
14. Account deletion
You can delete your account and personal data directly from the App:
Profile→Settings→Account→Delete account
You can also request it by email at support@rankmp.app.
When you delete your account: your profile and personal information are deleted (including your photo, your quiz answers, your comments and reactions, and your notification tokens), you stop receiving notifications and emails, you lose your ELO ranking and personal statistics, and your group memberships are removed. If you signed in with Apple, we also revoke Rank MP’s access to your Apple ID. The matches and results you took part in may be kept in anonymised form —not linked to your identity— to keep the history of group rankings and statistics consistent. In other words: your personal data is deleted; aggregated sports data may be kept, but it can no longer identify you.
Deleting the App from your device does not delete your account or your data. See also the section Account deletion.
15. Children’s privacy
Rank MP may be used by people aged 12 or over; the App does not allow registration with a lower age.
Where, under applicable law (Art. 8 GDPR and Art. 7 LOPDGDD), processing a minor’s data requires authorisation from their parent or legal guardian, that authorisation must be obtained before the account is created. Rank MP does not currently have a specific mechanism to verify that authorisation beyond the user’s own statement when signing up.
If you are a parent or guardian and believe a minor in your care has signed up without the required authorisation, write to us at support@rankmp.app and we will arrange for the account to be deleted.
16. Cookies and similar technologies
The mobile App does not use traditional cookies. To work, it does use strictly necessary technologies, such as local device storage to keep you signed in, remember your chosen language and active group, and the identifiers needed for push notifications. These technologies are exempt from consent under Art. 22.2 LSSI-CE.
This information page does not use cookies, analytics tools or resources loaded from third-party servers. If any Rank MP web service ever needs non-essential cookies, we will ask for your consent first and update this policy.
17. International data transfers
Data stored in Supabase is hosted in the European Union (Ireland, eu-west-1). However, Supabase, Expo, Resend and Netlify are providers based in the United States, so their processing may involve access or transfers outside the European Economic Area.
When this happens, we make sure adequate safeguards are in place under Chapter V GDPR: standard contractual clauses approved by the European Commission and, where the provider participates, the EU-U.S. Data Privacy Framework. You can ask us for information about these safeguards at support@rankmp.app.
18. Changes to the policy and contact
We may update this policy to reflect changes in the App, providers or the law. The “Last updated” date at the top of the page shows the current version. If the change is significant, we will let you know in the App or by email before it applies.
- support@rankmp.app
- Website
- https://rankmp.app
- Supervisory authority
- Spanish Data Protection Agency (AEPD), www.aepd.es