Privacy Policy
FantaAlpineSki
Last updated: 24 October 2026
FantaAlpineSki is a fantasy game about alpine ski racing. This policy explains which personal data is processed when you use the app, why, and what rights you have. It is written to actually be read: no needless boilerplate.
Who processes your data
The data controller is Livio Galleano, a private individual, as the developer of the app.
For any request about your data you can write to fantaskialpin@proton.me.
What data we collect
| Data | When | Where it is stored |
|---|---|---|
| Nickname, email address, password | When you sign up | Server |
| If you sign in with Google or Apple: your account's email address and your name, used only to suggest a nickname that you can change at any time. With Apple you can choose to hide your email: in that case we receive an address created by Apple that forwards messages to yours. We do not receive or store passwords, profile photos or any other data from your Google or Apple account | Only if you choose to sign up or sign in with Google or Apple | Server |
| Fantasy team name, names of the leagues you take part in, lineups, athlete purchases and sales, games of “Who am I?” | While you play | Server |
| Messages you write in the league chat | When you write in the chat | Server |
| Users you have blocked and messages you have reported in the chat | Only if you block a user or report a message | Server |
| Session token (keeps you signed in without re-entering your password) | When you sign in | Server and device |
| Notification identifier (push token), with the app language and the operating system | Only if you turn on notifications | Server and device |
| Local preferences: language, light/dark theme, last competition opened, messages already read | While you use the app | Only on your device |
Your password is not stored in plain text. It is transformed with the bcrypt algorithm into a value from which the original password cannot be recovered: not even the server administrator can read it.
What data we do NOT collect
The app does not ask for or collect any of the following:
- your location
- your contacts
- camera, microphone, photos
- payment data (the app is free and has no purchases)
- advertising identifiers, and there are no ads
- third-party analytics or tracking tools
You can check this yourself: the app does not request any sensitive permission from the operating system, on iOS or Android. The only permission you will ever be asked for is the one for notifications: your phone asks for it the first time you open the Home screen, and you can decline.
Why we process this data
- To let you play. Account, teams, leagues, lineups and chat are the service itself: without that data the app cannot work. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To protect your account. The session token, the hashed password and the email verification code prevent someone else from signing in as you or signing up with your address. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- To keep the chat safe. Reports are used to review and remove offensive content; blocks stop showing you messages from the users you have blocked. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Where it is stored
The data is stored on servers run by Railway, in the EU West (Amsterdam, Netherlands) region: it therefore stays within the European Union.
Who it is shared with
Your data is not sold, transferred or used for profiling. Only the following are involved:
| Party | What it receives |
|---|---|
| Railway — hosting and database provider | Stores the data on our behalf, in the EU |
| Open-Meteo — weather service | Receives the coordinates of the ski slope whose weather is shown. Not your location, which the app does not know |
| Apple (App Store and TestFlight) and Google (Google Play) | Crash reports and usage statistics, if you agree to share them with developers in your phone's settings, and any feedback you choose to send from the test version, under their respective privacy policies |
| Google or Apple, only if you sign in with their account | They ask you to choose the account and confirm, so they know you used it to sign in to FantaAlpineSki, under their respective privacy policies. They only pass us your email address and name |
| Google (Gmail), for the emails we send you | Your email address and the text of the email, which Gmail delivers on our behalf: the code to verify your address when you sign up (valid for 15 minutes) and, if you ask for it, the code to choose a new password (valid for 30 minutes). Neither contains your password |
| Proton (Proton Mail, Switzerland), only if you report a chat message | The report reaches the operator's mailbox by email: the text of the message, the league name, and the nickname, email address and identifier of both you and the author, so that it can be reviewed. Switzerland ensures a level of data protection recognised as adequate by the European Union |
| Expo, Apple (APNs) and Google (FCM), only if you turn on notifications | Your notification identifier and the text of the alert. A notification does not travel directly from our server to your phone: it goes through Expo's service, which delivers it to Apple or Google |
On a venue's page there is a button that opens Google Maps at the slope's coordinates. It only works if you tap it, and from then on Google's privacy policy applies.
Notifications
Notifications are optional. The first time you open the Home screen your phone asks whether you want to receive them: if you say no they stay off, and you can turn them on later from your Profile. They let you know when a race is about to start and you have not set your lineup yet, when a transfer window is about to close, and when a race's results are available.
When you turn them on, the app registers a push token on our server: an identifier of this installation, not of your phone and not of you. It comes with the language chosen in the app — so we can write to you in the right language — and the operating system.
You can turn them off at any time with the same switch in your Profile, or from your phone's settings. In both cases the identifier is removed from the server, not just ignored. It is also removed when you sign out, and it disappears with everything else if you delete your account.
How long we keep it
Account data is kept as long as the account exists. Game content (teams, lineups, messages) is kept as long as the leagues it belongs to exist: when a league is deleted, everything that belongs to it is deleted with it.
A block is kept as long as both accounts exist, or until you unblock the user. A report is kept as long as the reported message and your account exist; the email that brings it to the operator is deleted once the report has been closed.
Deleting your account
You can delete your account directly in the app, at any time and without writing to us: open your Profile, scroll to the bottom and tap Delete account. You will be asked to confirm, with a list of what is about to be deleted.
Deletion is immediate and permanent. The following are removed:
- your profile, with nickname and email address
- your fantasy teams and athlete rosters
- your memberships in all leagues, with the lineups you set
- the messages you wrote in league chats
- the leagues where you were the only participant
- the identifiers registered for notifications
- the users you had blocked and the reports you had made
One case requires an extra step. If you are the only admin of a league that still has other participants, the deletion is refused and the app tells you which leagues are involved: that league would be left without anyone able to manage it. Make someone else an admin, or delete the league, and then try again.
If you prefer, you can also request deletion by writing to the address above from the email address you signed up with.
Your rights
The EU General Data Protection Regulation (GDPR) gives you the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing. To exercise these rights, just write to the address above.
If you believe your data is not being handled correctly, you can contact the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or the supervisory authority of the EU country where you live.
Children
The app is not intended for children under 14 and does not knowingly collect their data. If you find out that a child under 14 has signed up, write to us and we will delete the account.
Changes to this policy
If anything changes in the way data is processed, this page will be updated and the date at the top will show it. Substantial changes will also be announced in the app.