Privacy policy

This policy explains what personal data we process through this website and the Guiñote Full app (the “App”), why, and what you can do about it. It is written under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.

Versión en español. The Spanish version is the original; the rest of the website is available in Spanish only.

Data controller

Summary

• We ask for the minimum needed to play: email, nickname and, optionally, a photo.
• There are no in-app purchases. Oros are earned only by playing and cannot be bought.
• Shipping details (name, phone, address and email) are requested only if you win or redeem a physical prize, and are used only to ship it to you.
• Usage analytics is off by default. It only starts if you turn it on in Settings, and you can turn it off at any time.
• We do not track you across apps, we do not use the advertising identifier, we show no ads and we do not sell your data.
• You can delete your account yourself in the App, underSettings → Account → Delete account.

Data we process in the Guiñote Full app

Your account

• Data: email address, sign-in method (email and password or Sign in with Apple; Google sign-in is currently available on Android only), language and sign-up date. Your password is stored hashed by our authentication provider, Supabase; we never see it. If you sign in with Apple or Google, we receive your email (or Apple’s private relay address, if you choose it) and an identifier of your account from them.
• Purpose: to create and maintain your account, verify it with a code and help you recover access.
• Legal basis: performance of the contract you accept in theterms and conditions (in Spanish).
• Retention: for as long as your account exists.

Your player profile

Part of your profile is public to other players: your nickname, your profile photo if you upload one and your statistics (cups, wins, losses, forfeits and games played). They appear at the table, in the ranking and in tournaments. Your email address is never shown to other players.

• Profile photo: you choose it from your device’s gallery. The App only accesses the image you select, crops it and uploads it. Anyone with its address can view it.
• Automatic photo check: before saving it, we send the image (only the image, without your name, email or identifier) to OpenAI’s moderation API, which checks that it contains no sexual, violent or other prohibited content. OpenAI is based in the United States, so this check is an international transfer (see below). If the check cannot be completed, the photo is rejected and not uploaded.
• Purpose: to identify you to other players in the game and to prevent inappropriate images.
• Legal basis: performance of the contract and our legitimate interest in keeping a safe environment.
• Retention: for as long as your account exists. You can change your nickname and photo from your profile.

Games, Oros, tournaments and ranking

• Data: game history and results, movements of your Oros balance, milestones reached, tournament registrations (including your partner and any registration codes you redeem), ranking position and prizes won.
• Purpose: to provide the service, keep your balance, run tournaments and the ranking, and resolve incidents.
• Legal basis: performance of the contract.
• Retention: for as long as your account exists.

Table chat

Messages you write in a table’s chat are visible to the players seated at that table. The server keeps the last 50 messages of the table in memory only, so that someone who joins late sees the recent conversation, and discards them when the table closes. They are not stored in our database, except in this case: if a player reports another, the last 20 messages of the table are attached to the report so that we can review it.

Reports and blocks between players

• Data: the reports you make or receive (who, reason, an optional note of up to 200 characters and the latest table chat messages) and the players you block.
• Purpose: to review conduct that breaks the rules and to protect players from unwanted contact.
• Legal basis: our legitimate interest in providing a safe and fair game.
• Retention: while the accounts involved exist. Reports are deleted together with the account of either of the two players.

Fair play

• Data: abandoned or disconnected games, and the sanctions applied with their reason and duration.
• Purpose: to enforce the conduct rules and prevent abuse that spoils other players’ games.
• Legal basis: our legitimate interest in providing a fair game.
• Retention: for as long as your account exists.

Improving the automated players

• Data: the moves and table state of training-mode games against bots.
• Purpose: to improve the bots’ level of play.
• Legal basis: our legitimate interest in improving the game.
• Retention: 24 months.

Physical prizes and shop redemptions

If you win a physical prize (in a tournament or in the ranking) or redeem Oros for a shop product, we ask for the data needed to ship it to you. Physical prizes are for players aged 18 or over only (see “Minors”).

• Data: full name, phone number, postal address (street, number, postcode, city and province), email address and an optional delivery note. This data is not sent to the analytics or error-diagnostics tools.
• Purpose: to prepare and deliver the shipment, and to handle incidents or claims about it. It is shared with the courier that makes the delivery.
• Legal basis: performance of the contract and, for keeping it afterwards, compliance with legal obligations and our legitimate interest in handling claims.
• Retention: until 1 year after the order is delivered; after that they are deleted.
• If you delete your account: orders not yet shipped are cancelled and the product is returned to stock. Cancelled orders lose their shipping data. Orders already shipped or delivered are kept, with the address, but with no link to your account, because delivery and possible claims need them, and are likewise deleted 1 year after delivery.

Push notifications

• Data: your device’s push notification token (an identifier generated by Expo, not your phone number or advertising identifier).
• Purpose: to alert you only about tournaments you are registered in, such as a round opening, the deadline to join your match or a partner invitation. We send no advertising.
• Legal basis: your consent, given when you accept the system notification permission. You can withdraw it at any time in Settings in the App, or in the system settings.
• Processor: Expo (United States) forwards the alert to Apple or Google, which deliver it to your device.
• Retention: until you turn alerts off, sign out or delete your account. Tokens that Expo reports as expired are deleted.

Usage analytics (optional)

• Default: off. Nothing is sent until you turn it on inSettings → Privacy. You can turn it off at any time and sending stops immediately.
• Data, if you turn it on: usage events (completing sign-up, starting or finishing a game, opening tournaments or the shop, making a redemption) linked to your internal player identifier, a random code with no meaning outside our database. Wenever send your name, nickname, email or shipping details.
• Purpose: to understand which parts of the App are used and to improve it.
• Legal basis: your consent, which you can withdraw at any time.
• Processor: PostHog, on its European Union cloud (eu.i.posthog.com).
• Retention: until you turn analytics off or delete your account, or until the data ages out in PostHog.

Error diagnostics

• Data: technical crash and performance reports (where the app failed, its version and your device model and system), linked to your internal player identifier. Before sending, your email, nickname, passwords, session tokens and IP address are removed.
• Purpose: to detect and fix errors.
• Legal basis: our legitimate interest in providing a stable service.
• Processor: Sentry, in its European Union region (Germany).
• Retention: 90 days.

Account emails

• Data: your email address.
• Purpose: to send you sign-up and password-recovery codes and security notices about your account. We send no advertising.
• Legal basis: performance of the contract.
• Processor: Resend (United States), which sends the emails.
• Retention: the time needed to send the email.

What we do not do

• We do not track you across other companies’ apps or websites, we do not use the device advertising identifier and we show no advertising.
• We do not sell your data or share it for commercial purposes.
• We do not ask for your date of birth, location or contacts.
• There are no in-app purchases, so we process no payment data. Oros cannot be bought.

What is stored on your device

The App stores your encrypted session, with the key in the iOS keychain or Android’s secure storage, so it does not ask for your password every time. It also stores your settings (volume, language, vibration, analytics and alerts). The App does not use cookies.

Data we process on this website

App launch notice

If you leave your email in the app form, we use it only to tell you when Guiñote Full is available to download. We do not share it with anyone or use it to send you third-party advertising.

• Data: email address.
• Purpose: to tell you about the app launch.
• Legal basis: your consent, given when you submit the form.
• Retention: until the app launches or until you ask to be removed, whichever comes first.

Requests to host the tournament

If you run a venue and write to us to propose your bar as a host, we process the data you give us to assess the proposal and get in touch with you.

• Data: venue name, town, email, phone number and the content of the message.
• Purpose: to handle your request and reply to you.
• Legal basis: your consent and pre-contractual measures.
• Retention: while the relationship lasts and, afterwards, for the legal limitation periods.

In-person tournament data

Registration data for the in-person Gran Premio phases is collected through the tournament’s own platform, which has its own privacy policy. If you register that way, read the information given to you at that point.

Minors

The App is intended for people aged 14 or over, the age from which Spanish law allows a person to consent to the processing of their own data. We do not knowingly collect data from children under 14. If you are a parent or guardian and believe a child under that age has created an account, write to info@g4eventos.com and we will delete it.

Physical prizes and shop redemptions are for players aged 18 or over only. A player aged 14 to 17 can play and take part in tournaments, but cannot receive physical prizes. See the tournament, prize and order rules.

Recipients

We do not share your data with third parties except where required by law. The providers that give us technical services do have access to it; they act as processors under a signed contract and on our instructions:

• Supabase: database, authentication and storage of profile photos. Data hosted in the European Union (Ireland).
• Contabo: servers for the app and the games. European Union (Germany).
• OpenAI: automatic check of profile photos (the image only). United States.
• Sentry: error diagnostics. Data hosted in the European Union (Germany).
• PostHog: usage analytics, only if you turn it on. Data hosted in the European Union.
• Resend: sending of account emails. United States.
• Expo: sending of push notifications and distribution of app updates. United States.
• Vercel: hosting of this website. United States.

If you sign in with Apple or Google, those companies process your data as independent controllers under their own privacy policies. The same applies to Apple and Google when delivering push notifications to your device.

International transfers

Some of these providers (OpenAI, Resend, Expo and Vercel) are US companies or may access data from the United States. These transfers rely on the EU–US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission. You can ask us for information about these safeguards by writing toinfo@g4eventos.com.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@g4eventos.com, saying which one you want to exercise. You can also withdraw your consent at any time (for example, by turning off analytics or notifications in Settings), without affecting the lawfulness of earlier processing. We reply within one month.

If you think we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) atwww.aepd.es.

Deleting your account in the app

You can delete your account at any time from within the app, underSettings → Account → Delete account. When you do, we immediately delete your access, profile, photo, Oros, milestones, history, registrations, reports, blocks, notification tokens and sanctions. The results of games already played are kept with no link to you, and diagnostic reports are deleted when their retention period ends. Orders for physical prizes are handled as explained above.

If your account uses Sign in with Apple, deleting it also revokes the access token Apple gave us, so the App disappears from the list of apps linked to your Apple ID.

If you cannot access the app, write to info@g4eventos.com from the address you signed up with. We will handle the request within thirty days.

Security

We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or alteration. All communication between the app, the site and our servers is encrypted, and internal access to data is limited according to each person’s role.

Changes to this policy

If we change this policy we will publish the new version on this page and update the date above. If the change is significant, we will also tell you in the app.