Privacy Policy

This Privacy Policy explains how Rebel Lion Labs ("we", "us", or "our") collects, uses, and protects your information when you use the PADLR mobile application ("App"). Rebel Lion Labs, Dublin, Ireland, is the controller of your personal data.

This Privacy Policy also covers the waitlist on our website, playpadlr.app.

1. Information We Collect

We collect the following categories of personal data:

Account information: Email address and display name (required for account creation), and your unique @handle
Date of birth: Collected at sign-up to verify that you meet our minimum age of 16. Your date of birth is kept in a private area of your account that only you can read (it is never visible to other users). You can correct it once in Edit profile; after that, or to change from an under-18 date to an adult one, contact us. We keep a record of each change (the old and new date and when) to protect the age check. Where you have enabled it, Apple may additionally share an age range (not a date) with the App as a secondary check; we store that range with your profile, and we never receive a date of birth from Apple. We also use your age to tell whether you are under 18, so that you are never shown personalised advertising.
Profile information: Profile photo (optional; if you sign in with Google, we copy your Google profile picture, which you can change), bio, court side, dominant hand, gender (optional), country, city, home club and other clubs, time zone, and approximate location (optional). Before a photo is shown, we re-encode it and remove its metadata, such as GPS position and camera details
Location data: If you grant location access, we use your device location to show nearby players, clubs and open games. Before we store any coordinate with your profile, we round it to two decimal places (about 1 km), so your precise position is never stored or published. We also use it to place you on a local leaderboard. The App reads your location only while you are using it. You can turn location access off at any time in your device's Settings > Privacy & Security > Location Services; you can still set your city and club yourself, and we then use the approximate centre of the city you choose.
Match data: Match results, scores, participants, venues, and match history logged by you, or logged by another player who named you in a match
Booking data: Scheduled matches you create or join, including time, venue, court price, skill range and the other participants; also the join requests you send or receive, and their outcome
Social data: Posts, comments, replies, reactions, follow relationships, and follow requests; also the accounts you block
Messages: The content of direct and group messages you send in the App, together with your display name and photo as shown to other participants
Reliability data: No-show reports, the answers of the players involved, the short note a reported player may add (the other players in the match see it), and the events (no-shows and late leaves) your reliability score is based on, which covers the last 90 days of your competitive matches, or your last 10 competitive matches if you played fewer than 10 in that time, going back up to 12 months. Players see the number of answers, not who answered which way
Dispute records: Match disputes you raise or that are raised against a match you played in, and their outcome
Moderation records: Reports you submit about other users' content, reports submitted about your content, any moderation action applied, and any appeal you lodge
Ratings and rankings: The playing level you choose at sign-up (your rating's starting point), your calculated skill rating, rating history, confidence value, badges, and leaderboard placement including the local region used to rank you
Device information: Push notification tokens (FCM) and an app-specific device identifier, used to deliver notifications to your devices
Subscription data: Whether you have PADLR Pro and its renewal status, received from Apple through RevenueCat. Other users can see a PRO badge on your profile. You can hide it with the Show PRO badge switch in Settings > Subscription.
Other App data: The city and level range of match alerts you save; your advertising consent choices and when you made them; your marketing email choice; the friends whose activity you mute; the notifications we show you in the App; and the names you type for guests who are not on PADLR. If you allow calendar access, the App adds booked matches to the calendar on your device; we cannot read your calendar.
Advertising data: Google AdMob gets data only from free accounts that reach the ad flow. That is your IP address, device and app details, and how you use ads. It gets your ad ID (IDFA) only if you allow tracking. If you decline, the ads you see are not personalised with that identifier.
Usage data: In-app interactions and feature usage for analytics and improvement
Contact information: When you sign up, and later from Settings, you can let PADLR look for friends in your contacts. The App reads only the email addresses and phone numbers in your contacts (not names), turns each into a one-way SHA-256 hash on your device, and sends only those hashes to our servers, where they are keyed with a secret before any comparison. We never see your raw contacts. If you turn on Let friends who have my email or number find me, we keep those keyed hashes of your contacts so we can tell you when one of them joins PADLR, and we keep a keyed hash of your verified sign-in email address and of the phone number you enter so that friends can find you the same way. The switch is off unless you turn it on. Turn it off in Settings > Privacy & safety > Privacy, and we delete all of these hashes. If you check your contacts while the switch is off, nothing is stored. We keep a count of how many contacts you checked, to limit misuse.
Security data: When you use some features, such as a password reset or creating a club, our servers read your IP address to stop abuse. We store only a keyed hash of it, and delete it when the limit window ends.
Performance data: We may measure how quickly screens and requests load, using Firebase Performance Monitoring. This data is not linked to your account.
Crash and error data: Firebase Crashlytics collects crash logs, stack traces, device model and OS version. It also records some errors that do not crash the App, such as a failed request to our servers or a purchase we could not confirm. These reports hold the operation and an error code, not the content you were sending. Each report also holds the screen and tab you were on, and the ID of the match, booking or conversation you had open. Reports are linked to your account ID. We use them to find and fix problems.
Waitlist: If you join the waitlist on playpadlr.app, your email address. We use it only to tell you when PADLR launches and about major updates. Every email tells you how to leave the list, and we delete the list within 90 days of launch.

2. How We Use Your Information

Calculate your padel skill rating using the Weng-Lin Bayesian algorithm
Show nearby players, clubs and open games, apply a game's skill range, and balance doubles teams by rating when a booked game fills
Create and manage match bookings and invitations
Rank players on global, country, local, club and friends leaderboards
Send push notifications about your matches and bookings, score confirmations, rating updates, match alerts and nearby games, messages, badges, follows, likes and comments, and moderation decisions
Operate direct and group messaging between players
Display your profile, ratings, and match history to other users
Detect and act on match manipulation, no-shows, and abusive content, and keep the community safe
Handle reports, moderation decisions, and appeals, and produce the moderation statistics we publish
Improve the App through usage analytics (Firebase Analytics), which uses a random app-instance identifier rather than your name or email address
Provide customer support
Comply with legal obligations

Push notifications are optional. You choose whether to allow them when the App asks, you can switch individual types on or off in the App under Settings > Account > Notifications, and you can turn them all off in your device's settings. Notifications can show a player's name and part of a message on your lock screen; you can hide previews in your device's notification settings.

If you are in the European Economic Area, we process your personal data on the following legal bases:

Contract performance: Account creation, match logging, rating calculation, bookings, messaging, and subscription management, necessary to provide the Service you signed up for; this includes sending you notifications about activity on your account
Legitimate interest: Analytics, crash reporting, fraud and manipulation detection, no-show handling, community safety, and service improvement, balanced against your rights with minimal data used; this includes showing non-personalised ads to free-tier users, and keeping moderation records to handle reports and appeals, to keep the service safe, and to defend legal claims
Consent: Personalised advertising (AdMob), optional location access, optional contact matching, and marketing communications (you can withdraw consent at any time); this includes storing and accessing information on your device for advertising
Legal obligation: Age verification, responding to lawful requests from authorities, and complying with tax and financial regulations; this includes alerting authorities to suspected threats to life or safety, as the law requires

4. Automated Decision-Making and Profiling

PADLR uses the Weng-Lin Bayesian rating algorithm (OpenSkill) to calculate your skill rating automatically based on match results. This constitutes automated profiling under GDPR Article 22. The system considers match outcomes, score margins, and opponent ratings to produce a skill estimate on a 0–7 scale.

Three further processes in the App operate automatically:

Match confirmation: A match that names other registered players stays pending until one of your opponents confirms it. In a friendly match, any other named player can confirm it. If nobody responds within 48 hours, the match is confirmed automatically. A friendly match you post that names no other registered player is confirmed immediately.
No-show handling: When a player is reported for not attending a competitive match, the reported player is told at once and can accept or contest the report. If players from both teams confirm it, it is confirmed 24 hours after the report, or sooner if the reported player accepts it. If the reported player contests it, a person on the PADLR team decides. A confirmed no-show voids the match (a booking is closed instead) and is recorded in the reliability score. A report nobody confirms within 72 hours lapses without effect. A late leave from a competitive match is counted automatically, but only if the match then does not go ahead full.
Content moderation: Content can be hidden automatically, a word filter refuses offensive words, and profile photos are checked automatically. Each is described below.

How automatic moderation works:

Automatic hiding: We hide content automatically, before any person reviews it, when enough separate established players report it, when a report is about child safety or threats, or when the word filter matches it. A hidden comment or reply is not shown to anyone else. A message is only removed after a person reviews the report. A hidden match post loses its caption, typed names, comments and reactions for everyone. The result itself stays in players' histories and ratings.
Review of automatic hiding: An automatic hide is provisional. If no person confirms it within 72 hours, we lift it. The exception is a report about child safety, threats or illegal content: that content stays hidden until a person decides. A person reviews reports and can confirm a hide, lift it or remove the content.
Word filter: When you enter a name, handle, bio, caption, comment, reply, guest name, venue name, no-show note, or a group or club name, the App checks it against lists of offensive words in the 14 languages of the App. If a word matches, the text is refused or hidden. Private chat messages are not filtered. The filter can make mistakes. To contest a refusal, email us at rebellionlabsofficial@gmail.com.
Profile photo check: Every new profile photo is checked automatically before it is shown. We send the photo to Google Cloud Vision SafeSearch, an image-classification service that Google runs as our processor. The check decides to approve the photo, reject it, or hold it for a person to check. If the photo is rejected or held, we tell you in the App, and you can appeal.
Who reported: We do not tell the person you reported who you are, unless that is strictly necessary to identify illegal content (see section 5).

You have the right to:

Request a human review of any rating, moderation, or reliability decision that materially affects you
Express your point of view regarding any such decision
Contest a decision by contacting us at rebellionlabsofficial@gmail.com; for moderation decisions, this is the appeal described in section 5

Our manipulation checks also run automatically on every competitive match. They look for the same players meeting unusually often in a short time, too many rated matches in a day, and head-to-head records that are too one-sided or too even to be real. A flagged match is held for review: it is not rated or shown in followers' feeds until a person clears it, and its players see it marked Held for review. You can ask us for a human review of any flagged match, and no account is restricted without a person reviewing it first.

Automated checks for safety. We also run automated checks on account activity. They keep players safe and the rating fair. A check queues an account for a person to review. The checks cover the kinds of conduct listed in section 19 of our Terms of Service, such as harassment, no-shows, rating manipulation and coming back on a new account after a ban. We do not publish thresholds.

These safety checks are a form of profiling. We do this under our legitimate interest in keeping the service safe and the rating fair. You have the right to object under GDPR Article 21: write to us at rebellionlabsofficial@gmail.com. No decision from these checks is made only by automated means. A person decides every warning, suspension and ban (GDPR Article 22). You can ask for a human review of any decision, and you can also appeal in the App.

5. Content Moderation and Your Rights Under the Digital Services Act

When content is reported or removed, we create and keep a record of the decision. This involves processing personal data about both the person who reported the content and the person who posted it. We keep it to handle reports and appeals, to keep the service safe, and to defend legal claims.

Notice and action (Article 16): Every match post, booking, comment, reply, chat message, chat and profile has a Report option. A report holds who reported, what was reported, the reason, an optional note, and a copy of the reported content as evidence. For "illegal content" the reporter must also explain why. They must confirm that the report is made in good faith. A report about child safety stores no copy of the text on the report. The reported item is hidden from the reporter straight away. Reporters see their reports under Settings > Privacy & safety > Your reports, and we tell them when a report is decided.
Reporter anonymity: We do not tell the person you reported who you are, unless that is strictly necessary to identify illegal content, as can happen with some intellectual property claims.
Statement of reasons (Article 17): Whenever we restrict content or an account, we record the rule applied, the reason, and whether the decision was automatic. We send the person a notice in the App, a push notification and an email, automatically. The notice says what was restricted, what that means and for how long, and why. The reason can be the number of reports and their categories, the word filter, the photo check, or a person's decision and the rule. It also says whether the decision was automatic, how to appeal, and until when. Notices stay under Settings > Privacy & safety > Moderation notices.
Log of decisions: Each moderation decision is written to a log that holds the case, what was done, the reason and when. We use the log to handle appeals and to defend legal claims.
Appeals: You can appeal a moderation decision about your content or account in the App, from the notice, or by emailing us at rebellionlabsofficial@gmail.com. An appeal is free. You can make one appeal for each decision, within six months of it. Appeals are decided by a person, never by an algorithm alone. We aim to decide every appeal within 14 days. We tell you the outcome and the reason. If your appeal succeeds, we restore the content where that is still possible. Our decision on an appeal is final inside PADLR, and you can still go to court. We offer this voluntarily: as a micro enterprise we are excluded from Articles 20 to 28 of the Digital Services Act by Article 19 of that Regulation.
Moderation statistics: We compile aggregate statistics about moderation activity each quarter and intend to publish them on our website. These contain no personal data and identify nobody.

If a report or other information points to a threat to someone's life or safety, or to content that appears to involve the sexual abuse or exploitation of a child, we escalate it and remove the content. We may keep records and share them, including account details, with law enforcement or judicial authorities, as the law requires.

We keep moderation records to handle reports and appeals and to defend legal claims. This can be longer than the retention of the content itself. See section 9.

If we suspend your account, you can still export your data and delete your account. If the suspension is permanent, you cannot sign in. To ask for a copy of your data or for deletion of your account, reply to the email we send you.

Misuse policy. Our policy is a warning first, then a 7-day suspension, then a permanent one. The most serious content, meaning threats and child sexual abuse material, can lead to a suspension at once. The same steps apply to people who often send plainly unfounded reports. Section 19 of our Terms of Service sets out the details.

6. Third-Party Services

We use the following third-party services to operate the App:

Firebase / Google (Google LLC, USA): Authentication, cloud database (Firestore), file storage, cloud functions, push notifications (FCM), analytics, performance monitoring, remote configuration, and App Check (which uses Apple App Attest to confirm requests come from the genuine App). Google Privacy Policy: policies.google.com/privacy
Google Sign-In (Google LLC, USA): If you sign in with your Google account, we receive your name, email address and profile picture from Google.
Firebase Crashlytics (Google LLC, USA): Crash and error reporting. Collects crash logs, stack traces, device model, OS version, error codes and the screen and item open at the time, linked to your account ID. Google processes this data under its Data Processing Addendum.
Google Cloud Vision SafeSearch (Google LLC, USA): Automatic check of profile photos (section 4). Google receives the photo and classifies it. Google acts as our processor under its Data Processing Addendum.
RevenueCat (RevenueCat, Inc., USA): Processes purchase records for in-app subscription management and purchase validation. RevenueCat Privacy Policy: revenuecat.com/privacy
Resend (Resend, Inc., USA): Transactional email delivery (account verification, password reset and change, data export links, deletion notices and confirmation, and moderation notices). Resend processes the recipient email address and message content under their Data Processing Agreement. Resend Privacy Policy: resend.com/legal/privacy-policy We also use Resend to send emails to people on our website waitlist and to store the waitlist. Resend also sends our own alerts about moderation.
Google AdMob (Google LLC, USA): In-app advertising shown to free accounts. Google Privacy Policy applies. You can opt out of personalised ads in your device settings. You can change your advertising choices at any time, as described in section 7.
Apple Inc.: Sign in with Apple, in-app purchases, push notification delivery, map and place search (MapKit) when you search for a city or venue, app attestation (App Attest), and, where you have enabled it, an optional age range signal used to corroborate our age check.
Netlify, Inc. (USA): Netlify hosts our website and processes waitlist sign-ups.

7. Advertising and Tracking

Free accounts see ads served by Google AdMob. PADLR Pro accounts see no ads and are not asked for ad consent.

We ask for your ad consent after you finish signing up. Where the law requires it, the App shows a consent message from Google. This applies in the EEA, the UK and Switzerland. It asks if Google and its ad partners may store and read information on your device to personalise ads. If you decline, you may see limited or non-personalised ads.

On iOS, the App asks adults for tracking permission before it turns on personalised ads. It asks only once consent allows ads. It uses Apple's App Tracking Transparency (ATT) prompt. If you decline, the ads you see are not personalised with that identifier.

Accounts we know to be under 18 get non-personalised, Teen-rated ads. So do accounts with no date of birth. The App does not ask them for tracking permission.

To change your ad choices, go to Settings > Privacy & safety > Privacy > Ad choices. It appears where Google's consent form applies.

You can change your tracking preference at any time in your device's Settings > Privacy & Security > Tracking.

We do not sell your personal data. We share data only:

With the third-party service providers listed above, who process data on our behalf
With other users of the App, as described below
When required by law or to protect our legal rights
With your consent for any other purpose

Your display name, @handle, profile photo, bio, city, home club, gender (if you add it), ratings, badges, PRO badge (which you can hide in Settings > Subscription), leaderboard placement, and match history are visible to other users of the App as part of the social features. Your date of birth, email address, precise location, and contact hashes are never visible to other users. If you turn on Private profile in Settings > Privacy & safety > Privacy, only followers you approve can see your matches, stats and activity, and you are left off public leaderboards. You can also block users in Settings > Privacy & safety > Blocked users, and stop friends finding you by email or number with Let friends who have my email or number find me in Settings > Privacy & safety > Privacy.

Because matches are shared records, another player can log a match that names you. Where a match names a registered player other than the person posting it, that match does not count towards anyone's rating or statistics until it is confirmed. You can remove yourself from a friendly match you did not agree to, and dispute a competitive one.

Open bookings you create can be seen by other users, including the venue, time, skill range and who has joined. When you send a join request, the organiser sees your name and photo, and can see your public profile, including your rating and, once you have played 10 competitive matches, your reliability score.

9. Data Retention and Account Deletion

We retain your data for as long as your account is active. You can request account deletion at any time with the Delete account button at the bottom of Settings in the App.

When you ask, you leave your upcoming games, we delete your pending follow requests and push notification registrations, and we email you the deletion date
Your account then enters a 30-day grace period. To keep your account, sign in before then and tap Cancel deletion
After 30 days, the deletion is carried out. If you signed in with Apple, we also revoke PADLR's access to your Apple account then

Deleting your account, or a suspension or ban, does not cancel a PADLR Pro subscription. Apple bills it, so cancel it in your Apple Account settings, or it keeps renewing. RevenueCat keeps the purchase records of your subscription under its own retention rules; ask us and we will ask RevenueCat to delete them.

What is deleted, and what is anonymised. Some content in PADLR is shared with other people: a match has other players in it, a conversation has other participants, a comment sits under someone else's post. Deleting that content outright would destroy other users' records. So:

Deleted outright: Your profile, email address, date of birth, photos, contact hashes, push tokens, private settings, follow relationships, and your reactions; your block list is deleted as well
Anonymised, not deleted: Matches you played in, comments and replies you wrote, and feed entries about you. Your name and photo are replaced with a "Deleted User" placeholder and can no longer be linked back to you.
Kept without your identity: Moderation records, including notices and appeal outcomes, as described below

Specific retention periods:

Account and profile data: Retained while your account is active, plus the 30-day deletion grace period
Match history and ratings: Retained while your account is active; anonymised on deletion as described above
Rating history: Every rating change, kept while your account is active and deleted when your account deletion is carried out
Cancelled or expired matches and bookings: Deleted after 7 days
No-show reports and reliability events: Removed after about 13 months
Moderation records: Reports, decisions, appeals and our log of decisions are kept for 3 years after a case closes, to handle appeals and defend legal claims. This is our current practice.
Copies of hidden text and report evidence: Kept for 190 days
Rejected profile photo: A photo rejected by the photo check is kept until the appeal window ends, so that an appeal can be decided
After you delete your account: Your identity is removed from moderation records. The notes on your reports and the text of your appeals are cleared, and a pending appeal is withdrawn. Copies of your hidden text and your kept photo are deleted. The records themselves stay, without your identity, until their period ends. So do counts and outcomes used as statistics, and our own reasons for decisions.
Legal hold: If a case is under legal hold, which we use for suspected child-abuse material, we keep its records, including the identity of the people involved and one copy of the content, until the hold is lifted.
Follow requests: Deleted if not answered within 30 days
Data export files: The download link expires after 24 hours, and the file is deleted after 7 days
Messages: A match's group chat is deleted, with its messages, once nobody has written in it for 30 days and the match was more than 30 days ago. Direct messages and other group chats are kept until every member has left or deleted their account. When you delete a message, it disappears for everyone, and we keep its text for 14 days in case it is reported. If you delete your account, the messages you sent are deleted
Notifications in the App: Kept for 30 days; moderation notices for 6 months
Your feed: Items older than 90 days are removed from your feed
Crash and error reports: Retained for 90 days by Firebase Crashlytics
Analytics data: Retained for 14 months by Firebase Analytics, then automatically deleted
Contact hashes: The hashes of your contacts and of your own email and number are deleted when you turn off Let friends who have my email or number find me, or when your account deletion is carried out
Push notification tokens: Deleted when you sign out, when a token stops working or has not been used for 60 days, when you ask to delete your account, or on account deletion

Data we keep to stop ban evasion. To stop banned people from returning, we keep a few keys. Each is a hash, which is a one-way code: it does not show the original data. The keys are:

A hash of your device's installation id
A hash of your verified contact details, kept only if you turned on contact matching
A hash of your Sign in with Apple account identifier

We keep each key for 12 months from its last use, and for as long as the account is restricted. If you delete your account while it is suspended or banned, or while it is under an open review case, we keep one device hash for 12 months. We do the same if your level fell a long way below where it started and our checks found signs you lost on purpose. This stops anyone registering again to avoid a decision.

Our legal basis is our legitimate interest in preventing abuse and fraud (GDPR Article 6(1)(f)). You can object: write to us at rebellionlabsofficial@gmail.com and we will weigh your reasons against ours.

If you are located in the European Economic Area, you have the right to:

Access: Request a copy of the personal data we hold about you
Rectification: Correct inaccurate personal data
Erasure: Request deletion of your personal data (see section 9)
Portability: Export your data as a ZIP file of JSON files with a summary you can read (Settings > Data > Export my data, once every 30 days); it includes the hashed contacts we keep for you. We also email you a download link, which works for 24 hours. The export is free for every user, whether or not you subscribe to PADLR Pro
Object: Object to processing of your data for direct marketing purposes
Restrict: Request restriction of processing in certain circumstances
Withdraw consent: Where we rely on your consent, withdraw it at any time without affecting processing already carried out

For a complete copy of all the personal data we hold about you, email us and we will send it free of charge within one month.

To exercise these rights, contact us at rebellionlabsofficial@gmail.com.

You also have the right to lodge a complaint with your local data protection supervisory authority (in Ireland, the Data Protection Commission) if you believe your rights have been violated.

11. Your Rights (California: CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

Right to know: Request the categories and specific pieces of personal information we have collected about you in the past 12 months
Right to delete: Request deletion of your personal information
Right to correct: Request correction of inaccurate personal information
Right to opt-out: We do not sell your personal information. We do not share personal information for cross-context behavioural advertising unless you have opted in via the ATT prompt.
Non-discrimination: We will not discriminate against you for exercising any of these rights

To exercise these rights, contact us at rebellionlabsofficial@gmail.com. We will verify your identity and respond within 45 days.

12. Children's Privacy

PADLR requires users to be at least 16 years of age and is not directed to children under 16. We verify age at sign-up. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has provided us with personal information, please contact us and we will delete it promptly.

If the date of birth you enter shows that you are under 16, you cannot complete sign-up, and we do not store the date you entered. For 24 hours we keep a keyed hash of your sign-in, so that sign-up cannot be retried at once. The sign-in record created when you started (your email address) is deleted automatically after 30 days, or sooner if you email us. If your date of birth is recorded incorrectly, you can correct it once in Edit profile, or contact us and we will correct it.

13. Data Storage Location and International Transfers

Your data is stored on Google Firebase servers located in the United States (the nam5 multi-region; primary region us-central). By using the App, you consent to the transfer and storage of your data in the United States.

For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following safeguards under GDPR Article 46 / UK GDPR / Swiss FADP:

EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension and Swiss-U.S. DPF: Google LLC is self-certified under the DPF, providing an adequacy mechanism for personal-data transfers from the EU/UK/Switzerland to the United States. See Google's certification on the official DPF list: dataprivacyframework.gov/list (search "Google LLC").
Standard Contractual Clauses (SCCs): Where the DPF does not apply, we rely on the European Commission's 2021 SCCs incorporated into Google's Data Processing Addendum and Resend's Data Processing Agreement.
Supplementary measures: All data in transit is TLS 1.2+ encrypted; data at rest is AES-256 encrypted by Google Cloud.

For more information, see Google's Data Processing Addendum and the EU-U.S. Data Privacy Framework.

14. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data is transmitted over HTTPS and stored securely in Google Firebase. Access to our backend is protected by server-side security rules and app attestation, and sensitive fields such as your date of birth are readable only by you.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or by email. The "Last updated" date at the top of this page reflects the most recent revision.

16. Contact

If you have any questions about this Privacy Policy, please contact us:

Rebel Lion Labs
Dublin, Ireland
Email: rebellionlabsofficial@gmail.com