Privacy

Confirmed players and organizers may exchange plain-text messages in a private event conversation. We process message content, author, event, time, blocks, and reports to provide coordination and protect members from misuse. Access is checked against current event membership. Conversations become read-only when an event ends or is cancelled and remain readable for authorized members for up to 90 days after the event.

After a completed event, the organizer may optionally record a thumbs-up or a structured reliability exception about a confirmed player. Negative feedback includes a bounded explanation, is visible privately to the affected player and authorized organizer workflows, and may be disputed. Feedback is not published as a public score. Processing supports event organization and member safety under Article 6(1)(b) and Article 6(1)(f) GDPR.

When you access Juvoa, our servers process technical connection data such as IP address, date and time, requested address, response status, referrer, and browser or device information. We use this data to deliver the service, maintain security, diagnose faults, and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable, and efficient operation of Juvoa. Technical logs are retained only for as long as required for these purposes and are then deleted unless a security incident or legal obligation requires longer retention.

To create and use an account, we process your identity-provider subject, email address, email-verification status, display name, authentication events, and security information. Authentication is provided by our self-hosted identity service on auth.juvoa.de. Passwords and recovery credentials are handled by that identity service and are not stored in the Juvoa application database.

Processing is necessary to create and secure your account and provide the requested service under Article 6(1)(b) GDPR. Security-related processing also relies on Article 6(1)(f) GDPR.

You may store a preferred language, a coarse location label, a geographic point, and a search radius. Juvoa uses these optional details to show nearby events. Your saved location is not shown in participant lists, invitations, or user search.

If you select “Use my current location”, your browser asks for permission and sends the resulting coordinates to Juvoa only for the requested nearby search or, if you explicitly save them, as your profile location. Juvoa does not request or track your location in the background. The legal basis is your consent under Article 6(1)(a) GDPR; you can withdraw it at any time by clearing the saved location and changing browser permissions.

When you type a city, area, or venue into place search, Juvoa sends the search text, selected language, country filter, and necessary technical request data from our server to Geoapify. Geoapify returns labels and coordinates. Your browser does not receive our Geoapify credential, and saved profile coordinates are not sent to Geoapify for this search.

We use Geoapify to provide requested place search under Article 6(1)(b) GDPR and, for optional discovery convenience, Article 6(1)(f) GDPR. Geoapify states that its service data is hosted in EU data centres. Its provider chain may nevertheless process technical data outside the EEA depending on the configured endpoint; where required, transfers are protected by an adequacy decision or standard contractual clauses under Articles 45 and 46 GDPR.

We process event and series details, sports, venues and facilities, organizer identity, times, capacity, prices, access settings, participation and waitlist status, invited users, and organizer or administrator actions. Other participants can see the event information and the display names and participation status needed for the event. Public events can be viewed by other Juvoa users; invite-only events are restricted to authorized users.

For external invitations we process the recipient email address, invitation role, expiry, and claim status. The invitation link contains a random one-time token; only its cryptographic hash is stored. Processing is necessary to provide event organization, participation, and invitation functions under Article 6(1)(b) GDPR.

Juvoa stores in-app notifications and sends transactional messages such as event changes, cancellations, waitlist promotions, invitations, verification, and account recovery. For email delivery, recipient address, subject, message content, delivery status, and technical error information are processed through the configured SMTP provider at mail-hh.de. We do not use this channel for advertising without a separate legal basis.

The legal basis is Article 6(1)(b) GDPR for requested service messages and Article 6(1)(f) GDPR for reliable delivery and security. Our legitimate interest is keeping users informed about their accounts and events and documenting delivery failures.

Juvoa uses only cookies required for login, session security, and your language choice. The language cookie is stored for up to one year. Authentication uses a session cookie for up to 30 days and short-lived security cookies during sign-in. They are protected with appropriate Secure, HttpOnly, and SameSite settings where applicable.

These cookies are necessary to provide the service you request within the meaning of section 25(2) no. 2 TDDDG. Juvoa currently uses no advertising or analytics cookies. If optional technologies are introduced later, this notice and any required consent mechanism will be updated before use.

Personal data may be disclosed only as necessary to:

• hosting, infrastructure, and backup providers that operate Juvoa on our behalf;
• mail-hh.de for transactional email delivery;
• Geoapify for place-search requests;
• other users where event organization and participation require it;
• public authorities where disclosure is required by law.

Processors are bound by data-protection agreements where required. We do not sell personal data.

We retain account and service data while your account is active and as long as it is needed to provide events, participation, invitations, and notifications. After deletion is requested or the purpose ends, data is deleted or anonymized unless contractual, tax, commercial, security, or other legal retention duties require continued storage. Security and administrative audit records may be retained for the limitation period needed to establish, exercise, or defend legal claims.

Encrypted backups follow a rolling schedule of seven daily, five weekly, and twelve monthly snapshots. Data deleted from live systems can therefore remain in protected backups until the corresponding snapshot expires; backups are used only for disaster recovery and are not restored to recover individual deleted records.

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability, and objection. Where processing is based on consent, you may withdraw that consent at any time for the future. Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You also have the right to lodge a complaint with a data-protection supervisory authority.

To exercise your rights, contact info@juvoa.de. The supervisory authority responsible for Hamburg is the Hamburg Commissioner for Data Protection and Freedom of Information.

An email address and the account information requested by the identity service are required to register and use account-based functions. Event details are required when you organize an event. Location information is optional; without it, nearby discovery is less personalized. Juvoa does not use solely automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

We update this notice when processing activities, providers, or legal requirements change. The current version and its update date are always available on this page.