Privacy

Who we are

FantaFellas is run by Riccardo Bellatreccia, Via G. Bruno 18, 20025 Legnano (MI), Italy, who is the data controller for everything described here.

Write to [email protected] for anything about your data — a copy of it, a correction, a deletion, or a question about this page.

What we store

Your email address and password, held by our authentication provider. We never see your password, and your email address is never shown to anybody else in the app — not even to people in your groups, who only ever see your username, your display name and your avatar.

Your profile: username, display name, time zone, language, and the year you were born. We ask for the year and not the date, because a year is enough to know whether you are old enough and a date would be more of you than we need.

The fact that you accepted these documents: which version, and when. Nothing else about that moment.

What you do in a group: the group’s name and settings, the rules you write or vote on, the events you file, the notes you attach, your votes, your bids in an auction and the swaps you agree to. Also the requests to join a group, and the invitations sent — an invitation by email carries the address it was sent to.

Pictures: your avatar, a group’s cover image, and any photograph somebody attaches to an event as proof. Proof photographs are kept in private storage and are shown only to people in that group, through links that expire.

If you turn on notifications, what your browser needs in order to deliver them — an address for your device and the keys that go with it. You can turn them off from your browser at any moment.

If you report a problem to us: what you wrote, an optional screenshot, and technical details such as the app version and the page you were on. If you report a rule or an event inside a group, what you wrote and which item it was about.

If you write a review: the stars, the text, and the name you chose to appear under. This one is published on our public page — see below.

Ordinary technical records kept by our hosting providers, such as request logs. We do not run any analytics or advertising trackers, and there are no third-party cookies.

Why we store it

To run the game: without your account and your group’s content there is nothing to play. That is the performance of our agreement with you.

To keep the service working and secure — for example, to find and fix faults.

To be able to show that you agreed to these terms, and which version of them. That is a legal obligation rather than a choice.

Who else sees it

People in your groups see your username, display name, avatar and everything the game itself makes visible: the rules, the events, the standings.

Nobody outside your groups sees any of it. Group content is not public, not indexed by search engines, and never shared by us with anyone.

One exception, and it is a member’s doing rather than ours: at the end of a game anyone in the group can download a summary card as an image and post it wherever they like. The app tells them what is on it first, and a group can switch the version that names people off entirely.

A second exception, and this one only happens if you ask for it: a review you write is shown on our public page, under the name you picked when you wrote it, once we have approved it. Delete your account and the review goes with it.

Our suppliers process data on our behalf, on our instructions: Supabase for the database, the accounts and the files, on servers in the European Union; Vercel for running the site; and Brevo for sending email, which means Brevo sees the address we are writing to and what the message says.

Notifications sent to your phone or your desktop travel through whatever push service your browser uses — Google, Apple or Mozilla, depending on the browser you chose. We do not pick that supplier and we have no agreement with it; the contents are encrypted on the way.

Outside the European Union

The database, the accounts and the files are in the European Union, in Frankfurt. Brevo, which sends our email, is a French company.

Vercel, which runs the site, is a United States company, so serving a page to you involves a transfer outside the European Union. That transfer is covered by the data protection terms of our agreement with them, which include the standard contractual clauses adopted by the European Commission.

A note about fines

A fine handed to a real person is, in effect, something people say about them. We never email it out, never publish it and never let a search engine near it. Treat what you write with that in mind, and so will we.

The end-of-game card is the one thing built to leave the group, and a member can take it with them. The default version names nobody: fines appear as one number. The version that does name people asks for a confirmation first, and an admin can switch it off for the whole group if anybody would rather not appear.

Cookies

Two cookies, and neither is for us. One keeps you signed in. The other remembers which language you chose, so the app does not greet you in the wrong one. Both are strictly necessary for the service to work as you asked it to, so there is no banner asking you to accept them. There are no advertising or analytics cookies.

How long we keep it

A group that has finished stays readable for six months. After that the events, the notes, the votes and the bids are deleted, and what remains is the final standings and the end-of-game summary — those we keep. The exact date is shown inside the group, and we tell you when it is set and again a week before.

Photographs attached as proof go sooner: ninety days after the group finishes.

A screenshot attached to a problem you reported is deleted once the report is closed.

Your account and profile stay until you ask us to delete them.

When a member leaves or is removed, their row survives so that standings and history do not break, but it can be anonymised on request.

What you can ask for

A copy of your data, a correction, or its deletion. You can also object to how we use it and ask us to restrict it.

You do not have to ask us for the copy: every group has a "Take it with you" screen that exports what the app holds about you there — and the group’s own record — as JSON or as spreadsheet files. It is immediate and it needs nobody’s permission.

You can delete your account yourself, from Settings, without asking anybody. It removes your account and your personal data; what your groups need in order not to fall apart — a name on a past standing — can be anonymised instead.

If you would rather we did it, or you want a copy of your data, write to [email protected].

If you believe we have handled your data badly, you can complain to your national data protection authority.

Age

FantaFellas is for people aged 16 and over. Some groups are set up for adults only and ask you to confirm you are 18 or over before you join.