Privacy Policy

Effective date: October 14, 2026

Last updated: October 22, 2026

Welcome to Squadin ("we", "us", or "our"). This Policy explains in plain language what personal data we collect when you use the Squadin website, the web app and the iOS and Android apps ("Services"), why we collect it, who we share it with, how long we keep it, and what you can do about it. The Services cover pickup games and events, challenges, competitions, teams, communities, venue bookings, chat, the SKOIN wallet, player cards and the Fanzone.

1. Who we are and our role

Squadin SHPK (NUIS M52020015H, Rruga Pjetër Budi, Nd. 70, H. 1, Ap. 28, 1003 Tiranë, Albania) is the data controller for the processing described in this Policy. Contact details are in section 23.

Event organizers, sports venues, organizations and community admins who use Squadin to run their own activities decide themselves why they need your data (for example to run a league or confirm a booking). For that use they act as independent controllers and you should ask them about their own practices. POK Payments, our card payment provider, is an independent controller for card data.

2. What data we collect

• Account: mobile phone number (verified by SMS code), password, name, nickname and username.
• Linked sign-in methods (optional): if you link Apple, Google or Facebook, your account ID with that provider and, if it shares one, your email address; if you add a passkey, its public key (the private key never leaves your device). We use them only to sign you in and to show you which account is linked, and we never receive your password for those services.
• Profile: profile photo, short bio, gender and year of birth (optional), home area, time zone, the sports you play with your level, current form and preferred positions, and the language you use the app in.
• Activity you create or join: events, bookings, teams and team membership, organizations, competitions and registrations, communities, posts and comments, Fanzone predictions, and a referee profile if you create one (bio, federation ID, languages, base fee, sports, areas and venues you cover).
• Chat: messages, photos, videos, voice notes, documents, polls and votes, reactions, pinned and starred messages, a location you choose to send, and a contact card (name and phone number) you choose to share.
• Wallet: SKOIN purchases, balance, transactions, SKOIN you send to or receive from other users with the note you attach, and for organizations and venues: withdrawal requests with the business name, tax number (NIPT), the invoice PDF and any notes.
• Support and contact: what you write to our support chat in the app, and the first name, last name, phone number and message you send through the contact form on the website.

• Match data: lineups, goals and other match events, results, statistics and performance trends recorded by organizers, referees or team admins.
• Ratings and votes: ratings teammates give you after a match, MVP and award votes, referee ratings, and the ratings and votes you give to others.
• Attendance: whether you checked in, played, were a substitute or did not show up, as reported by the organizer.
• Gamification: XP, medals, streaks, daily check-ins and your Fanzone points.
• Social: friends, friend requests, follows, bookmarks, blocked users, and your membership in chats, teams and communities.
• Presence: whether you are online and when you were last active (section 5).

• Device and technical data: IP address, device model and operating system, app version, browser type, push notification token, time zone, and server logs of the requests your device makes.
• Approximate location: only when you allow it, to detect your area (section 5).
• Diagnostics: crashes, errors and performance data from the app and our servers (section 12).
• In-app interactions: which notifications and in-app alerts were delivered, opened or dismissed, so we do not show you the same thing twice.

• An organizer may add you to an event, a team or a competition, pay your entry for you, or record your attendance.
• Another user may share your contact card in a chat or invite you to Squadin using your phone number.
• POK Payments sends us the outcome of a payment and a card token (never the card number).
• Public sports data providers supply fixtures, scores and club crests for the Fanzone; this is not personal data.

3. Why we use your data

• To run the Services: create and secure your account, show events and games near you, manage teams, competitions, communities, bookings, chat and the wallet.
• Stats, cards and rankings: turn match data, ratings and votes into player statistics, leaderboards, highlights, awards and shareable player cards.
• Payments and tax: take payments, keep a transaction ledger, issue fiscal invoices and process refunds and withdrawals.
• Communication: SMS verification codes, push notifications, in-app alerts and email about your activity, matches, payments and support requests.
• Support: answer your questions in the support chat, including with the AI assistant (section 9).
• Safety and abuse prevention: rate limits, sign-up protection, fraud checks, blocking and bans.
• Improvement and diagnostics: find and fix bugs, measure performance, understand which features are used.
• Legal obligations: fiscal and accounting records, responses to lawful requests from authorities.

4. Chat

Squadin has direct chats, group chats, team, event, community and competition chats, and a support chat with us. Chats are not end-to-end encrypted: messages travel through our servers and are stored there so they can be delivered and synced to your devices.

• What is stored: the message text, type and time, who sent it, reactions, read and delivery state, poll options and votes, pins and stars, and the location or contact card you chose to send.
• Media: photos, videos, voice notes and documents are uploaded to object storage on DigitalOcean Spaces and served through time-limited links.
• Retention on the server: media files are kept for up to 30 days after upload and messages for up to 90 days. After that they can no longer be downloaded or restored to a new device. Your own devices keep the copies they have already downloaded until you delete the chat, clear it, or remove the app.
• Deleting: you can delete a message for yourself or, for messages you sent, for everyone. You can clear or delete a chat on your device. Deleting for everyone removes the message for the other members but a member who already saw it may remember it.
• Group links: admins can create an invite link for a group or community chat. Anyone with the link can see the group name and photo and ask to join. Admins can reset the link at any time.
• Previews: push notifications for new messages can contain the sender's name and a preview of the message. You can switch previews or notifications off in the app and on your phone.
• Typing and presence: "typing..." indicators, delivery receipts and online status are sent in real time through Google Firebase (section 13).
• Support chat: what you write in the Squadin support chat is read by our support staff, and, when the assistant is enabled, by the AI assistant (section 9).

5. Location, area and online status

Approximate location. When you first open the app we may ask for your location to suggest your area (city or region). We read a single, low-accuracy position, match it to one of our areas and save only the chosen area, not the coordinates. You can refuse and pick your area by hand, and you can change it in your profile. The area you choose is used to show you events, games, venues and communities nearby.

Precise location in chat. If you choose to send your location in a chat, the app reads your current position with your permission and sends it as a message to the people in that chat. Nothing is tracked in the background.

Online status. While the app is open it tells our servers every 60 seconds that you are active. You are shown as "online" to other users when your last signal is less than 5 minutes old, and friends can see a list of who is online. When the app is closed you appear offline.

6. What is public and what other users can see

Squadin is a social sports app. Some information is visible without a Squadin account:

• Player cards: when you or a teammate shares a card (for example Man of the Match, Team of the Week or a competition card), anyone with the link can open a page that shows the name, photo, team and statistics on the card, and the card image can be saved and reposted elsewhere.
• Games and competitions: a shared game page shows the teams, lineups with player names and photos, the score and the match events. Competition pages show fixtures, standings, scorers and awards.
• Leaderboards: rankings of players by rating and statistics, with name, photo and team.
• Events and communities: a shared event page shows its title, description, date and place, unless the event is private, in which case only "private event" is shown. A community share page shows its name, photo and description.
• Referees: a referee profile that you have published is listed publicly with your name, photo, bio, sports, areas, venues, base fee, rating and verification badge.
• Blog: blog posts and their authors.

Your player profile (name, nickname, photo, bio, area, sports, level, statistics, awards, teams, match history, followers and following) is visible to every signed-in Squadin user who has not been blocked by you. Members of the same event, team, chat or community also see your name and photo in participant lists. Your phone number is never shown on your profile, but people who already have your number may find you through it when they invite you.

How to limit this: use a nickname instead of your full name, do not upload a photo, make your events private, do not share cards or links, keep your referee profile in draft or paused, and block users you do not want to interact with. Share links can be reset by the person who created them.

7. Ratings, votes, awards and rankings

After a match, players rate their teammates, vote for the opponents' MVP and other awards, and may rate the referee. We combine these with the match statistics entered by organizers to calculate your rating, performance trend, highlights, awards, leaderboard position and the numbers on your player cards. This means other users' opinions influence how you are presented in the app. To keep it fair, rankings only count players with a minimum number of matches, you cannot vote for yourself, and awards are decided by votes or by match statistics, not by us. Individual ratings are only shown as aggregates. If you believe a result or statistic is wrong, contact the organizer of the match or us.

8. Gamification and Fanzone

You earn XP, medals and streaks for things you do in the app (playing, checking in daily, sending SKOIN) and appear on an XP leaderboard. In the Fanzone you can predict the results of real-world matches. Predictions earn points only: no money or SKOIN is staked or paid out, and the Fanzone is not a betting product. We keep your predictions, points and favorite team to run the rankings and send you reminders you can turn off.

9. AI support assistant

Our support chat may be answered by an AI assistant built on Claude, a model provided by Anthropic. When the assistant is enabled for your account, each time you send a message in the support chat we send to Anthropic: the last 30 messages of that chat, your first name, your home area, the sports you play, your app language and your device time zone. To answer, the assistant can also look up, in your name, your upcoming events, matches, bookings, teams, communities, your SKOIN balance and your latest transactions, as well as public information such as events, games, competitions, standings, venues and free slots. It never sees your phone number, password or card details, and it cannot change anything in your account.

Anthropic processes this data only to generate the reply and, under its API terms, does not use it to train its models. The assistant hands the conversation to a human when it cannot help, and a human reply pauses the assistant. Answers are rate-limited per day. The assistant is switched on gradually for groups of users and can be switched off at any time; a human from Squadin can always be reached through the same chat.

10. Payments, SKOIN, invoices and withdrawals

Card payments are processed by POK Payments. We never see or store your full card number or CVV. POK returns a payment token; if you choose to save a card we store the token, card brand, last four digits, expiry month and year and cardholder name so you can recognise the card and pay again. You can delete saved cards at any time.

SKOIN is the in-app credit used to pay for events, bookings and services. We keep a full ledger of your purchases, payments, refunds, holds, bonuses, cashback, the SKOIN you send to or receive from other users (including the optional note), and payments made for you by an organizer.

Fiscal invoices. Albanian law requires a fiscal invoice for every SKOIN purchase. We issue it through devPOS, a licensed fiscalization provider that reports the invoice to the Albanian tax authority. The invoice contains the product name and amount and, as a note, your name as it appears in your profile.

Withdrawals. Organizations and venues can request a payout of their wallet balance. We collect the business name, tax number (NIPT), an invoice in PDF form and optional notes, and keep them with the payout records for as long as accounting law requires.

11. Notifications and messages from us

• SMS: verification codes when you sign up, log in on a new device or change your number, sent through Routee or SMS.to.
• Push notifications: delivered through Google Firebase Cloud Messaging and Apple's push service for events, matches, chat, wallet, awards, Fanzone and support. Manage them in the app settings or your phone settings.
• In-app alerts and email: operational messages about your account and activity.
• Marketing: we only send promotional messages with your consent, and every one lets you opt out.

12. Monitoring, diagnostics and security logs

To keep the Services working we collect technical data:

• Datadog (EU region): performance and error monitoring of our servers and, in production builds, of the app. The app sends page views, taps, loading times, failed requests and JavaScript errors together with your user ID and name so we can see what went wrong. A share of sessions may be recorded as a visual replay; everything you type is masked in replays. Today one in five sessions (20%) is sampled for replay.
• Bugsnag: error reports from our servers.
• Cloudflare: sits in front of our servers to protect them and may show a Turnstile check when you sign up to tell people from bots. Cloudflare sees your IP address.
• Abuse protection: we log IP addresses and phone numbers used at sign-up and login, limit how often codes can be requested, cap sign-ups per address and per day, and may refuse sign-ups from some country dial codes. These logs are used only for security and are kept for up to 30 days.

13. Who we share data with

We do not sell personal data. We share it only with:

• Other users, as described in sections 4, 6 and 7.
• Organizers, venues, organizations and community admins: the data they need to run the activity you joined (name, photo, contact through the app, payment status, attendance, results).
• Processors working for us, bound by contracts: DigitalOcean (servers and file storage, European data centres in Frankfurt, Germany), Cloudflare (network security, Turnstile), Google Firebase (real-time features, push notifications), Apple (push notifications on iOS), Datadog EU (monitoring), Bugsnag (error reports), Routee and SMS.to (SMS), our email delivery provider (email), POK Payments (card payments), devPOS (fiscal invoices), Anthropic (AI support assistant).
• Authorities: the Albanian tax authority receives fiscal invoices; we answer lawful requests from courts and public bodies.
• A buyer or successor if Squadin is sold or merged; you would be informed.

14. Legal bases

• Contract: everything needed to provide the account, events, chat, wallet and support you asked for.
• Legal obligation: fiscal invoices, accounting records, responses to authorities.
• Legitimate interest: security and abuse prevention, diagnostics and monitoring, rankings and cards that make the sports experience work, showing your public activity to other players.
• Consent: location access, contacts access, camera and microphone, push notifications, saving a card, marketing messages and publishing a referee profile. You can withdraw consent at any time in the app or your phone settings.

15. How long we keep data

• Account and profile: while your account exists, then as described in section 16.
• Chat: messages up to 90 days and media up to 30 days on our servers (section 4).
• Match data, ratings, awards, statistics: while the game, competition and your account exist, because they are part of other players' records too.
• Wallet ledger, invoices, withdrawals: 10 years, as required by Albanian tax and accounting law.
• Server, security and monitoring logs: up to 30 days.
• Support chats: the same as other chats: messages up to 90 days and media up to 30 days (section 4).
• Saved cards: until you delete them or the card expires.

16. Your rights and controls

You can access, correct, delete and export your data, object to or restrict processing, and withdraw consent. You also have the right to complain to the Albanian Commissioner for the Right to Information and Protection of Personal Data.

• In the app: edit your profile and sports, change your area, manage notifications, delete saved cards, remove linked sign-in methods (they are deleted from our records at once), block users, leave or delete chats, and delete your account from the account settings (step by step).
• What account deletion does: your profile is deactivated and hidden immediately, all sessions are logged out, linked sign-in methods and push notification registrations are deleted, your chat media is deleted from storage, teams where you were the only admin are archived, and venues or organizations where you were the only admin are closed. Match results, ratings and statistics stay in the records of the games you played. Financial records are kept as section 15 requires. Remaining personal data is erased or anonymised once the retention periods in section 15 end.
• By request: write to us (section 23) for a copy of your data or anything you cannot do in the app. We answer within the legal deadline.

17. Moderation and support access

You can block a user; a blocked user cannot see your profile or contact you. Community admins can ban members from their community. Our staff can suspend or close accounts that break the Terms. There is no in-app report button yet: to report a user or content, write to us through the support chat or the contacts below.

To resolve a support issue, an authorised Squadin staff member may open your account in a support view that shows the app as you see it. Such access is limited to authorised support staff, is used only to solve your problem, and the chat copy created on the staff member's device during that session is deleted when they exit.

18. Children's privacy

Services have no minimum age requirement. However, if you are under 18 years of age, your parent or legal guardian is responsible for your use of the Platform and must supervise your activities. We do not knowingly collect data from children without parental awareness. Parents and guardians should supervise minors' use of the Platform and are responsible for their actions. If you believe we have collected data from a child without proper parental supervision, please contact us and we will take appropriate action.

19. International transfers

Our servers and file storage are in the European Union. Some providers listed in section 13 (Google, Apple, Cloudflare, Anthropic, Bugsnag) may process data in the United States or elsewhere. Where that happens we rely on their standard contractual clauses and equivalent safeguards.

20. Security

Passwords are stored hashed, connections are encrypted, access to production systems is restricted and logged, uploads are served through time-limited links and the database is backed up to storage in the EU. No system is perfectly secure; if we learn of a breach affecting you we will inform you and the authorities as the law requires.

21. Cookies and local storage

This website (squadin.com) is a static site. It uses no advertising, analytics or tracking cookies. It sets one cookie, i18n_redirected, to remember whether you prefer English or Albanian, and stores your light or dark theme choice in your browser's local storage. The contact form sends what you type to our server, which forwards it to our mailbox by email.

The app (web, iOS and Android) keeps your login session, settings, a local copy of your chats and cached content on your device so it opens instantly and works offline. In production the web app also sets a session cookie from Datadog (_dd_s) for the monitoring described in section 12; it is not used for advertising. You can clear all of this by logging out, clearing the site data in your browser, or uninstalling the app.

22. Changes to this Policy

We may update this Policy as the product changes. The new version is published here with a new date and a summary of what changed. For significant changes we also tell you in the app.

23. How to contact us

Questions, requests or complaints about this Policy:

• In the app: the Squadin support chat.
• Email: alban [at] squadin [dot] com
• Phone: +355 69 421 6008
• Supervisory authority: Commissioner for the Right to Information and Protection of Personal Data, Tirana, Albania.