Privacy Policy

Effective Date: 17.09.2026

R3 Punct Net srl ("we," "our," or "us"), based in Romania, is the data controller responsible for the Wanna Play Pool website and mobile app. This Privacy Policy explains what personal data we collect, why, the legal basis we rely on, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Romanian data protection law. You can contact us about privacy matters via our support page.

Information We Collect and Why (Legal Basis)

1. Account and Profile Data

Name, nickname, email address, password (stored as a salted hash), profile photo, roles, ratings, followers/following, blocked users, EULA acceptance, and notification preferences. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR) — we need this to create and run your account.

2. Location Data

Your approximate or precise geographic coordinates, either detected automatically or entered manually, used only in the moment to show you nearby pool clubs, providers, and tournaments. We do not store your coordinates on our servers — each search is used to return results and then discarded. Legal basis: performance of the contract (Art. 6(1)(b)), since these location-based search features are core to the service. Check-ins and planned visits (which club, and when) are stored, but your raw coordinates are not — see "Messages and Social Activity" below.

3. Messages and Social Activity

Chat messages, match invitations, match results, marketplace listings you create, and club check-ins/planned visits (which club, and when — not your raw GPS coordinates). Legal basis: performance of the contract (Art. 6(1)(b)).

4. Technical and Log Data

IP address, browser type, session cookie, error/crash reports (via Sentry), and basic request logs. Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).

5. Cookies and Local Storage

We use the following storage technologies:

• Strictly necessary session cookie — keeps you signed in; set by our own server. Legal basis: necessary for the service, no consent required.
• Browser local storage — stores your profile and sign-in token on your device so you stay logged in between visits.
• Google Maps (address autocomplete) and Google reCAPTCHA (spam protection on forms) — third-party scripts that may set cookies on google.com. Loaded only after you accept cookies in the banner shown on this site. Legal basis: consent (Art. 6(1)(a)).
• Google Sign-In — used to let you log in with your Google account; loads a Google script that may set cookies on google.com. Legal basis: consent, and performance of the contract when you actively use it to log in.

You can withdraw cookie consent at any time by clearing your browser's local storage for this site, which will show the cookie banner again.

Who We Share Data With

We do not sell personal data. We share data only with the following processors, strictly to run the service:

• Google (Google Maps, Google Sign-In, reCAPTCHA) — see Google's Privacy Policy.
• Amazon Web Services (AWS S3 / CloudFront) — stores uploaded photos.
• Firebase (Google) — delivers push notifications to the mobile app.
• Sentry — error monitoring to help us fix bugs.
• Our email provider — sends account, verification, and password-reset emails.

We may also disclose information if required by law, to enforce our Terms and Conditions, to prevent fraud or abuse, or in connection with a merger or asset sale (in which case we will notify you before your data is transferred to a different privacy policy).

Some of these providers may process data outside the EU/EEA (e.g. in the US). Where this happens, we rely on their compliance with the EU-US Data Privacy Framework or Standard Contractual Clauses as the transfer safeguard.

How Long We Keep Your Data

• Account data: kept while your account is active, and deleted (along with your messages, check-ins, planned visits, invitations, and match history) when you delete your account from the Account settings page.
• Session cookie: expires automatically after 7 days, or immediately when you log out.
• Club/venue check-ins and planned visits: deleted automatically shortly after they expire.

Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data — most profile fields can be edited directly in your Account settings.
• Erase your data — you can permanently delete your account and associated data from the Account settings page at any time.
• Restrict or object to certain processing based on our legitimate interest.
• Data portability — download a copy of your data in machine-readable (JSON) format at any time from your Account settings page ("Export my data").
• Withdraw consent at any time for anything based on consent (e.g. cookies), without affecting the lawfulness of prior processing.
• Lodge a complaint with your local data protection authority (in Romania, the ANSPDCP — www.dataprotection.ro).

To exercise any of these rights, contact us via our support page. We will respond within one month as required by the GDPR.

Security

We take the following measures to protect your information:

• Encrypting traffic using HTTPS/TLS
• Storing passwords as salted, hashed values, never in plain text
• Restricting access to personal information to staff and contractors who need it to operate the service

Children's Privacy

Our service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us via the support page so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will update the effective date above and, for material changes, notify you through the app or by email.

For any questions or concerns regarding this Privacy Policy, or to exercise your data rights, please contact us at our support page.