Privacy Policy

1. Who we are

This privacy policy applies to MatchUp (referred to as "MatchUp", "we", "us", or "our"), operator of the website at zhihengliu1203.github.io/MatchUp/ (the "Service").

For any privacy-related question or request, see Section 14.

2. What information we collect

We collect the following categories of personal information:

Category	What it includes	Source
Account information	First name, last name, email address, password (encrypted), and (if you sign in with Google) the basic profile information Google shares with us.	You / Google
Profile information	City, phone number (optional), bio, preferred sports, skill level, profile photo (optional).	You
Event content	Events you create or join, including titles, sport, dates, venue addresses, descriptions, photos, and pricing.	You
Location-related data	Venue addresses you submit, which we geocode into approximate latitude/longitude. Optionally, your device's approximate location if you grant browser permission to use the "near me" filter (used in-session only, never stored on our servers).	You / Browser
Communications & safety	Reports you file about other users or events (category, reason, reporter ID), and users you have blocked.	You
Authentication metadata	Email verification status, account creation date, last sign-in timestamp. Managed by Firebase Authentication.	System
Technical data	Standard server logs from our hosting and infrastructure providers (IP address, browser type, request timestamps). We do not run our own custom analytics.	Browser

We do not collect: payment information, government IDs, biometric data, health data, or precise GPS coordinates (unless you explicitly grant the browser geolocation prompt for the "near me" feature).

3. How we use your information

• To provide the Service: create your account, display events, let you join and organize events, and match you with relevant events near you.
• To communicate with you: account-related emails (such as email verification, password reset).
• To keep the Service safe: review reports, enforce these Terms, prevent abuse, fraud, and harassment.
• To improve the Service: understand how features are used (in aggregate) and fix bugs.
• To comply with legal obligations: respond to lawful requests from authorities, enforce our agreements, and protect our rights or those of users.

We do not sell your personal information to anyone, ever. We do not use your information for advertising profiling or targeted advertising.

4. Legal basis for processing

Under applicable Canadian and Quebec law, we process your personal information on the following legal bases:

• Performance of a contract — to deliver the Service you have signed up for.
• Your consent — for optional features such as browser geolocation, profile photo upload, and marketing communications (if any).
• Legitimate interests — to operate, secure, and improve the Service, and to prevent fraud or abuse.
• Legal obligation — to comply with laws and lawful requests from public authorities.

5. Who we share information with

Your personal information is shared only in the following situations:

• With other users (public profile content): Your first name, last initial, profile photo, and the events you organize are visible to other users (and to non-logged-in visitors) so they can find and join events.
• With event participants and organizers: If you join an event, the organizer can see that you have joined. If you organize an event, participants can see your name and contact info you choose to share within the event description.
• With service providers: Trusted third parties who help us run the Service (see Section 6). These providers process data only as needed to perform their function.
• For legal reasons: If required by law, court order, or to protect the safety, rights, or property of MatchUp, our users, or the public.
• In a business transfer: If MatchUp is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before that happens.

6. Third-party services we use

We rely on the following service providers, each of which has its own privacy practices:

Provider	Purpose	Data shared
Google Firebase (Google LLC — USA)	Authentication, database (Firestore), hosting infrastructure.	Account info, profile, events, photos, reports, blocks.
Google Sign-In (Google LLC — USA)	Optional federated login.	Your Google profile (name, email, photo) — only if you choose to sign in with Google.
GitHub Pages (GitHub, Inc. — USA)	Hosting the public-facing website.	Standard web server logs (IP, browser, request).
OpenRouteService (HeiGIT, Germany)	Geocoding venue addresses you submit into map coordinates.	Address text you submit.
OpenStreetMap (OpenStreetMap Foundation — UK)	Displaying map tiles.	Standard map-tile request logs (IP, viewport).
Google Fonts (Google LLC — USA)	Web fonts.	Standard request logs (IP).

We do not control how these providers process data; we recommend reviewing their privacy policies for further details.

7. Where your data is stored

Our database (Google Firestore) is hosted in Google Cloud regions, which may include locations outside Canada (such as the United States or the European Union). By using the Service, you understand and agree that your personal information may be transferred to, stored, and processed outside Quebec and Canada. We rely on the contractual and technical safeguards Google provides for such transfers.

Pursuant to Quebec's Law 25, before transferring your personal information outside Quebec, we have assessed that the third-party providers above offer protection considered adequate.

8. How long we keep your data

• Account & profile: kept for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 60 days, except where retention is required by law.
• Event records: kept indefinitely for safety, history, and integrity of the Service, but personally identifying fields (your name, email) are anonymized when you delete your account.
• Reports and safety records: kept for as long as needed to enforce our Terms and protect the community, typically up to 3 years.
• Server logs: kept by our infrastructure providers per their standard retention (typically 30–90 days).

9. Your rights

Depending on your jurisdiction, you have the following rights regarding your personal information:

• Right of access: request a copy of the personal information we hold about you.
• Right of rectification: ask us to correct inaccurate or incomplete information. You can edit most of your information directly on your profile page.
• Right of deletion / erasure: ask us to delete your account and personal information.
• Right to withdraw consent: withdraw any consent you have given (for example, by revoking browser location permission, or removing your photo).
• Right to portability: request your data in a structured, machine-readable format.
• Right to object or restrict: object to or limit certain processing of your information.
• Right to lodge a complaint: if you live in Quebec, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). Elsewhere in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

To exercise any of these rights, contact us using the details in Section 14. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

10. Security

We take reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encrypted connections (HTTPS) for all traffic to and from the Service.
• Industry-standard Firebase Authentication with hashed passwords.
• Database access controlled by Firestore security rules that limit access on a per-user basis.
• Limited administrative access on a need-to-know basis.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a privacy incident likely to cause serious harm, we will notify affected users and the relevant regulator without undue delay, as required by Quebec Law 25 and PIPEDA.

11. Cookies & local storage

We use only the following types of browser storage, all essential for the operation of the Service:

• Firebase Auth session tokens — to keep you logged in.
• localStorage — to remember your session and cache geocoded addresses (avoids re-querying the same address).

We do not use third-party advertising cookies, behavioural tracking pixels, or cross-site tracking technologies.

12. Children's privacy

The Service is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top, and we will provide additional notice (such as via the Service or by email) where required by law. Continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

14. Contact & Privacy Officer

If you have questions about this Privacy Policy, or wish to exercise any of your rights, please contact our Privacy Officer:

MatchUp — Privacy Officer
Montréal, Quebec, Canada
Email: liuzhiheng1203@gmail.com

We will acknowledge your request within 5 business days and respond substantively within 30 days, as required by Quebec Law 25.

← Back to MatchUp