Privacy Policy

1. Introduction

This Privacy Policy explains how Fantastic Online Stores PTY LTD (ABN 39 655 964 784), trading as FanPass (“FanPass”, “we”, “us”), of Melbourne VIC 3064, Australia, collects, uses, and protects your personal information when you use myfanpass.app and web.myfanpass.app (the “Service”). We are the data controller of your personal information. FanPass is an independent trip companion and is not affiliated with, endorsed by, or sponsored by FIFA or any football federation.

2. Information we collect

Account information

When you sign up we collect your email address and authentication details. If you sign in with Google, we receive your email and basic profile information from that provider. We also store your display preferences, such as light or dark theme and your distance and temperature units.

Your trip selections

To build and save your itinerary, we store the teams you follow and the matches you select. If you use the visa and border checklist, we store the nationality or nationalities you enter and which checklist items you have ticked off. You provide this nationality yourself, and it is used only to work out which entry requirements apply to your trip. Before you sign in, these selections live only in your own browser; when you sign in they sync to your account so your plan follows you across devices.

Group trips

When you create or join a group trip, we store the display name you choose, your RSVP, whether you have a ticket, the shows the group is considering, and any shared expenses you add to the split calculator. Your display name and these entries are visible to the other members of that trip. You can join a trip without an account: in that case we set a cookie on your device that identifies you as a member so your name and RSVP stick, and we do not link it to a personal profile. The split calculator is a tally only. FanPass never moves, holds, or processes any money between members.

Payment information

FanPass does not currently charge you for anything, and the split calculator never moves or holds money. When paying your share together launches as a future feature, payments will be handled by a licensed payment provider (such as Stripe); we would not see or store your full card number, and we would keep only the metadata needed to show who has paid their share.

Usage and technical information

We collect product analytics (such as pages viewed and actions taken) and standard technical data (such as device and browser information) to operate and improve the Service.

3. Location and community features (planned)

Community features such as the fellow-fan finder and fan-zone map are not active yet. When they launch they will be strictly opt-in and will use only an approximate location, never exact tracking, and you will be able to turn them off at any time. We will ask for your clear consent before any location is shared, and we aggregate over individuals rather than exposing precise positions.

4. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on: performance of our contract with you (to provide the Service and save your trip); our legitimate interests (to secure, maintain, and improve the Service); your consent (for optional features such as the community location features); and compliance with legal obligations.

5. How we use your information

• To build your itinerary, detect conflicts, and show heat, safety, and visa information for your trip.
• To run group trips: your display name, RSVP, and shared expenses are visible to the other members of that trip.
• To secure the Service and prevent abuse.
• To understand usage and improve the product.
• To send you transactional email about your account, your saved trip, and your purchases, including optional reminders when an entry or visa deadline for the matches on your trip is approaching.
• To comply with our legal obligations.

6. Sharing and sub-processors

We do not sell your personal information. We share it only with service providers who process it on our behalf:

• Supabase (database, authentication, and storage)
• Stripe (payment processing)
• PostHog (product analytics)
• Resend (transactional email)
• Vercel (hosting)

We may also disclose information where required by law or to protect our rights and the safety of others.

7. Affiliate links

Some travel options in your itinerary are affiliate links. When you click one, you leave FanPass and go to a travel partner, and we may earn a commission at no extra cost to you. Those partners have their own privacy policies that govern what they collect once you are on their site. We do not book travel on your behalf and we do not pass your account details to these partners.

8. International data transfers

Some of our providers are located outside Australia and the European Economic Area. Where we transfer personal information internationally, we rely on appropriate safeguards such as standard contractual clauses.

9. Data retention

We keep your personal information for as long as your account is active or as needed to provide the Service. You can change or remove your trip selections, and you can ask us to delete your account. Some information may be retained where required for legal, accounting, or security reasons.

10. Your rights (GDPR)

If you are in the EEA or UK, you may have the right to access, correct, delete, restrict, or port your personal information, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at privacy@myfanpass.app.

11. Your rights (CCPA/CPRA)

If you are a California resident, you may have the right to know what personal information we collect, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law.

12. Your rights (Australian Privacy Act)

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to, and correction of, your personal information. If you have a complaint about how we handle your information and are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).

13. Cookies

We use strictly necessary cookies for sign-in and privacy-friendly analytics. See our Cookie Policy for detail.

14. Security

We protect your data with measures including encryption in transit, row-level security on our database, explicit per-user ownership checks in our data layer, and verified payment webhooks. No method of transmission or storage is completely secure, but we work to protect your information.

15. Data breach notification

If a data breach is likely to result in serious harm, we will notify affected individuals and the relevant authorities as required by applicable law, including the Notifiable Data Breaches scheme in Australia.

16. Children's privacy

The Service is not intended for anyone under 16, and we do not knowingly collect personal information from children under 16.

17. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the date above, and where appropriate notify you.

18. Contact

For privacy questions or requests, contact us at privacy@myfanpass.app, Fantastic Online Stores PTY LTD, Melbourne VIC 3064, Australia.