Privacy Policy

1Data We Collect

We collect only the data necessary to operate the app. We do not collect billing or card details, contacts, calendar data, audio files, or web-browsing history.

Account identifiers (Firebase Authentication) — when you sign up, we collect your phone number (required for OTP-based phone sign-up) and/or your email address (required for email/password sign-up). We also store the Firebase User ID assigned to your account. Phone number is optional if you choose the email/password sign-up path.

Profile data — you may optionally provide a display name, profile photo/avatar, biography, sport interests, spoken languages, and age range. This information is stored against your account and is visible to other users of the app according to your privacy settings.

Photos and media — you may optionally upload a profile photo, a club banner image, or attachments to match posts. No videos or audio files are collected.

In-app messages and activity — if you use in-app chat (within matches or clubs), the messages you send are stored. Chat is optional — if you never use it, no messages are collected. We also record the matches, clubs, and events you join or create, and other user-generated content such as match results and club posts.

Device location — we request location permission to enable venue and activity filtering. Both approximate location (city-level) and precise location are optional and permission-gated — the app functions without location access, and you can deny or revoke the permission at any time in your device settings. Precise location is only accessed when you explicitly opt in to a location-dependent feature.

Push token (device identifier) — we collect the Firebase Cloud Messaging (FCM) token assigned to your device to deliver push notifications (e.g. match invitations, club updates). This identifier is tied to your account and replaced when you reinstall or reset the app.

Crash logs and diagnostics — we collect crash reports and diagnostic data via Firebase Crashlytics to identify and fix bugs. This data includes stack traces, device model, OS version, and app version. It does not include the content of your messages or profile fields.

Interests for your feed — to order the “For you” list in the Lobby, the app notes which activities you open, how long you read them, and which you join, share or hide. These notes are encrypted, stay on your device and are never sent to us or to anyone else. You can switch off “Personal feed” or use “Reset my interests” at any time under Settings → Personal recommendations, and the notes are erased when you delete your account.

2Why We Collect It

Account management and authentication — to create, secure, and recover your account (name, email, phone number, Firebase UID, push token).

App functionality — to let you find and join nearby clubs, matches, and community events; to display your profile to other members; to deliver in-app notifications; and to enable chat within matches and clubs.

Location-based features — to filter matches and venues by proximity. Location is requested only when you use a feature that needs it, and only with your prior permission.

Crash diagnostics and stability — to detect and resolve application errors, improving the experience for all users.

3Organizer Applications

Becoming an organizer is not automatic. If you want the organizer role you fill in the form at lux-pro.app/organizer and a person at Lux Pro decides by hand. This section covers that form only — if you never apply, none of it applies to you.

What the form collects — the name you give, your email address, your phone number, the city or area you organize in, and a free-text description of what you want to organize and roughly how often. If you opened the form from inside the app it also carries your Lux Pro account identifier (the Firebase User ID), so the application can be tied to the right account. We ask for your phone number even though your account already has one: the two together are how a person checks, by hand, that the applicant is the account holder.

Why we collect it — to decide whether to grant you the organizer role, and to reach you about that decision. Organizers create activities that other people commit to and turn up for, so we verify before granting the role rather than after.

Lawful basis — your consent (GDPR Article 6(1)(a)), given by ticking the consent box on the form. The form cannot be submitted without it, the box is never pre-ticked, and it is not bundled with anything else. You may withdraw your consent at any time by writing to privacy@lux-pro.app; withdrawal stops us considering the application and does not affect processing carried out before you withdrew.

Who processes it — the application is stored on the same Google Firebase infrastructure as the rest of your data (see “Where Data Is Stored and Who Processes It”), and the alert telling us an application has arrived is delivered over the Telegram Bot API, as described in that section. It is read by Lux Pro staff only: it is never published, never shown to other users of the app, and never used for marketing.

How long we keep it — if we grant the role, the application is kept for as long as your account holds it, as the record of why it was granted. If we decline it, or if you withdraw your consent, we delete it within 6 months. Deleting your Lux Pro account deletes any application attached to it.

If you would rather not use the form, write to privacy@lux-pro.app instead. We will ask for the same details and the same rules apply.

4Where Data Is Stored and Who Processes It

All data is stored on Google Firebase infrastructure (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Firebase Cloud Messaging, and Firebase Crashlytics). Location-related features use the Google Maps Platform (Maps SDK and Places API). Google acts as our data processor under a Data Processing Agreement with Google LLC.

Google is our processor for everything described above. One further processor is involved: Telegram FZ-LLC, which operates the Telegram Bot API and our bot @LuxProAppBot. It is used in three places, each of them optional and each described below — if you use none of them, nothing of yours reaches Telegram through us. Telegram carries, and retains under its own privacy policy, every message exchanged with the bot; what we keep on Firebase is set out here.

Telegram sign-in — if you choose to sign in with Telegram, Telegram passes us the identifier of your Telegram account and the public profile details attached to it: your first and last name, your username, and a link to your profile photo. Your Lux Pro account is created against that identifier. Sign in any other way and none of this happens.

Phone verification through the bot — you may confirm your phone number through the bot instead of by SMS. If you choose it, the app asks us for a single-use link and opens it in Telegram, and the bot offers you a “Share my number” button. The number you tap to share is sent by Telegram to our Cloud Function, the bot replies in that private chat with a six-digit code, and when you type that code into the app the number becomes your account’s verified phone number: it is written to your Firebase Authentication record, to your account document, to a private contact document only you can read, and to a lookup entry that pairs a hash of the number with your account identifier, so that someone who already knows your number in full can find you. While the exchange is under way we also hold the single-use link, the identifier of the Telegram account that opened it, and the number waiting to be confirmed; the code itself is stored only as a hash, and neither the number nor the code is ever written to our logs. The link and the pending number are deleted the moment the code is used, and lapse on their own within fifteen minutes if it is not; the record tying your Telegram account to that link is kept for up to seven days so that a later share is not misrouted. Deleting your Lux Pro account erases all of it.

Organizer applications — the alert that tells the Lux Pro operator a new application has arrived (see “Organizer Applications”) is delivered through the same bot, and contains the applicant’s name, email address and phone number. The application record itself is stored on Firebase; Telegram carries and retains the notification message. Apart from these three, no feature of the app routes any data through Telegram.

The Lux Pro app uses no advertising SDKs, no analytics platforms other than those listed above, and no other third-party services. We do not sell your data. The website at lux-pro.app is covered separately in “This Website” below.

Encryption in transit: all communication between the app and Firebase or Google Maps services uses HTTPS. No unencrypted network connections are made.

Encryption at rest: data stored in Firestore and Cloud Storage is encrypted at rest by Google’s default infrastructure. On-device preferences are stored in encrypted storage.

5This Website

This section covers lux-pro.app, the website you are reading. It is separate from the app: browsing it requires no account, and by default it stores nothing on your device and sends nothing to any third party. Everything described below happens only if you have given your consent, and only for as long as you leave that consent in place.

Advertising measurement (Meta pixel) — if you accept, we load the Meta pixel, operated by Meta Platforms Ireland Limited. It lets us see which of our advertisements bring people to this site and on to the app stores. It collects your IP address, information about your browser and device, the pages you open on this site, and — if you use Facebook or Instagram in the same browser — an identifier that lets Meta connect the visit to your Meta account. We also send the same events from our own server (Meta’s Conversions API); the server and browser events carry a shared event id so that they are counted once rather than twice.

Lawful basis — your consent (GDPR Article 6(1)(a)), together with your prior consent to the storing of information on your device and access to it (Article 5(3) of the ePrivacy Directive as implemented in Luxembourg). Nothing is loaded before you accept, declining leaves the site fully usable, and you may withdraw your consent at any time from the privacy controls at the foot of any page. Withdrawal stops all further collection; it does not affect what was collected beforehand.

Roles — for the collection of this data and its transmission to Meta, we and Meta Platforms Ireland Limited act as joint controllers. For everything Meta does with the data afterwards, Meta is the sole controller and its own privacy policy applies. Meta may process the data outside the European Economic Area under the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework.

Campaign labels on the store links — the App Store and Google Play links on this site may carry a campaign label so that the stores can tell us, in aggregate statistics only, which campaign an installation came from. Those reports contain no information about individual people, and they are produced by the stores, not by us.

We place no other trackers of any kind. We run no web-analytics platform, no advertising network other than the one described here, no heatmaps, no session recording and no A/B testing tools. Questions about any of this go to privacy@lux-pro.app.

6Data Retention

We retain your personal data for as long as your account is active. When you delete your account (see “How to Delete Your Data”), your data is removed from our systems within approximately 30 days of the deletion request being processed. Crash logs retained by Firebase Crashlytics follow Google’s standard retention settings.

7Your GDPR Rights

As a data subject under the GDPR you have the following rights, which you may exercise by contacting us at privacy@lux-pro.app:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”) — you may request deletion of your personal data. The in-app account-deletion flow is the fastest way to exercise this right.
• Right to restriction of processing — you may ask us to limit how we use your data in certain circumstances.
• Right to data portability — you may request your personal data in a structured, commonly used, machine-readable format.
• Right to object — you may object to processing of your personal data where we rely on legitimate interests as the legal basis.

You also have the right to lodge a complaint with a supervisory authority. The competent authority in Luxembourg is the Commission nationale pour la protection des données (CNPD): 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu.

8How to Delete Your Data

In-app deletion (recommended): open the app and go to Settings → Account → Delete account. Confirming this action permanently deletes your profile, all uploads (profile photo, club banners, match attachments), and your authentication account. This cascade runs automatically and cannot be undone.

By email: if you cannot access the app, send a deletion request to privacy@lux-pro.app from the email address associated with your account. We will process the request and confirm deletion within 30 days.

9Children

Lux Pro is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has registered, please contact us at privacy@lux-pro.app and we will delete the account promptly.

10Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. We will notify users of material changes through an in-app notice or by updating this page.

11Contact

Data controller: Lux Pro. Privacy enquiries and GDPR data-subject requests: privacy@lux-pro.app.