1. Who Controls Your Data
The controller of the personal data described in this policy is PunchID, established in Portugal, which operates PunchID.
For anything in this policy — including access, correction, erasure or portability requests — write to support@punch-id.com. We answer within one month, as the GDPR requires.
2. Data We Collect
When you create and use a PunchID account, we collect the following categories of personal data:
- Account information: full name, email address, password (hashed via Firebase Authentication), and account type (Athlete or Organization).
- Profile data: date of birth, gender, city, country, profile photo, and any optional bio or social links you choose to add.
- Combat sports data: fight records, event results, sport disciplines, fight classes, team affiliations, certifications, and achievements. Fight records are submitted by authorized event organizers via the results workflow.
- Event data: events you create (Organizations), events you register for, registration status, and participant decisions.
- Photos: profile photos uploaded by you, stored on Cloudflare R2.
- Usage data: session tokens, browser type, device type, and IP address collected for security and platform improvement purposes.
3. How We Use Your Data
Your data is used exclusively to operate and improve PunchID:
- Displaying your public profile to other users on the Platform.
- Managing event registrations and communicating approval or rejection decisions.
- Populating your PunchID Record from verified event results submitted by organizers.
- Sending notifications about events, registration status changes, and platform updates.
- Enforcing platform rules and preventing fraudulent or abusive activity.
- Improving Platform features based on aggregated, anonymized usage patterns.
We do not use your data for targeted advertising, and we do not sell your personal data to any third party.
4. Why We Are Allowed To
The GDPR requires us to name the legal basis for each purpose, not only the purpose. Ours are:
- Performance of a contract (Art. 6(1)(b)): holding your account, showing your profile, running registrations and approvals, recording results, and emailing you about your own registrations and events. This is the service you asked for; it cannot be delivered without processing this data.
- Legitimate interests (Art. 6(1)(f)): keeping the Platform secure, preventing fraud and abuse, and keeping a public record of verified fight results so that a record means something. We have weighed these against your interests; you may object at any time under section 9.
- Legal obligation (Art. 6(1)(c)): responding to lawful requests from a court or a regulator.
- Consent (Art. 6(1)(a)): anything optional you choose to add to your public profile, such as a biography or a photo. You can withdraw it by removing that content, without affecting anything else.
Giving us this data is not a legal requirement, but an account cannot exist without the account information in section 2, and an Athlete cannot register for an event without a complete profile.
5. Data Sharing
Your data is shared only in the following circumstances:
- Public profile: Your name, profile photo, sport disciplines, and public achievements are visible to all registered PunchID users.
- Event organizers: When you register for an event, the organizer can view your registration details and profile to make an acceptance decision. Participant lists are visible only to the event organizer before the event.
- Fight records: Verified fight results are part of your public PunchID Record and visible to all users.
- Legal requirements: We may disclose your data when required by law, court order, or regulatory authority.
6. Cookies and Session Tokens
PunchID uses cookies and browser storage exclusively for authentication and session management. Specifically:
- Firebase session cookies: httpOnly, secure cookies issued by Firebase Authentication to maintain your login session. These are essential for the Platform to function and cannot be disabled.
- CSRF tokens: Short-lived tokens to protect form submissions against cross-site request forgery attacks.
We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.
7. Data Retention
We retain your personal data for as long as your account is active.
When you delete your account it stops working immediately — your sign-in is removed and your profile disappears from the Platform. Your data is then held for 30 days, so that an account deleted by mistake can be recovered, and after that a scheduled job erases it: name, email address, date of birth, gender, city, country, photo and biography are overwritten and cannot be recovered by us or by anyone else.
What survives is the bout. A fight result names two athletes, so deleting one of them would destroy the other athlete's record as well. The result therefore remains, attached to a row that no longer identifies anybody — there is nothing left in it that points back to you. Event data created by Organizations is retained for 12 months after the event closes, then deleted unless the law requires otherwise.
Encrypted backups are kept for 30 days and are then discarded in turn, so a copy of your data can persist in a backup for up to that long after erasure. We do not restore backups to reinstate deleted data.
8. Data Outside the EEA and Minors
The application and its database run on servers in London, in the European Economic Area. Some of the providers listed in section 10 are United States companies, and data reaches them: Firebase (Google) holds your email address for authentication, Resend processes the emails we send you, and Cloudflare stores photos and encrypted backups and serves traffic through its network.
Those transfers rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework. You may ask us for details of the safeguards that apply to a particular provider.
PunchID is not for children under 13. That is the age of consent for information society services in Portugal, and registration checks it against the date of birth you give. If you believe a child under that age has an account, tell us at support@punch-id.com and we will remove it. Where a user is under 18, a parent or guardian must consent to their use of the Platform and to entry into any event.
9. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Correct inaccurate or incomplete data through your profile settings at any time.
- Right to erasure: Request deletion of your account and personal data from the Settings page or by contacting us at support@punch-id.com.
- Right to portability: Request an export of your personal data in a machine-readable format.
- Right to object: Object to processing of your data in certain circumstances.
- Right to lodge a complaint: You may file a complaint with the Portuguese data protection authority, CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt.
10. Third-Party Services
PunchID uses the following third-party services to operate the Platform. Each service has its own privacy policy:
- Firebase (Google): Authentication and session management. Your email address is stored with Firebase. Firebase Privacy Policy
- Resend: Sends the notification and account emails. Receives your email address and the contents of those messages. Resend Privacy Policy
- Fly.io: Application hosting. Processes request logs and serves the application. Fly.io Privacy Policy
- Cloudflare R2: Stores profile photos, uploaded images and encrypted database backups. Files are served via Cloudflare's network. Cloudflare Privacy Policy
- Database: application data (profiles, events, fight records) is stored in a SQLite database on the application server itself, not with a third-party database provider. Encrypted backups are replicated to Cloudflare R2.
11. Contact
For privacy inquiries, data access requests, or to exercise your rights under GDPR, contact us at support@punch-id.com.