Version: 1.9
Effective: February 14, 2026
Last Updated: February 14, 2026
We collect the following categories of information:
Important: LookApex does NOT have a chat or messaging feature. Users cannot communicate with each other through the app. We do not collect, store, or process any direct messages or communications between users.
We collect precise geolocation data ONLY when you actively initiate a check-in to a court. We do NOT collect background location data or track your movements outside of explicit check-in actions.
In compliance with GDPR Article 30 (Records of Processing Activities), we provide a complete inventory of all personal data we collect, store, and process:
| Data Field | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Account identification, communication | Contract | Until account deletion + 30 days | |
| first_name, last_name | Profile display | Consent | Until account deletion + 30 days |
| nickname | Alternative display name | Consent | Until account deletion + 30 days |
| height_cm, weight_kg | Player statistics (optional) | Consent | Until account deletion + 30 days |
| birth_year | Age verification (COPPA/GDPR compliance) | Legal Obligation | Until account deletion + 30 days |
| date_of_birth | Full birthdate for minors (parental consent) | Legal Obligation | Until account deletion + 30 days |
| country, city | Location preferences, finding nearby courts | Consent | Until account deletion + 30 days |
| jersey_number, colors, pattern | Customization preferences | Consent | Until account deletion + 30 days |
| sponsor, support_local_address | "Support Local" feature - user-provided business name and address (generates Google Maps link) | Consent | Until account deletion + 30 days |
| terms_accepted_at | Legal proof of consent | Legal Obligation | 7 years (legal requirement) |
| privacy_policy_version | Track which version user agreed to | Legal Obligation | 7 years (legal requirement) |
| Data Field | Purpose | Legal Basis | Retention |
|---|---|---|---|
| registration_ip | Fraud prevention, rate limiting | Legitimate Interest | 30 days |
| registration_fingerprint | Detect multi-account abuse | Legitimate Interest | 30 days |
| registration_user_agent | Bot detection | Legitimate Interest | 30 days |
| turnstile_token | Bot/human verification (Cloudflare Turnstile) | Legitimate Interest | Not stored (verified at registration only) |
| last_sign_in_ip | Security (detect unauthorized access) | Legitimate Interest | 30 days |
| last_sign_in_at | Account activity monitoring | Legitimate Interest | Until account deletion |
| sign_in_count | Usage statistics | Legitimate Interest | Until account deletion |
| spam_score | Automated spam detection | Legitimate Interest | Until account deletion |
| Data Field | Purpose | Legal Basis | Retention |
|---|---|---|---|
| court_id | Link check-in to court | Contract | Until account deletion + 30 days |
| checked_in_at | Timestamp of check-in | Contract | Until account deletion + 30 days |
| checked_out_at | Timestamp of check-out | Contract | Until account deletion + 30 days |
| verified (boolean) | GPS verification status | Consent | Until account deletion + 30 days |
When our automated moderation system detects inappropriate content, we record the following data to enforce our community guidelines and the three-strike warning system:
| Data Field | Purpose | Legal Basis | Retention |
|---|---|---|---|
| user_id | Link warning to user account | Legitimate Interest | Until account deletion + 30 days |
| warning_type | Type of violation detected (e.g., "bad_words") | Legitimate Interest | Until account deletion + 30 days |
| context | Where violation occurred (e.g., "court_name", "report_details") | Legitimate Interest | Until account deletion + 30 days |
| triggered_words | Words that triggered the filter (for audit/appeal purposes) | Legitimate Interest | Until account deletion + 30 days |
| created_at | Timestamp of violation | Legitimate Interest | Until account deletion + 30 days |
| Data Field | Purpose | Legal Basis | Retention |
|---|---|---|---|
| parent_email | Contact parent/guardian | Legal Obligation | Until child reaches 18 + 5 years |
| consent_given_at | Proof of consent timestamp | Legal Obligation | Until child reaches 18 + 5 years |
| consent_ip | Verify consent authenticity | Legal Obligation | Until child reaches 18 + 5 years |
| consent_items | Specific items consented to | Legal Obligation | Until child reaches 18 + 5 years |
We process your personal data for the following purposes:
When you check in to a court, we use your device's GPS/geolocation to verify that you are within proximity of the court location. This verification helps maintain the accuracy and integrity of our community data.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under GDPR:
You can exercise these rights directly in the app under Profile → Privacy & Data, or by contacting us at privacy@lookapex.com.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
To exercise these rights, contact us at privacy@lookapex.comwith the subject line "CCPA Request". We will verify your identity before processing your request.
We take the privacy of children seriously and comply with COPPA (US), GDPR (EU), and ZZPL (Serbia) regulations.
We collect birth year during registration to verify that users meet our minimum age requirement of 16 years. This is the strictest standard that complies with all applicable regulations globally.
If a user is under 16 years old, the following parental consent process applies:
Parental consent records include: parent's email, consent timestamp, IP address at time of consent, and specific items consented to. These records are maintained as required by law.
We obtain your consent through clear affirmative actions:
You may withdraw your consent at any time by:
Note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
We process your personal data based on the following legal grounds:
Your personal data may be transferred to and processed in countries outside of your residence. When we transfer data internationally, we ensure appropriate safeguards are in place.
Your personal data is primarily stored on Supabase servers located in the European Union (Germany and Netherlands). Data only leaves the EU when necessary for specific services (email delivery, security services) and is protected by the safeguards listed below.
When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place:
We use the following third-party services that may process your data:
We use Cloudflare Turnstile to protect our registration and login forms from automated bot attacks. Turnstile is a privacy-focused CAPTCHA alternative that does not require you to solve puzzles or identify images.
Our Android mobile application uses Firebase Analytics and Firebase Crashlytics to help us understand app usage and improve stability. These services are only active in the native mobile app — the web version does not use any analytics.
Each third-party service has its own privacy policy. We encourage you to review them:
We implement industry-standard security measures to protect your data:
Important: No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.
After you delete your account, your personal data is permanently removed from our active systems within 30 days. Backup copies may persist for an additional period before being permanently deleted.
We maintain backups of platform data for operational purposes, disaster recovery, and service continuity. These backups are created at our discretion and are retained for internal use only.
Important: We do NOT guarantee the ability to restore individual user data upon request. Backups are not a recovery service for user actions.
We may update this Privacy Policy from time to time. Depending on the nature of the changes, different notification and consent procedures apply.
Minor updates that do not affect your rights (e.g., clarifications, typo fixes, formatting changes).
Notification: We will display an informational banner in the app. You can dismiss it and continue using the Service.
Your action: No explicit acceptance required. Continued use of the Service constitutes your acknowledgment of the changes.
Significant updates that affect your rights, data usage, or legal obligations (e.g., new data collection practices, changes to data sharing, new legal bases).
Notification: We will send you an email notification and display a blocking modal in the app. You must review and accept the changes to continue using the Service.
Your action:
If you do not accept: You will not be able to continue using the Service. You may request account deletion and data export via privacy@lookapex.com.
All previous versions of this Privacy Policy are archived and available upon request. Contact us at privacy@lookapex.com to request historical versions.
Questions? If you have any questions about policy updates or the re-consent process, contact us at privacy@lookapex.com.
For questions about this Privacy Policy, data protection, or to exercise your rights under GDPR/CCPA, contact us at: privacy@lookapex.com
LookApex
Privacy Team
Belgrade, Serbia
If you are located in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti).
We use automated systems to enforce our community guidelines and maintain platform integrity.
Our moderation system automatically detects prohibited content (profanity, spam, inappropriate language) and prevents it from being submitted. Repeated violations trigger automatic warnings and, after three violations, automatic account suspension.
We use automated systems to detect suspicious activity, including multiple account creation from the same device, bot-like behavior, and other patterns indicative of abuse.
GDPR Notice: Under GDPR Article 22, you have the right to information about automated decision-making that significantly affects you. The above disclosure satisfies this requirement. You may contact privacy@lookapex.com with questions about our automated systems.
Below is our GDPR compliance checklist showing how we meet each requirement:
We clearly explain what data we collect and why. Legal bases are documented for each data type.
Data collected for specific, explicit purposes only. We don't use data for other purposes.
We only collect essential data. Most profile fields are optional. No background location tracking.
Users can update their profile anytime. Edit profile available in-app.
Defined retention periods for all data types. Automatic deletion after account removal.
TLS 1.3 encryption, bcrypt password hashing, Row Level Security in database.
Clear checkbox during registration. Must actively agree. Can withdraw anytime.
Minimum age 16 (strictest standard). Parental consent required for under-16.
Access, rectification, erasure, portability available in-app under Profile → Privacy & Data.
Complete data inventory documented in section 1A above.
Privacy-first architecture. Location only on explicit action. Optional fields.
DPO contactable at dpo@lookapex.com
Primary servers in EU (Germany/Netherlands). SCCs with non-EU providers.
Incident response procedures in place. 72-hour notification commitment.