Privacy Policy

Information we process

• Account and profile information: your name and email address supplied through Google Sign-In or Sign in with Apple, plus the interests, gender choice, age, city, and postal/PIN code you provide when completing your profile. Apple may provide a private relay email address instead of your personal email address. Profile details other than your display name are private to you and are not shown to group members.
• Group information: groups you create or join, membership, invitations, events, attendance responses, contributions, credit history, shared expenses, and a guest name if a group administrator records a guest's outside-app contribution. A group administrator may add an optional group picture. If an administrator marks a group public, its name, description, picture, and chosen category tags are shown for discovery. Upcoming events created in that group may show their name, date/time, city, venue, postal code, and category tags in public event search; member identities, balances, and history are not published.
• Optional location and address lookup: if you tap “Use my location”, we use your device location once to suggest a city. Address searches are sent to Geoapify to provide address details such as a postal code; this also happens when a signed-in user asks AI to draft an event whose supplied address has no postal code. We do not track your location in the background.
• Optional AI event drafting: when a signed-in user chooses “Draft with AI”, the event description they enter and administrator-written tags and descriptions for shared cover-library images are sent to OpenAI to create an editable draft and suggest a matching existing cover. Cover images themselves are not sent to OpenAI. The draft is not published automatically. Non-administrator accounts are limited to three successful drafts per UTC day by default; administrators are not subject to that daily limit. Do not include unrelated personal or sensitive information.
• Messages: messages you send to members of your groups, together with the sender and delivery/seen information needed to show the conversation.
• Support requests: information you choose to send us by email.

Why we use it and our legal bases

We use this information to create and secure accounts, operate shared groups and events, calculate credits and expenses, deliver group chat, and respond to support requests. The main legal basis is performance of the service you request when you create an account, join a group, or use its features (GDPR Article 6(1)(b)). We also process limited information where necessary for security, fraud prevention, troubleshooting, and service reliability, based on our legitimate interests (GDPR Article 6(1)(f)).

Who can see it

Members of a group can see the information needed to use that group, including member names, event participation, shared credits, expenses, and group messages. Group administrators can manage group membership and related group activity. For a public group, people can see only its administrator-selected discovery details and upcoming event details, and can submit a join request containing their display name to that group's administrator.

Service providers and international transfers

ClubCredits uses Google Firebase services, including Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, and Hosting, to authenticate users and operate the service. ClubCredits application data is stored in our Firestore database in the EU. Google and Apple provide the sign-in services you choose to use. OpenAI processes event descriptions and administrator-written cover tags and descriptions only when a signed-in user requests an AI-assisted draft; cover images are not sent, and ClubCredits asks OpenAI not to retain those API responses for later retrieval. These providers may process information outside the European Economic Area as part of their global services; where applicable, their contractual and transfer safeguards apply. We do not sell personal information or use it for advertising.

Retention and deletion

Account and group information is kept while the account or group remains active. Group chat messages are automatically deleted after 30 days. Support correspondence is kept only as long as needed to resolve the request, normally no longer than 12 months. You can delete your account from the in-app profile. This removes your account, messages, and group access. Financial entries are retained only in anonymised form so that other members' group balance remains accurate. If you administer a group, the app warns you that deleting your account also deletes groups you created and their related group data. ClubCredits does not process refunds or transfers; arrange any balance settlement outside the app before deleting an account. You can also request assistance at developers@sharcraft.com.

Security

We use authenticated access controls, Firestore security rules, encrypted connections, and Google Firebase's standard encryption at rest to protect the service. Group chat is not end-to-end encrypted: it is stored temporarily so that group members can receive it when they are offline. Please do not use ClubCredits to share sensitive personal information.

Your rights

Depending on your circumstances, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Contact developers@sharcraft.com to make a request. You may also complain to your local data-protection authority; in Denmark, this is Datatilsynet.

Age and automated decisions

ClubCredits is not intended for anyone under 16 years old. We do not make automated decisions that produce legal or similarly significant effects. The app automatically calculates shared event credits from the amounts and attendees configured by a group administrator; administrators can review and correct completed event costs.

Changes to this policy

We may update this policy as ClubCredits develops. We will publish the updated version on this page and change the effective date.