Version 2.1 of October 14, 2026, replaces version 2.0 of July 27, 2026. English translation provided for convenience; only the French version is authoritative.

1. Who we are

The Smatchy mobile application and the website smatchy.app (together, "Smatchy") are published by LBDC Organisation, a French simplified joint-stock company (SAS) registered with the Annecy Trade and Companies Register under number 839 338 514, with its registered office at 5 rue de l'Industrie, 74000 Annecy, France.

LBDC Organisation is the data controller for the processing described in this policy. For any question or request regarding your data: donneespersonnelles@smatchy.app.

2. Who this policy applies to

It applies to anyone who uses the Smatchy application (activity participants and organizers), visits smatchy.app, contacts us through our forms or social networks, subscribes to our communications, or applies for a position with us.

3. The data we collect

Account and sports profile data. When you create your account: name or username, e-mail address, password, declaration of legal age (checkbox certifying you are 18 or older), profile picture where applicable, and your sports profile: sports practiced, level per sport, preferences and availability. Your profile and activities are visible to other users, that is the point of the service.

Geolocation. With your permission, the application uses your device's position to suggest activities and partners near you, within the search radius you choose. Before your phone asks for that permission, a screen explains what it is for and lets you answer later.

We store only two pieces of position data, and we build no history of your movements. The first is the position reported by your phone, recorded only when you turn that setting on in the application. The second is the point corresponding to the city you declare, if you would rather enter a city than allow geolocation; the service then remains fully usable. We do not keep your address or your home location, and nothing is read while the application is closed.

Your exact position is shown to no one. Other users do, however, see the distance in kilometres between you and them.

To turn a city into coordinates and coordinates into a place name, we use Google's geocoding service, to which those coordinates are sent.

You have two ways to stop this collection. The setting in the application switches it off and erases the position stored on our servers. Withdrawing the permission in your phone settings stops your device from providing a new position; until you have used the setting in the application or written to donneespersonnelles@smatchy.app, the last recorded position may remain.

The locations of activities you join are stored with the activity. The list of the last five cities you searched for stays on your device, inside the application, and is not sent to our servers.

Your weight

If you choose to enter it, your weight is used only to estimate how much energy a session asks of you, and that estimate is shown to you alone. It does not appear on any profile, is not shared with any organizer, any other participant or any third party, and is used neither for advertising nor for statistical analysis. Only authorised Smatchy staff can access it, for support and moderation purposes.

This field is optional. Without it, the estimate is based on an average weight and remains available. You can change or remove it at any time from your profile settings; removing it erases it from our servers. You can also switch these estimates off entirely in the application settings, in which case no calculation is performed.

Your weight is deleted along with the rest of your profile data when you delete your account.

Legal basis: your consent, which you give by entering this field and withdraw by erasing it.

Recommendations. Smatchy recommends activities and partners using an algorithm based on your sports, level, availability and location. These recommendations only personalize the content shown to you; they produce no decision with legal effect on you.

Messaging and groups. The content of the messages you exchange (private messaging and groups) is stored to provide the service. These exchanges are not systematically monitored; they may be reviewed by our teams following a report of content or behaviour contrary to our terms of use, or upon request from an authority.

Activities. The activities you create or join: sport, date, location, level, participants, history.

Payments and organizer documents. Payments for paid activities are processed by our payment service provider Stripe; Smatchy never stores your card numbers. For professional organizers, we collect the documents required by our Terms of Sale (diploma or professional card, Kbis extract or RNA receipt, federal licence, professional liability insurance certificate, SIRET number), and Stripe collects the identification and account information needed for payouts.

Notifications. To send you notifications (new participation request, message received, activity reminder…), we process your device's technical identifier and your notification preferences, which you can change at any time in the application or your phone settings.

Technical and audience measurement data. Technical logs required for the security and proper operation of the service.

On the smatchy.app website, audience measurement cookies (Google Analytics) are only set with your consent, see our Cookie Policy.

In the mobile application, a separate usage measurement has been active since August 12, 2026. It relies on Google Analytics for Firebase, it does not work like the website one, and we therefore describe it in detail.

What it records. Application opening, session start and screens viewed, together with nine specific actions: viewing an activity, joining an activity, viewing a group, requesting to join a group, joining a group, declaring a sport, searching, starting a payment and completing a payment. Each carries internal activity or group identifiers, the sport concerned, the location, numeric values (price, seats left, member count, number of results) and the place in the application the action started from. Payments additionally carry the amount, the currency and the outcome, success or failure. Where a payment fails, the reason is also sent. None of these parameters is intended to carry your name, your e-mail address or the content of your messages.

Three points we would rather state plainly than leave buried in technical detail. First, when you run a search after picking a place from the suggestion list, it is that place's full address that is sent, not just the town name; since people usually look for a partner near their home or their workplace, that address can be telling. Second, this measurement is not anonymous: as soon as you are signed in it is tied to your account's technical identifier, which makes it possible to link your sessions together and across devices. Third, the reason a payment failed is sent as it reaches us. It is a technical message produced by our payment provider or by an error inside the application, not a code we defined in advance. We therefore do not fully control its content, and it may include elements of the context of that payment.

This measurement is active from the first launch of the application. It is not submitted to you for acceptance.

From version 2.2.5 of the application onwards, you can switch it off at any time from your profile, in the settings. If you are using an earlier version, write to donneespersonnelles@smatchy.app and we will act on your objection.

Two points about that setting, so that you know exactly what it does. Your refusal is recorded on the device from which you express it: it stays there after an application update and after signing out, but it does not follow you to another phone and it disappears if you reinstall the application, in which case you need to express it again. And when you switch the measurement off, our own events stop immediately and the data already tied to your device is reset, while the automatic collection built into Google Analytics for Firebase, limited to application opening and session start, may only stop at the next launch.

You may in all cases object to this measurement and request the erasure of the data concerning you by writing to donneespersonnelles@smatchy.app.

Forms. The information you submit through our forms (contact, pre-registration): name, e-mail, subject and message content.

4. Why we use your data, and on what legal basis

Providing the Smatchy service (account, profile, matching, recommendations, messaging, activities, service notifications): performance of the contract (Terms of Use).
Processing payments and payouts (payment for an activity, organizer wallet, verification of professional documents): performance of the contract; legal obligations (anti-fraud, accounting).
Geolocating your searches (nearby activities and partners): consent, given through the setting in the application and the device permission, withdrawable at any time.
Estimating the energy spent during a session, from the weight you enter: consent, withdrawable at any time by erasing the field.
Securing the service (fraud prevention, handling of reports, moderation upon report): legitimate interest (safety of users and of the service).
Communicating with you (responses to your requests, information about the service and its changes): performance of the contract; legitimate interest.
Sending you marketing communications (newsletter, offers, unsubscribe available in every message): consent.
Measuring website audience (visit statistics, Google Analytics): consent (cookie banner).
Measuring use of the mobile application and improving the service (journeys within the app, searches, payment funnel, Google Analytics for Firebase): legitimate interest (understanding actual use of the service in order to improve it). You may object, see section 8.
Complying with our legal obligations (accounting, tax, including reporting of organizers' income, legal requests): legal obligation.
Handling job applications (review of applications, interviews): pre-contractual measures.

5. Who has access to your data

Other users: your profile (username, picture, sports, level) and the activities you create or join are visible to other users. The organizer of an activity sees the list of registered participants.
Stripe (payment service provider) for transactions and payouts to organizers.
Our hosting and technical providers: MongoDB Atlas (application database, hosted in the European Union, in Frankfurt), Amazon Web Services (hosting of the smatchy.app website, on servers located in Paris, and image storage), acting as processors.
Google (website audience measurement if you have consented, usage measurement of the mobile application through Google Analytics for Firebase, and geocoding of the cities and search coordinates).
Brevo (e-mail delivery provider) for messages relating to the smatchy.app website, our service e-mails and, if you have consented, our marketing communications and information lists.
SendGrid (e-mail delivery provider) for the messages and notifications sent by the Smatchy app.
Notion (tool we use to track our exchanges) when you send us a request relating to our fundraising round: your name, your e-mail address, your LinkedIn profile where applicable and the information you send us are recorded there so that we can review your request and follow it up.
Our advisers and contractual partners (accountants, lawyers, insurers) where necessary, and the authorities where required by law (notably the tax administration under platform reporting obligations, and judicial authorities upon request).

We do not sell your data to anyone and do not pass it to any third party for their own marketing purposes.

6. Transfers outside the European Union

Your data is hosted in the European Union. Some of our providers are, however, US companies (Google, Amazon Web Services, MongoDB Inc., Stripe, Notion Labs, Twilio SendGrid): where a transfer outside the EU occurs, it is governed by the safeguards provided by the GDPR, the European Commission's standard contractual clauses and, for certified providers, the EU–US Data Privacy Framework. You can obtain a copy of these safeguards by writing to donneespersonnelles@smatchy.app.

7. How long we keep your data

Account and profile: until you delete your account, and at the latest 10 years after your last activity.
Messages (messaging and groups): until account deletion, and at the latest 10 years after the last activity.
Position and declared city: until you erase them from the setting in the application, and in any event until the account is deleted. We keep no history of positions.
Weight: until you erase it, and in any event until the account is deleted.
Payment data: 13 months (banking data, held by Stripe); 10 years for accounting documents (invoices).
Organizer documents (diplomas, Kbis, insurance…): duration of the contractual relationship + 5 years.
Technical logs: 6 to 12 months.
Website audience measurement: 2 months for event data, 14 months for data tied to an identifier, the latter period restarting on each new visit.
Application usage measurement: at most 14 months.
Contact forms: 1 year after the request is closed.
Prospects (newsletter, pre-registration): 3 years after last contact.
Job applications: 2 years after last contact.
Reports and sanctioned accounts: time needed for processing, then archiving for the applicable limitation period.

Inactive accounts are in any event anonymised, together with all associated data (profile, messages, position), at the latest 10 years after the last activity.

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, the right to set instructions regarding your data after your death, and the right to withdraw consent at any time. To exercise them: donneespersonnelles@smatchy.app (or directly in the application for most profile information). We respond within one month, extendable by two months for complex requests. If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 – www.cnil.fr).

9. Minors

Smatchy is restricted to adults. Each user declares that they are 18 or older when creating their account; this declaration is their own responsibility, as Smatchy does not carry out systematic identity verification. We do not knowingly collect data about minors: if we discover, or are informed, that an account belongs to a minor, the account and associated data are deleted. Reports can be sent to support@smatchy.app.

10. Security

We implement appropriate technical and organizational measures: encrypted communications (HTTPS), access control to the database, hosting in the European Union, payment handling segregated with our authorized provider. As no system is infallible, we recommend using a strong, unique password and never sharing your credentials.

11. Changes to this policy

Each version of this policy has a number and a date. In the event of a substantial change (new purpose, new recipient, change of retention period), we will inform you by e-mail or in-app notification before it takes effect. The version history is available on request.

Version 2.1 of October 14, 2026 · Description of the mobile application's usage measurement, active since August 12, 2026, of what it records, of its link to the account and of the setting that switches it off, available from version 2.2.5 of the application; addition of the optional weight field, its purpose, its legal basis and its retention period; retention periods added for audience measurement; the Geolocation paragraph rewritten after verification in the code, removing the mention of a position history that does not exist and adding the distance visible to other users, the use of Google geocoding and the two ways of stopping the collection; clarification on the anonymisation of inactive accounts. Replaces version 2.0 of July 27, 2026.

PRIVACY POLICY