5QUAD Privacy Policy
Effective date: 31 August 2026 Controller: Yassine Sherif, auto-entrepreneur (registre national de l'auto-entrepreneur nº 003645071000059), operating as "5QUAD" ("we", "us"), Rabat, Morocco. Contact: privacy@5quad.io.
1. About this policy
This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have. It applies to the 5QUAD application and website. By using the Service you acknowledge this policy. Where required by law, we rely on the lawful bases and consents described below.
2. Data we collect and why
We collect only what the Service needs to function. The table below is the complete inventory.
| Data | Why we collect it | Notes |
|---|---|---|
| Phone number | Account verification and sign-in (one-time passcode) | Shared with our verification provider to deliver the passcode. Never sent to our analytics provider. |
| Email and name | Sign-in through Apple or Google; roster display | Apple private relay email addresses are supported. |
| User identifier | To operate your account | Also used as a pseudonymous analytics identifier. |
| Date of birth | Age eligibility and birthday features | Never shown to other Users; never sent to analytics. |
| Gender (optional) | To gate access to women-only activities | Self-declared, optional, not verified, never shown to other Users. |
| Precise location | To show nearby games, match you, and confirm attendance at a venue | Your precise location is never shown to other Users. Only a shared venue pin is visible. Collected only while the app is in use, never in the background. |
| Attendance | To calculate reliability | Confirmed by an in-person check-in at the venue. |
| Chat messages | To coordinate a game | Deleted when the match result is settled or the game is cancelled. A reported message is retained only as evidence for moderation. |
| Card photo | To personalize your player card | Only the processed cutout image is uploaded. Your original photo never leaves your device. |
| Competition images | League and tournament branding | Uploaded by Organizers; subject to reporting and removal. |
| Ratings and statistics | To provide ratings, cards, and standings | Recorded from match results. |
| Reports, blocks, account status | Safety and moderation | Handled by our moderation function. |
| City and city interest | To match you to an active area and to plan expansion | Self-selected. |
| Guest name | To let a Host fill a game and to attach history if the Guest later joins | Provided by a Host who confirms the Guest's consent. |
| Waitlist email (website) | To contact you about availability | Collected only if you submit it on our website, with your consent to be contacted about marketing and product updates. |
| Waitlist signup record (website) | To stop abuse of the signup form and know where a signup came from | A one-way keyed hash of your IP address and the referring page, stored with the waitlist email. |
3. How we use your data
We use your data to operate and provide the Service, to verify your account, to match you with games and other Users, to record results and calculate ratings, to keep the Service safe (moderation, reports, blocks, bans), to communicate with you about the Service, to comply with law, and, only where you have consented, for analytics and marketing.
4. Legal bases (where GDPR or an equivalent law applies)
- Performance of a contract: providing the Service you sign up for, including matching, lobbies, results, and account management.
- Legitimate interests: safety and moderation, preventing abuse, securing the Service, and planning market expansion, balanced against your rights.
- Consent: analytics in regions where consent is required, and optional marketing communications. You may withdraw consent at any time.
- Legal obligation: responding to lawful requests and meeting statutory duties.
- Vital interests: acting where necessary to protect someone's safety.
5. Location data
Your precise location is used to find nearby games, to match you, and to confirm you are at a venue for check-in. We collect it only while the app is in use. We never collect it in the background. We never show your precise location to other Users. Other Users see only the shared venue pin for a game, not your personal position.
6. Sharing and processors
We do not sell your personal data and do not share it for advertising. We share data only with service providers that process it on our behalf under contract, and only as needed:
- Convex: our primary data host and database.
- Clerk: our sign-in provider, holding the email and name associated with your chosen sign-in method. Clerk never receives your phone number.
- Our verification provider (Twilio): to deliver verification passcodes over WhatsApp or SMS, and to check that a number is not a virtual number. Delivery only, never marketing.
- Our analytics provider (PostHog, European hosting): pseudonymous usage analytics, gated behind consent where required. We never send it raw location, phone numbers, email addresses, or chat content, and analytics session replay masks the phone field and map screens.
- Our crash-reporting provider (Sentry, European region): crash and error reports containing device model, operating system, app version, and a pseudonymous identifier. Configured to exclude phone numbers, email addresses, location, and chat content.
- Map provider (Google Maps): to display the in-app map on iOS and Android.
- Website and email provider (Hostinger, Titan): to run the website and support email. The website waitlist email and its signup record are stored in a Hostinger MySQL database. They are not shared with the app's other processors.
- Apple and Google: as sign-in identity providers you choose.
We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and security of Users, the public, or the Company.
7. International transfers
We operate across several countries. Where we transfer personal data across borders, including out of the European Economic Area, we use appropriate safeguards required by applicable law, such as standard contractual clauses or an adequacy decision. You may contact us for more information about the safeguards we use.
8. Retention
We keep personal data only as long as needed for the purposes above or as required by law. Specifically: chat messages are deleted when a match result settles or a game is cancelled; your original photos are never uploaded; reported content is retained only as evidence for as long as needed for moderation; and when you delete your account we delete or anonymize your data as described in Section 10.
9. Analytics and consent
We use privacy-preserving analytics to understand and improve the Service. In regions that require consent for analytics, including the European Union, analytics are blocked until you consent, not merely anonymized. We do not use advertising identifiers and do not track you across other companies' apps or websites.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You can:
- Delete your account in the app or through the web deletion form. Deletion cascades across your data (signals, memberships, messages, ratings, and aura records anonymized or removed), revokes your linked sign-in token, and issues an analytics deletion request.
- Manage communication and language preferences in the app; where you set a preference, we honor it.
- Contact us at privacy@5quad.io to exercise any right. We respond within the period required by applicable law.
If you are in the European Economic Area, you may lodge a complaint with your local supervisory authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada or your provincial authority.
11. Children
The Service is not directed to children under sixteen (16), and we do not knowingly collect data from them. We use the date of birth collected at registration to enforce this. If we learn we have collected data from someone under the applicable minimum age, we will delete it.
12. Security
We protect your data with technical and organizational measures, including encryption in transit. Our back-office tools operate under least-privilege access and audit logging, and never hold a master key to your data. No system is perfectly secure, but we work to protect your information and to respond to incidents.
13. Regional information
- Morocco: the controller is established in Morocco, and we handle personal data consistently with Law 09-08 and the requirements of the CNDP.
- European Union and France: this policy sets out the lawful bases and rights required under the General Data Protection Regulation. France's digital consent age is respected through our age gate.
- Canada: we handle personal information consistently with PIPEDA. You control your communication and language preferences, and we honor them.
- United Arab Emirates and GCC: we handle personal data consistently with the applicable data protection laws in these markets.
14. Changes to this policy
We may update this policy from time to time. If we make a material change, we will provide notice through the Service or by other reasonable means before it takes effect.
15. Contact
Privacy questions and requests: privacy@5quad.io. Intellectual property complaints: legal@5quad.io. Postal: Rabat, Morocco. Email us if you need the full postal address for a formal request.