Privacy Policy
Rosanero is an unofficial app for Palermo F.C. supporters. It is not affiliated with, sponsored by, or endorsed by Palermo F.C. or any league or federation. This policy explains what personal data we process when you use the app, why, and what rights you have.
The Italian version of this policy prevails in case of any discrepancy.
1. Data controller
The data controller is Vincenzo Stira, who can be contacted at support@rosanero.app for any request concerning your data.
No Data Protection Officer has been appointed, as the conditions requiring one do not apply.
2. You can use Rosanero without an account
Fixtures, results and the squad are browsable without signing up. If you do not create an account we process no identifying data: only the technical and diagnostic data described in § 3.3, and the technical information needed to deliver content to you (§ 3.4).
3. What we process
3.1 Account data
If you create an account, we process:
- your name and email address, and whether the email has been verified;
- your profile picture, if the provider you sign in with supplies one;
- your password, if you choose email and password sign-in — never stored in the clear, only as a cryptographic hash;
- the 6-digit verification codes (OTP) sent by email, kept only for as long as they are valid;
- the identifiers of your linked identities (Apple, Google, email/password) and the tokens the provider issues for them.
If you use Sign in with Apple and choose “Hide My Email”, we receive an anonymous @privaterelay.appleid.com forwarding address, not your real one.
3.2 Session data
To keep you signed in we process a session token and its expiry and — recorded by the server when the session opens — the device’s IP address and user agent. The token is stored on your device in the system Keychain; the app also holds a short-lived token, kept in memory only, to reach protected content.
3.3 Diagnostic and usage data
Distributed builds (TestFlight and App Store) include Google’s Firebase Analytics and Firebase Crashlytics, which collect aggregated usage events and crash reports with the device’s technical state at the time of the error (model, OS version, app version, identifiers generated by the libraries). We do not use this data for advertising profiling and do not combine it with your account data. Internal development builds do not configure Firebase and send nothing.
3.4 Feedback
If you send feedback from the app, what you write is transmitted to the FeedbackThread service together with an identifier for your account, so that we can reply. Do not put data in that channel that you do not want processed.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating and running your account, keeping you signed in | § 3.1, § 3.2 | Performance of a contract — (b) |
| Verifying your email and allowing password recovery | § 3.1 | Performance of a contract — (b) |
| Security: preventing abuse and unauthorised access, rate-limiting | § 3.2 | Legitimate interest — (f) |
| Diagnosing crashes and faults, understanding which sections are used | § 3.3 | Legitimate interest — (f) |
| Handling your feedback and replying to it | § 3.4 | Legitimate interest — (f) |
We do not process special categories of data under GDPR art. 9, and we take no automated decisions producing legal effects concerning you.
5. Where the data comes from
From you directly, or — when you choose to sign in with Apple or Google — from the provider, which gives us an identifier, the associated email address and, where available, your name. We never receive your password for those services.
6. Who we share it with
We do not sell your data and do not share it for third-party marketing. The following providers process it on our behalf, as processors or as independent controllers:
- Apple and Google, as identity providers, for sign-in;
- Resend, for sending verification and password-recovery emails;
- Google (Firebase), for diagnostics and usage analytics;
- FeedbackThread, for handling feedback;
- the hosting provider of the infrastructure the service runs on.
We may also disclose data to judicial or other competent authorities where the law requires it.
7. Transfers outside the European Economic Area
Some of the providers listed above are based in the United States. Where this involves a transfer of data outside the EEA, it takes place on the basis of the European Commission’s standard contractual clauses or an adequacy decision, as provided for in Chapter V of the GDPR.
8. How long we keep it
- Account data: for as long as the account exists. If you delete it, the data attached to it is deleted with it (see § 9).
- Sessions: until they expire or you sign out.
- Verification codes: minutes — as long as they are valid.
- Diagnostic data: per Firebase’s retention periods, and in any case no longer than the purpose requires.
- Feedback: for as long as it takes to handle the conversation with you.
9. Deleting your account
You can delete your account from inside the app, under More → Delete Account. Deletion removes your profile, your linked identities and your sessions, and revokes the authorisation you granted to Apple if you had signed in with Apple. It is irreversible. Step-by-step instructions are on the Account deletion page.
10. Your rights
Under GDPR arts. 15–22 you have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Write to support@rosanero.app to exercise them; we will reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live.
11. Children
The app is not intended for children under 14 and we do not knowingly collect their data. If you believe a child has given us personal data, write to support@rosanero.app and we will delete it.
12. Changes to this policy
We may update this policy; the date at the top always identifies the current version. If changes are substantial we will tell you in the app before they take effect.
Rosanero is an independent fan project, not affiliated with Palermo F.C.