Privacy Policy
Last Updated: December 9, 2025
Shallow Game (“we”, “our”, or “us”) operates the SHARKS mobile application (the “Application”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Application.
By using the Application, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please discontinue use of the Application.
1. Information We Collect
1.1 Personal Information You Provide
Email Address:
- Required for account creation and authentication
- Used to send verification codes for login
- Used to notify administrators of new user registrations
- Can be deleted when you delete your account
Username:
- Required unique identifier (3-16 alphanumeric characters)
- Displayed publicly in competitions and leaderboards
- Can be changed at any time or deleted with your account
Uploaded Images:
- Venue photos you choose to upload
- Stored with metadata (upload date, uploader ID, venue association)
- You can delete images you have uploaded
1.2 Automatically Collected Information
Account Data:
- User ID (automatically generated unique identifier)
- Account creation timestamp
- Last update timestamp
- User role
Session Information:
- Session ID stored in cookies
- Session expiration date
- Verification status
- Temporary verification codes valid for limited time
Device Information:
- Installation ID (unique device identifier stored in cookies)
- User agent string (to detect iOS/Android platforms)
- Notification preferences (opt-in status)
- Network status (online/offline detection)
Geolocation Data:
- Real-time location coordinates
- Collected only when using venue search or map features
- Requires explicit permission via browser/OS prompts
- Not stored in our database - only used for real-time calculations
- Temporarily cached on your device
- Cleared when you sign out or close the app
1.3 Activity Data
Competition Participation:
- Registration date and time for competitions
- Team assignments (partners in team competitions)
- Game participations (opponents, results)
- Tournament bracket positions
- Competition results (WIN, BREAKNRUN, DEFEAT, FORFEIT)
Venue Management Activities (if you are a Manager):
- Manager assignments to specific venues
- Assignment timestamps
- Seasons and competitions created
- Images uploaded to venue galleries
2. How We Use Your Information
We use the collected information for the following purposes:
Authentication & Account Management:
- Verify your identity via email verification codes
- Maintain your login session with automatic refresh
- Manage your user profile and preferences
- Enable account deletion and data removal
Competition Features:
- Register you for competitions
- Generate tournament brackets and team compositions
- Track game results and calculate statistics
- Display leaderboards and rankings
- Show your competition history
Venue Discovery:
- Calculate distance from your location to venues
- Display venues on an interactive map
- Sort venues by proximity to you
- Show venue details, images, and schedules
Manager & Admin Functions:
- Authorize venue management actions
- Enable competition creation and management
- Allow image uploads and gallery management
- Track manager assignments
Communication:
- Send verification codes via email (Resend service)
- Notify administrators of new user registrations
- Send push notifications for competition updates and announcements (via WonderPush)
Technical Operations:
- Ensure platform compatibility (iOS/Android detection)
- Maintain session security
- Prevent fraud and abuse
- Debug and improve the Application
3. Device Permissions
The Application requests the following permissions from your device’s operating system:
3.1 iOS Permissions
When you install the Application on iOS, you will be prompted for the following permissions:
Location Access:
- Purpose: Find bars nearby
- What it enables: Allows the app to access your location when using venue search and map features
- Control: iOS Settings > Privacy > Location Services > Sharks
Camera Access:
- Purpose: Take pictures and join competitions
- What it enables: Allows scanning QR codes and capturing venue photos
- Control: iOS Settings > Privacy > Camera > Sharks
3.2 Android Permissions
When you install the Application on Android, the following permissions are declared:
Camera Permission:
- Purpose: Scan QR codes and capture venue photos
- Control: Android Settings > Apps > Sharks > Permissions
Location Permission:
- Purpose: Find nearby venues and display your position on the map
- Control: Android Settings > Apps > Sharks > Permissions
Network State:
- Purpose: Detect online/offline status
All permissions are optional, but certain features will not function without them.
4. Data Storage and Security
4.1 Storage Locations
Database Storage:
- Hosted by Vercel infrastructure
- Location: As specified by Vercel hosting
Image Storage:
- Cloud storage with public URLs for venue images
- Permanent storage until deleted
Local Storage (on your device):
- Authentication session cookies
- Geolocation coordinates (temporary)
- Installation ID and notification preferences
- Application state and cache
4.2 Data Retention
Active Accounts:
- All data retained while your account is active
- Sessions expire after a period of inactivity with automatic refresh
Deleted Accounts: When you delete your account:
- Email address is permanently removed
- Username is permanently removed
- Installation ID is cleared from our database
- Notification preferences are disabled
- Manager assignments are deleted
- Your session is terminated
Important Note on WonderPush: When you delete your account, we clear your installation ID from our database, which prevents us from sending you notifications. However, WonderPush may retain the installation ID and notification history in their systems according to their own data retention policies. To fully remove your data from WonderPush, you may need to contact them directly or uninstall the Application from your device.
Data Retained After Deletion:
- User ID (anonymized identifier)
- Competition participation history
- Game results (for tournament integrity)
- Images you uploaded (for venue galleries)
- Registration records (for historical competition data)
This retention is necessary to maintain the integrity of competition results and tournament brackets.
Temporary Data:
- Verification codes: Deleted after verification or expiration
- Geolocation data: Not stored in database, cleared from localStorage on signout
4.3 Security Measures
We implement industry-standard security measures:
- HTTPS encryption for all data transmission
- Secure cookie management for session handling
- Parameterized database queries to prevent injection attacks
- Image validation (file type, size limits)
- Input validation and sanitization
- Regular security updates
Note: No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
5. Third-Party Services
The Application integrates the following third-party services:
5.1 Vercel (Hosting & Storage)
Purpose: Web hosting, serverless functions, image storage (Vercel Blob)
Data Shared: All application data, uploaded images, user requests
Privacy Policy: https://vercel.com/legal/privacy-policy
Location: United States
5.2 Resend (Email Service)
Purpose: Send verification codes and administrative notifications
Data Shared: Email addresses, verification codes, notification content
Privacy Policy: https://resend.com/legal/privacy-policy
Usage:
- Verification code emails sent to users
- New user notification emails sent to administrators
5.3 Mapbox (Interactive Maps)
Purpose: Display venue locations on interactive maps
Data Shared: Your real-time location (if you grant permission), map interactions, venue coordinates
Privacy Policy: https://www.mapbox.com/legal/privacy
Usage:
- Map rendering and display
- Marker placement for venues and user position
- Map interaction tracking (zoom, pan)
5.4 WonderPush (Push Notification Service)
Purpose: Send push notifications for competition updates and announcements
Data Shared:
- Installation ID (unique device identifier generated by WonderPush)
- Device type (iOS or Android)
- Subscription status (opt-in/opt-out)
- Notification interaction data (opens, clicks)
Privacy Policy: https://www.wonderpush.com/privacy-policy
How It Works:
- When you install the app, the notification service initializes automatically
- A unique installation ID is generated for your device
- The app requests notification permission according to your device’s OS
- Your installation ID is sent to our servers via a cookie
- We can send push notifications to your device
Notification Types:
- Competition reminders (upcoming competitions you registered for)
- Competition results and bracket updates
- Venue announcements (from venues you follow or are registered at)
- System announcements (maintenance, new features)
User Control:
- Opt-out: You can disable notifications from app settings
- OS-level control: You can disable notifications via iOS/Android settings
- Unsubscribe: Deleting your account removes your notification subscription
- Per-notification control: You can dismiss individual notifications
Data Retention by WonderPush:
- WonderPush stores installation IDs and notification history
- Refer to WonderPush Privacy Policy for their data retention practices
- When you delete your account, we clear your installation ID from our database
5.5 Firebase Cloud Messaging (FCM)
Purpose: Deliver push notifications on Android devices (used by WonderPush)
Data Shared:
- Device token for your Android device
- App package identifier
- Message delivery statistics
Privacy Policy: https://firebase.google.com/support/privacy
How It Works:
- WonderPush uses Firebase Cloud Messaging (FCM) for Android push notifications
- When you install the app on Android, FCM generates a device token
- This token is used to send notifications via Google’s FCM infrastructure
Note: FCM is only used on Android devices. iOS uses Apple Push Notification service (APNs).
6. Data Sharing and Disclosure
6.1 Public Information
The following information is visible to other users of the Application:
- Your username (if you choose to set one)
- Your competition participations and results
- Your position in leaderboards and rankings
- Images you upload to venue galleries
- Your team assignments in competitions
6.2 Venue Managers
Venue Managers can see:
- List of users registered for competitions at their venue(s)
- Competition participation and results at their venue(s)
- Images uploaded to their venue(s)
6.3 Administrators
Administrators have access to:
- All user accounts and activity
- All venue data and management functions
- System-wide statistics and reports
6.4 Legal Requirements
We may disclose your information if required by law or in response to:
- Valid legal processes (court orders, subpoenas)
- Requests from law enforcement or government agencies
- Protection of our rights, property, or safety
- Protection of the rights, property, or safety of our users or the public
6.5 Business Transfers
If Shallow Game is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
6.6 No Sale of Data
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
7. Your Rights and Choices
7.1 Access and Correction
You can:
- View your profile information in the Application
- Update your username at any time
- Review your competition history and statistics
- Access your uploaded images
7.2 Data Deletion
Account Deletion:
- Available from the Settings section of the Application
- Also available by contacting hey@shallowgame.com
- Results in permanent deletion of email, username, and personal identifiers
- Some data retained for competition integrity (see Section 4.2)
Image Deletion:
- You can delete images you uploaded
- Managers can delete images from their venue galleries
- Deleted images are permanently removed from Vercel Blob storage
7.3 Geolocation Control
You can:
- Grant or deny location permission via your device settings
- Disable location services for the Application at any time
- Clear localStorage to remove cached location data
- Use the Application without location features (limited functionality)
7.4 Notification Control
Managing Push Notifications:
You have multiple options to control notifications:
Via Application Settings:
- Disable notifications from the app’s settings menu
- This updates your notification preference in our database
Via Device Settings:
iOS:
- Go to Settings > Notifications > Sharks
- Toggle “Allow Notifications” on or off
- Customize notification style, sounds, and badges
Android:
- Go to Settings > Apps > Sharks > Notifications
- Toggle notifications on or off
- Customize notification categories and importance
Complete Removal:
- Delete your account to remove all notification subscriptions from our database
- Uninstall the Application to remove WonderPush data from your device
- For complete data removal from WonderPush servers, contact WonderPush directly at https://www.wonderpush.com/contact
Note: WonderPush SDK initializes automatically when you install the app, but actual push notification delivery requires explicit permission from your device’s operating system (which you grant or deny when prompted).
7.5 Cookie Management
Essential Cookies: The Application requires certain cookies (auth_session, installation_id, notifications) for core functionality. Disabling these cookies will prevent you from using the Application.
Local Storage: You can clear local storage data via your browser settings, but this may log you out and reset application preferences.
7.6 Your GDPR Rights (for EU Users)
Under the General Data Protection Regulation (GDPR), you have the following rights:
Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data (“right to be forgotten”)
Right to Restriction: Request limitation of data processing
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to certain types of data processing
Right to Withdraw Consent: Withdraw consent for data processing at any time
Right to Lodge a Complaint: File a complaint with your supervisory authority (CNIL in France)
To exercise these rights, contact us at hey@shallowgame.com or use the Application’s settings.
8. Children’s Privacy
The Application is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hey@shallowgame.com, and we will delete such information.
9. International Data Transfers
The Application is hosted on Vercel infrastructure, which may process data in the United States and other countries. By using the Application, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.
We ensure that such transfers comply with applicable data protection laws, including GDPR requirements for EU users.
10. Data Processing Legal Basis (GDPR)
We process your personal data under the following legal bases:
Consent:
- Geolocation data collection (explicit OS-level permission)
- Camera access (explicit OS-level permission)
- Push notification delivery (OS-level permission)
Contract Performance:
- Account creation and authentication
- Competition registration and management
- Session management
- Feature delivery
Legitimate Interests:
- Fraud prevention and security
- Application improvement and debugging
- Administrator notifications
- Competition integrity and result tracking
- Push notification infrastructure initialization
Legal Obligations:
- Compliance with applicable laws
- Response to legal requests
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be effective when posted to this page with an updated “Last Updated” date.
Significant changes will be communicated through:
- Notification in the Application
- Email to registered users (if applicable)
- Prominent notice on the website
Your continued use of the Application after changes constitutes acceptance of the updated Privacy Policy.
12. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
Shallow Game 69 rue Belliard 75018 Paris, France
Email: hey@shallowgame.com
Company Registration: RCS Paris 880 718 341
Data Protection Officer: For GDPR-related inquiries, contact hey@shallowgame.com
13. Supervisory Authority
If you are located in the European Union and have concerns about our data practices, you have the right to lodge a complaint with your local supervisory authority:
France: Commission Nationale de l’Informatique et des Libertés (CNIL) Website: https://www.cnil.fr/ Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
14. Additional Information
13.1 Automated Decision-Making
The Application uses automated algorithms for:
- Tournament bracket generation (random draw from registered users)
- Team composition (for doubles competitions with random teams)
- Leaderboard calculations (based on game results)
These automated processes do not involve profiling or have legal/significant effects on users beyond the context of the casual pool competition.
13.2 Data Accuracy
You are responsible for ensuring the accuracy of information you provide. We rely on you to keep your email address and username current. You can update your username at any time through the Application.
13.3 Security Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will:
- Notify affected users without undue delay
- Report the breach to supervisory authorities as required by law
- Take immediate steps to mitigate the impact
13.4 Do Not Track
Some browsers support “Do Not Track” signals. The Application does not currently respond to Do Not Track signals, as we do not track users across third-party websites.
Thank you for trusting SHARKS with your information. We are committed to protecting your privacy and providing a secure, enjoyable experience.

