Important: This privacy policy applies to galamento.com and everything on it: the website, every season page and video share link, and the emails we send.
In short
Galamento is run by Tech Ale OÜ, a company registered in Estonia. We are the controller of the personal data described in this policy. The full privacy policy follows this summary; if anything is unclear, email support@galamento.com.
- Children are recorded by first name only. An organiser adds each child's first name (with an initial if two match), an optional jersey number and whether the child has photo consent. We never store surnames or dates of birth, and children do not use Galamento themselves: every organiser, parent and supporter confirms on screen that they are 18 or older, and we keep only the time they did (on the organiser's account, or on the parent's phone record for that season).
- No face recognition, ever. We never use face recognition, face detection or face embeddings. Children are matched to photos by the tags parents add and the numbers printed on their kit.
- Location is removed on the phone. GPS and other location details are stripped from every photo on the uploader's device, before upload.
- Private by default. A season opens only with its long, random link (and its PIN, if the organiser sets one). Seasons never appear in search engines or a public gallery.
- No photo consent means never shown. A child marked "no photo consent" never appears in any video, and their photos are hidden from other families.
- AI checks quality and safety only. Each photo is checked automatically for quality, printed jersey numbers and content that is inappropriate in a youth sports setting. The check is never asked who is in a photo or to guess anyone's age, gender or ethnicity, and it runs on our hosting provider's infrastructure (Cloudflare Workers AI). Every photo added is checked: there is no way to turn the check off for some photos, so if you would rather a photo was not checked, don't add it. You can delete any photo you added at any time.
- Kept only as long as the plan says. A season's photos, videos and roster are deleted 90 days after the season closes on Free, 12 months on Team and 3 years on Team Plus and Club seasons, or sooner if the organiser deletes the season. The organiser gets an email 14 days before. Parents can delete their own photos at any time. When a season is deleted we keep only anonymous totals, and deleted details leave our database backups within 30 days.
- Everything else has a limit too. An organiser's account is kept until they delete it on the Account page. Purchase records (plan, amount, currency, date and Paddle's transaction number, without names or email addresses) are kept for 7 years after the end of the year of purchase, as Estonian accounting law requires; Paddle keeps its own records. Anonymous usage statistics are kept for up to a year, error reports and security logs for up to 30 days, support emails for up to 12 months after the question is resolved, and the record of the service emails we sent until the account is deleted.
- A random identifier for the phone, not for tracking. On the season page a cookie holds a random value that recognises the parent's phone for that season. It is not used to track anyone and is never sent to our analytics or error reporting.
- News emails only if you ask. A box that says "Receive news from Galamento" is never ticked for you and is never needed to use Galamento. If you tick it, we keep only your email address, your choice (when, on which screen and the wording you saw) and your language, and send occasional news about new features and next season. We never use children's names, photos or tags for this, nor anything from Paddle or Google. Parents' boxes count only after they confirm their address by email. Every news email has a one-click unsubscribe link, and an organiser can untick the box on the Account page; after that we keep only the record not to email you.
- Payments are handled by Paddle. Paddle, our reseller and merchant of record, collects payment details, not us, under its own privacy notice.
- No advertising, no tracking pixels, no sale of personal data. We share personal data only with the companies that run Galamento for us (Cloudflare, Amazon Web Services, Google for "Continue with Google", PostHog, Sentry and Resend) and with Paddle for payments. We never sell it or share it for targeted advertising. The providers are listed on the sub-processors page.
- If something goes wrong. If personal data is ever exposed, we tell the data protection authority and, when it puts you at risk, we tell you, as the law requires. The software that runs in your browser is listed in the open-source notices.