AllProspects Privacy Policy
Last updated: 22 October 2026
This policy explains what personal data AllProspects uses, why, who receives it, how long we keep it and what rights you have. It covers the AllProspects app for iPhone and Android, the website allprospects.app, the shop page shop.allprospects.app and the "Support us" subscription.
1. Who is responsible
AllProspects is published by Marwan Aliou Diallo, entrepreneur individuel (sole trader), trading as AllProspects, registered in Paris (SIREN 131 188 641, RCS Paris), 74 rue de Gergovie, 75014 Paris, France. He is the data controller.
Contact for anything about your data: hello@allprospects.app (write "Privacy" in the subject). We answer in English or French.
2. The short version
- We use your data to run a basketball social network: your account, your profile, what you post, your messages, events, leagues and The Run.
- We don't sell your data. There is no advertising in AllProspects and no tracking across other apps or websites.
- Your data is stored in the European Union (Paris).
- You must be 13 or older. Accounts of people aged 13 to 17 get stricter settings (section 9).
- You can delete your account in the app at any time: Settings › Privacy and safety › Delete account.
3. The data we use
| Category | What | Where it comes from | Required? |
|---|---|---|---|
| Account | Email address, password (stored hashed by our sign-in provider), role (fan, athlete, coach, scout, club, school, brand…), country (and state, in the United States), year and month of birth (we never keep the day), the date you accepted our Terms | You | Yes |
| Sign in with Apple or Google | The email address and name that Apple or Google give us when you choose that option | Apple or Google, at your request | Only if you use it |
| Profile | Name shown on your profile, photo, cover, bio, sport, position, team, height, weight and other profile facts you choose to fill in, links, career path (Journey), recruiting status, the city you put on your profile | You | Name and role only |
| Content | Posts, Plays (videos), photos, audio, captions, comments, Stories, events, leagues and game scores, Pronostics, polls, the place you attach to a post or an event (a court or a city), people you tag | You | No |
| Interactions | Follows, reactions, saves, shares, event and league participation, Fan ID choices, Run points, stickers and streaks | You | No |
| Messages | Private and group messages, photos, videos, voice messages, documents and stickers you send | You and the people you talk to | No |
| Location | The centre of the city on your profile (rounded to about 1 km). When you use the map, "Near me", the court picker or a game check-in of The Run, your phone's position is used at that moment and not stored (section 6) | You, your phone | No |
| Usage | What you view, play, skip or mark "Not interested" in feeds, the profiles you open, when you were last active (you can hide it), your time zone | Our systems | Yes |
| Device | A push notification token, the type and system version of your phone, an installation identifier used to deliver app updates | Your phone | Yes for notifications and updates |
| Diagnostics | Crash reports and the reports you send with "Give feedback / Report a problem" | Your phone, you | No |
| Safety | Reports you make or receive, blocks, moderation decisions | You, other members, our team | Yes |
| Support us | Your supporter status, the amount, the dates of your subscription, your email for receipts. Your card or wallet details go to Stripe, never to us. If the app opened our payment page through Apple's or Google's link programme, the transaction reference we must report to them (no personal details) | You, Stripe | Only if you subscribe |
| Website | Email address if you join our mailing list, what you write in our report or account-deletion forms | You | No |
We don't ask for an identity document, a phone number or your school records.
Information about other people. Our directory of professional clubs and players helps you type a team or a player's name. It contains public information (name, nationality, year of birth, club) taken from Wikidata, and cities from GeoNames. A professional player who doesn't want to appear can write to us and we remove them.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (EU and UK GDPR) |
|---|---|
| Create and secure your account, show your profile, publish your content, deliver your messages, run events, leagues, Pronostics and The Run, send the notifications you allow | Performance of our contract with you (the Terms) |
| Check your age, apply the protective settings for people aged 13 to 17, close sign-up where the law requires it | Legal obligation and legitimate interest in protecting minors |
| Show you the map, "Near me", nearby events and courts, distances | Performance of the contract (you asked for the feature); your phone asks your permission first |
| Order and recommend content (section 7) | Legitimate interest in showing you relevant basketball content |
| Keep the service safe: reports, blocks, moderation, fraud and spam prevention, enforcing our rules | Legitimate interest; legal obligations (EU Digital Services Act) |
| Fix crashes and bugs | Legitimate interest in a working app |
| Charge and manage a "Support us" subscription, send receipts, keep accounting records, report link-out sales to Apple or Google where their rules require it | Contract; legal obligation (accounting) |
| Send our newsletter (website) | Your consent, which you can withdraw in one click |
| Answer the authorities and keep evidence when the law requires it | Legal obligation |
When we rely on legitimate interest, you can object (section 11).
5. Who can see your data
- Everyone, including people without an account: your profile (name, photo, role, country, city, bio, the profile facts you filled in), your public posts and Plays, comments under public posts, your career path, your public events and leagues, your Run level and points, your public follows. Content can be shared by link. Accounts aged 13 to 17 are limited (section 9).
- Your followers only, or only you: posts for which you chose that audience.
- The people in a conversation: the messages of that conversation.
- Our team: only what is needed to handle a report, a request or a technical problem. Access is limited and logged.
- Our service providers (section 8), only to provide their service to us.
- Authorities: when the law requires it, to report a threat to someone's life or safety, or to report child sexual abuse material.
Push notifications can show the sender's name and the beginning of a message or comment. To deliver them, this text passes through Expo and then Apple (iPhone) or Google (Android). You choose which notifications you get in Settings › Notifications, and your phone's settings control what shows on the lock screen.
6. Location
- Your city. The city you put on your profile is turned into map coordinates by your phone's system service (Apple or Google). We keep the centre of the city, rounded to about 1 km. If "Show in Discover" is on, you can appear on the map at that city.
- Your phone's position. It is read only when you use a feature that needs it and you have allowed location access, only while you use the app, never in the background. The map, "Near me" and nearby events use it on your phone. The court picker sends the server an area of about 3 km around you to list the courts in it. A game check-in of The Run sends your position once to check that you are at the court or event; we don't keep it. We keep the court or event and its distance from your city, to count your trips.
- Places on posts and events. The court or city you choose is shown with the post or the event to everyone who can see it.
- Photos. We remove the location data stored inside photos before upload. Video files are stored as you upload them: if your camera saves the location in videos, turn that option off in your phone's camera settings.
7. How we order content
We order feeds and suggestions with simple rules: freshness, accounts you follow, what you engaged with, the quality of a post and the discovery of new athletes and countries. To do this, we use what you view, play, skip and like, and keep a summary of your interests that is updated as you use the app.
- On a post, "Why you're seeing this post" explains the main reason, and "Not interested" shows you less of that kind of content.
- Paying (Support us or anything else) never changes how content is ranked.
- An account aged 13 to 17 is not suggested to adults it isn't connected with, and adults reported or blocked by minors are not suggested to minors.
- No decision with legal or similarly significant effects on you is made automatically.
Detailed viewing events are erased after 90 days.
8. Our service providers and international transfers
| Provider | What it does for us | Where the data is |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, sign-in, file storage, server functions | European Union (Paris, France) |
| Expo (650 Industries, Inc.) | Delivers push notifications and app updates | United States |
| Apple and Google | Push notification delivery (Apple Push Notification service, Firebase Cloud Messaging), Sign in with Apple and Google, maps and address lookup on your phone | Under their own privacy policies, worldwide |
| Sentry (Functional Software, Inc.) | Crash reports and the feedback you send | European Union (Germany) |
| Cloudflare, Inc. | Hosting of the website and of its database, email routing, protection against attacks | Worldwide network |
| Resend | Sends our emails (sign-up confirmation, password reset, replies) | United States |
| Google (Gmail) | Mailbox of hello@allprospects.app | Worldwide |
| Brevo (Sendinblue SAS) | Website mailing list | European Union |
| Stripe Payments Europe, Ltd. | Payment of the "Support us" subscription. Stripe is also responsible for its own fraud-prevention and legal checks | European Union and United States |
| Fourthwall, Inc. | Sells and ships the products of shop.allprospects.app. When you buy, Fourthwall is the seller and its privacy policy applies. The shop page loads product pictures from Fourthwall's servers | United States |
The app also loads a few illustration pictures from Pexels and Wikimedia, and the website map uses OpenFreeMap tiles: these services see your device's IP address when the picture or tile loads. Sports results come from BALLDONTLIE and football-data.org; we send them no personal data.
When a provider outside the European Economic Area receives personal data, the transfer is covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework when the provider is certified. You can ask us for a copy of these safeguards.
We never sell or rent your personal data, and we don't share it with advertisers or data brokers.
9. Children and teenagers
- You must be at least 13 to use AllProspects. We ask everyone for their month and year of birth. Under 13, sign-up is refused and the date is not kept. If we learn that an account belongs to a child under 13, we delete it. In Australia and Brazil, AllProspects is not available at this time. In the United States, we ask for your state: residents of Mississippi can't create an account at this time, nor residents of Florida, Georgia and Tennessee under 18. Where Apple or Google give us an age range or a parent's approval for your account (for example in Texas), we use it only to apply these rules.
- If you are under 18, ask a parent or guardian before you join, and use AllProspects with their agreement where the law of your country requires it.
Accounts of people aged 13 to 17 have these rules:
- An adult can send them a first message only if they follow that adult or have already written to them. This also applies to group invitations and league invitations.
- They are not shown to adults they aren't connected with: not in search, Discover, suggestions, follower lists or the map. "Connected" means you follow each other, you play on the same league team, the minor wrote to you in a conversation, or the minor joined through your invitation. Following a minor is not enough.
- "Show in Discover" is off by default.
- Their age is shown only to them and to people they are connected with.
- They can't attach a place to their posts or events.
- No paid features, no payouts, no "Support us" subscription.
- Mentoring and services offered "on request" are hidden from them.
A parent or guardian can write to hello@allprospects.app to ask for access to or deletion of their child's data. A teenager can delete their own account at any time, without asking anyone.
10. How long we keep data
| Data | How long |
|---|---|
| Your account and profile | As long as your account exists |
| Content and messages | Until you delete them or your account. When you delete your account, the messages you sent are erased for everyone |
| An account you ask to delete | Hidden at once, erased 30 days later (time to change your mind by signing in). Backup copies are overwritten within 30 days after that |
| Detailed viewing events | 90 days. "Not interested" choices: until you undo them |
| Your summary of interests | Updated continuously, erased with your account |
| Notifications | 12 months |
| Stories | Visible 24 hours, erased from our servers 30 days later |
| Push tokens | Until you sign out, the app is uninstalled or you delete your account |
| Crash reports | 90 days |
| Reports and moderation decisions | 1 year after the case is closed, longer if legal proceedings require it. A report you filed is kept, without your name, after you delete your account |
| Evidence of serious offences, including child sexual abuse material | Stored without copying, with very restricted access, for 1 year after it is reported to the authorities, longer if an authority asks |
| Identifier of a banned account (a coded fingerprint of its email) | For the duration of the ban |
| "Support us" payment records | 10 years, as French accounting law requires (kept by Stripe and in our accounts; your supporter status in the app is erased with your account) |
| Website mailing list | Until you unsubscribe; proof of your consent 3 years after that |
| Website report and deletion forms | 1 year after we handled them |
| Server logs | A few days to 30 days, depending on the provider |
11. Your rights
You can ask to access your data, correct it, delete it, restrict its use, object to its use based on legitimate interest, receive it in a portable format (portability) and withdraw your consent at any time. You can also give instructions about what happens to your data after your death (France).
- Most of it you can do yourself: edit your profile, delete posts, change your privacy settings, delete your account (Settings › Privacy and safety › Delete account, or at allprospects.app/delete-account).
- For anything else, including a copy of your data, write to hello@allprospects.app. We may ask you to confirm the request from the email address of your account. We answer within one month; for complex requests this can be extended by two more months, and we tell you why.
Complaints. You can complain to the data protection authority where you live or work, or where you think a breach happened. In France: CNIL, www.cnil.fr. In the UK: ICO, ico.org.uk.
California and other US states. We don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics. Residents of every US state can use the rights above, and you won't be treated differently for using them. You may use an authorised agent.
Canada. You can access and correct your personal information, and complain to the Office of the Privacy Commissioner of Canada.
Africa. You can also contact your national authority: Senegal: Commission de Protection des Données Personnelles (CDP); Côte d'Ivoire: ARTCI; Morocco: CNDP; Mali: APDP; Nigeria: Nigeria Data Protection Commission; Ghana: Data Protection Commission; Kenya: Office of the Data Protection Commissioner; South Africa: Information Regulator.
12. Cookies and similar technologies
The app stores on your phone only what it needs to work: your session, your saved accounts, your settings, drafts and some data kept for speed. It doesn't use advertising identifiers or tracking technologies, and doesn't ask for App Tracking Transparency.
The website and the shop page use only what is strictly necessary or what you ask for: your light or dark theme (a cookie kept 1 year), whether you closed the language banner, your shop bag and, if you sign in on the shop page, your session. They contain no advertising or social-media trackers. Visit statistics, if any, come from Cloudflare Web Analytics, which sets no cookie and keeps no personal profile. That is why we don't show a cookie banner.
13. Security
Data is encrypted in transit (HTTPS) and at rest by our host. Access rules are enforced inside the database, so each person can only read what they are allowed to see. Secret keys are never in the app. Our team's access is limited and logged. If a data breach creates a risk for you, we notify the competent authority within 72 hours and tell you when the risk is high.
14. Changes
When we change this policy in an important way, we tell you in the app before the change takes effect. The date at the top shows the latest version. Earlier versions are available on request.