Privacy Policy

Last updated: October 21, 2026

And One ("we", "us") is operated by Kevin Bourdeau and available at https://and-one.app. This policy explains what personal data we collect, why we collect it, and the rights you have over it. For any privacy question, contact us at contact@and-one.app.

Data we collect

When you create an account, we collect your email address. If you sign in with Google, we receive the basic profile information Google shares with us, namely your email address, name, and profile picture. We do not receive or store your Google password, and we request no access to any other Google service.

Within the app, we store the preferences you set: the team and players you follow, and the date you completed onboarding. Before you create an account, an anonymous identifier is stored in a cookie so your preferences survive between visits. We also process technical data sent automatically by your browser, such as IP address and user agent, which our hosting provider uses to serve the site and protect it from abuse.

If you subscribe to a paid plan, your payment is handled by Paddle.com, which acts as the merchant of record for the transaction. We never receive or store your full payment card details. Paddle shares with us only the information needed to manage your subscription: your email address, your subscription status, and your billing country, which we need for tax purposes.

Why we use it, and our legal basis

We use this data solely to operate the service: to authenticate your account, to personalize your feed around the teams and players you follow, and to send account-related emails such as sign-up confirmation and password resets. Under the GDPR, our legal basis is the performance of the contract you enter into when you create an account, and our legitimate interest in keeping the service secure and functional. We do not use your data for advertising, and we do not make automated decisions that produce legal effects concerning you.

Cookies

We use strictly necessary cookies only: session cookies that keep you signed in, and a preferences cookie that remembers your team. We do not use advertising cookies, third-party trackers, or cross-site analytics. Because these cookies are essential to deliver a service you have requested, they do not require consent under EU rules, but you can clear them at any time from your browser settings.

Sharing and service providers

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We rely on a small number of processors who handle data on our behalf: Vercel hosts the application, Supabase stores account data and handles authentication, and Upstash provides caching that keeps the service fast. Paddle.com processes payments, taxes, invoices, and refunds as our merchant of record. Google processes your sign-in if you choose that method. We may disclose data where required by law or to protect our rights.

International transfers

Our providers may store or process data outside the European Economic Area, including in the United States. Such transfers are covered by the standard contractual clauses and equivalent safeguards set out in those providers' data processing agreements.

Retention

We keep your account data for as long as your account remains active. When you delete your account, the associated data is deleted. Anonymous preference cookies expire one year after they are set.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. You may withdraw consent where processing is based on consent, and you may lodge a complaint with your national supervisory authority, such as the CNIL in France.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request its deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of. We will never discriminate against you for exercising any of these rights.

You can delete your account and all associated data directly from your profile page. For any other request, email contact@and-one.app and we will respond within thirty days.

Children

And One is not directed to children under 13, and we do not knowingly collect personal information from them. Users in the European Economic Area must be at least 16, or have the consent of a parent or guardian where local law sets a lower age. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

Data is transmitted over encrypted connections and stored with our providers under their security controls. No system is perfectly secure, but we take reasonable measures to protect your information and will notify you and the relevant authorities of a breach where the law requires it.

Changes to this policy

We may update this policy as the service evolves. The date at the top of this page reflects the latest revision, and material changes will be communicated by email or in the app.