SPOLLOW privacy notice

Editorial date: 12 October 2026

Version 1.1 · Published October 17, 2026 · Effective from October 17, 2026

1. Controller

The controller for the processing by SPOLLOW described here is:

Felix Köhler, trading as needbuilt.
Sydneystraße 18, 22297 Hamburg, Germany
Privacy enquiries: privacy@needbuilt.de
Telephone: +49 1567 9527184

This notice covers SPOLLOW for Android and access to its legal documents. Independent services such as Google Play, your chosen calendar or email app and other websites also have their own privacy notices.

2. A short explanation — including for children and parents

SPOLLOW shows football fixtures and can display them on your home screen. You do not need a separate SPOLLOW account. Your selected clubs and widget settings remain in the app on your device. To obtain current fixtures, the app connects to a data provider, which can see information including your internet connection's IP address.

The app does not request your GPS location. Weather information concerns the match venue or an expressly labelled home stadium.

If you email us, we receive your message and email address. Please do not send passwords or personal information unnecessary for your question. Children can ask a trusted adult for help. Purchases should be discussed with parents or guardians. Even if you buy nothing, the app may connect to RevenueCat. The purchase service then receives an app identifier and technical information. Section 8 explains this.

3. Local app data

SPOLLOW stores information on your device including selected clubs, widget assignments and display settings, language, appearance, setup status, reminder rules, locally confirmed purchase entitlements and, where applicable, calendar links. Fixture data, private settings and weather data are processed separately.

SPOLLOW has no own user account, no own cloud synchronisation of these settings and no advertising. The app does not create its own advertising profiles or send these private settings as a user profile to an own SPOLLOW server. Technical connections to data and purchase services are described separately below.

Local data serves the functions you use. Where personal data is processed under our responsibility, this provides the requested service under Article 6(1)(b) GDPR. Technically necessary storage on or access to your device is also governed by section 25(2), no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act. Unnecessary access would require separate consent; this notice is not consent.

The app excludes its private data areas from Android cloud backup and the intended Android device transfer. Exported data and copies in other apps are outside this exclusion.

4. Current fixtures — OpenLigaDB

SPOLLOW retrieves fixture data directly from OpenLigaDB through an encrypted connection. Requests concern competitions and seasons; your private club selection is not sent as a separate user profile. However, the competitions requested can depend on the fixtures needed for your selection.

The provider technically receives information including IP address, request time, requested path, response status and connection details. OpenLigaDB states a general retention period of 30 days for server logs; security incidents may require longer retention. See its privacy notice (https://www.openligadb.de/Privacy).

Retrieval displays and updates the requested fixtures, under Article 6(1)(b) GDPR. The provider's server logging under its own responsibility is separate.

The free sports data export contains the stored, adapted sports dataset and its source and licence notices. It contains no private widget settings, purchase data, calendar links or reminders managed by SPOLLOW.

5. Weather and venues

When you expressly open an available weather function, SPOLLOW downloads a Deutscher Wetterdienst forecast file for the assigned forecast point. This requires the corresponding Lifetime entitlement. There are no automatic background weather requests.

The request specifies a weather station, not your GPS location. The service technically sees your IP address and connection data. According to the DWD Open Data information (https://opendata.dwd.de/README.txt), DWD retains IP addresses for server operation and security for at most seven days.

Selection relates to the stated venue or an additional assignment labelled as a home stadium. Additional stadium data from Wikidata is already bundled with the app; the app does not query Wikidata online for this.

The weather request provides your requested function under Article 6(1)(b) GDPR. Forecasts are cached locally and replaced by subsequent requests. The six hours after which data is considered no longer fresh are not an automatic deletion period.

6. Calendars, reminders, navigation and sharing

One-off calendar entry: At your request, SPOLLOW opens a pre-filled event in your chosen calendar app, passing information such as fixture, competition, time and venue. This one-off transfer requires no calendar read access.

Ongoing calendar maintenance: Activating this Lifetime function requires Android calendar read and write permissions. The app reads the selectable writable calendars and the events it has linked, to create and update them. This includes calendar/event IDs, title, description, location, time, time zone and modification or deletion states. Links are stored locally. Your other appointments are not generally analysed.

You can disconnect and revoke permissions in Android. Events already created in the external calendar are not automatically deleted. If your calendar uses cloud synchronisation, its provider may process entries independently of SPOLLOW.

Reminders: SPOLLOW schedules reminders locally. Depending on the Android version, notification permission and special system access for exact alarms are needed for the most precise timing. Without notification permission, SPOLLOW cannot display match notifications. Without separate exact-alarm access, permitted reminders may be less precisely timed. There is no own SPOLLOW server for advertising push messages.

Navigation and sharing: Only your respective action transfers match text or a venue's name and coordinates to your chosen other app. Its provider determines further processing.

These operations provide the requested functions under Article 6(1)(b) GDPR. An Android permission is technical authorisation; it does not automatically replace any legally required data protection consent.

7. Email and telephone support

Contact us at spollow@needbuilt.de. The app first creates an editable email draft. We receive the message only when you send it in your email app.

Even with extended diagnostics switched off, the draft contains basic technical details: app version, build/package information, Android version, device manufacturer and model. You can review and change it before sending.

Extended diagnostics is initially off. If you enable it, you can inspect the diagnostic block before sending. It contains limited technical states, such as language, launcher, widget count and size classes, data freshness and purchase verification, weather, reminder, calendar and legal connection status. It does not automatically attach complete calendar contents, passwords, purchase tokens or arbitrary log files. Free text may of course contain information you enter yourself.

Large local drafts may temporarily remain in the app cache. Outdated draft files are cleaned up when you next open the support screen after more than 24 hours. Copies in the clipboard or email app follow their own storage rules.

We process your email address, message, voluntarily supplied information and necessary handling notes to answer your enquiry. The basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters, otherwise Article 6(1)(f) GDPR. Our legitimate interest is answering incoming questions and correcting faults. Please do not send unnecessary sensitive information.

Our mailbox uses Zoho Mail's EU environment. For telephone contact, we use information including your number, the time and conversation content to handle your enquiry; sipgate provides the telephone connection. Providers also process their own operational and security data. See Zoho privacy (https://www.zoho.com/de/privacy.html) and sipgate privacy (https://www.sipgate.de/datenschutz).

SPOLLOW support is handled personally. We do not use original messages or their attachments for capture, summarisation or preparing replies through generative AI. General reply templates may be created with AI if no personal support content is transmitted.

Ordinary support cases are generally deleted no later than twelve months after closure. If particular information is still needed for outstanding claims or statutory retention, we retain only the necessary information for longer.

8. Google Play and the planned RevenueCat purchase service

Google Play processes installation, updates, the store account and payments under its own terms and privacy notice (https://policies.google.com/privacy). This does not automatically give SPOLLOW your password or complete credit card or bank details.

For the planned Lifetime unlock, SPOLLOW uses Google Play Billing and RevenueCat, Inc. to display offers and verify, assign and restore purchases. No separate SPOLLOW registration is planned.

RevenueCat is activated when the Lifetime offer is reached during setup and at regular subsequent app starts. This can also affect free users; the service does not start exclusively after a purchase.

RevenueCat generates a pseudonymous app user identifier. “Pseudonymous” means it is not your real name; it does not mean the data is anonymous. Depending on use, processing includes this identifier, IP address, technical app, operating system and device information, and product, transaction, purchase and entitlement information including necessary store purchase evidence. SPOLLOW passes no own email, telephone or advertising profile attributes to RevenueCat.

Processing a purchase you request and managing acquired rights serve Article 6(1)(b) GDPR. Legally required retention of supporting records is based on Article 6(1)(c) GDPR.

RevenueCat also describes analysing purchases within its service. SPOLLOW has no additional general advertising or usage analytics tool. This does not guarantee that purchase and store providers process no operational or analytical data.

Purchase assignment may be needed for the entitlement's duration to restore the one-off unlock. Uninstalling the app does not automatically delete such external purchase records. Contact privacy@needbuilt.de about data under our responsibility. We establish the necessary assignment with as little information as possible; do not send passwords or secret purchase tokens. Deletion may make future automatic restoration harder but does not itself remove existing statutory rights.

9. Google Play reviews, recipients and international processing

SPOLLOW stores a few local usage states to time occasional review requests: setup, days of use, data updates and times of previous requests or support actions. These counters are not sent to an own SPOLLOW server. When the Google Play review function opens, Google processes what you enter under its privacy notice. SPOLLOW receives no individual star rating or review from this function. Local timing serves our interest in reasonably infrequent review requests; any relevant processing of personal data is based on Article 6(1)(f) GDPR. You do not have to submit a review.

Recipients needed for each function are identified above: data providers, Google Play, the purchase service, our email/telephone services and other apps you choose. Section 10 describes hosting.

Providers processing data on our behalf follow our instructions and the applicable data protection agreements. Providers' processing under their own responsibility, especially the store's, is separate.

RevenueCat and Cloudflare may process data, particularly in the USA and through further subprocessors. Their data protection agreements provide, in particular, EU Standard Contractual Clauses for relevant transfers to third countries. Depending on the actual circumstances, suitable adequacy decisions may also apply. We do not promise exclusively European processing. You can request information and a copy of the safeguards actually applied to your data.

RevenueCat DPA (https://www.revenuecat.com/dpa) · Cloudflare DPA (https://www.cloudflare.com/cloudflare-customer-dpa/)

10. Accessing legal documents on needbuilt.de (https://needbuilt.de)

The planned legal connection retrieves a version overview over HTTPS; document pages open in your browser. The web server technically receives information including IP address, time, requested address and connection/browser details. The app request does not add club selection, purchase identifier or consent decision as a user profile.

needbuilt.de (https://needbuilt.de) uses Cloudflare to deliver and protect the website. Processing delivers requested content and detects technical faults and attacks. The basis is Article 6(1)(f) GDPR; our interest is a secure, accessible website. Article 6(1)(b) GDPR also applies where delivery is necessary for contractual information.

The rest of the website also has its own privacy notice (https://needbuilt.de/datenschutz/). The app stores locally, for example, the last known version overview with document references and your legal decisions. This does not automatically store complete website documents offline in the app. Merely reading a privacy notice is not treated as consent.

11. Retention and deletion

Local settings and data generally remain until you reset them through available functions, clear app data in Android or uninstall the app. Updated datasets may replace earlier ones sooner. No general automatic 72-hour deletion is promised for local reminder and diagnostic states.

Uninstalling does not automatically delete emails, exported files, external calendar entries or Google Play/RevenueCat data. Disconnecting a calendar stops further maintenance but does not remove existing external events.

Statutory retention applies only to the relevant records: generally eight years for accounting vouchers, ten for books and certain closing records, and six for business correspondence subject to retention. The start, extensions and exceptions follow applicable law. Not every support message becomes an accounting voucher.

12. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future; earlier lawful processing is unaffected.

For processing based on legitimate interests, you may object on grounds relating to your particular situation. We assess objections under Article 21 GDPR. You could object to direct marketing at any time without giving reasons; SPOLLOW currently conducts no own direct marketing.

Contact privacy@needbuilt.de. We generally answer privacy requests within one month; legally permitted extensions are explained. Identity checks take place only where necessary and with minimal information. We do not require an identity-document copy as a precaution.

You may complain to a data protection supervisory authority, particularly where you live or work or where the suspected infringement occurred. For our registered location, the competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de/).

SPOLLOW makes no own solely automated decisions with legal or similarly significant effects within Article 22 GDPR. This does not describe Google's independent fraud or payment checks.

13. Changes

We update this information when relevant functions, recipients or legal requirements change. If new processing requires consent, changing this notice alone is insufficient. Notices and necessary approvals must precede the relevant processing in the respective user flow.