SPOLLOW privacy notice

Editorial date: 31 October 2026

Version 1.4 · Published October 31, 2026 · Effective from October 31, 2026

1. Controller

The controller for the processing by SPOLLOW described here is:

Felix Köhler, trading as needbuilt.
Sydneystraße 18, 22297 Hamburg, Germany
Privacy enquiries: privacy@needbuilt.de
Telephone: +49 1567 9527184

This notice covers SPOLLOW for Android and access to its legal documents. Independent services such as Google Play, your chosen calendar or email app and other websites also have their own privacy notices.

2. A short explanation

SPOLLOW shows football fixtures and can display them on your home screen. You do not need a separate SPOLLOW account. Your selected clubs and widget settings remain in the app on your device. To obtain current fixtures, the app connects to a data provider, which can see information including your internet connection's IP address.

The app does not request your GPS location. Weather information concerns the match venue or an expressly labelled home stadium.

SPOLLOW is intended for football fans aged 16 and over: older teenagers and adults. It has no own age check, parent area or technical age restriction. Any legally required consent from a minor’s legal representatives remains necessary.

If you email us, we receive your message and email address. Do not send passwords or unnecessary personal information. Send privacy requests to privacy@needbuilt.de; no SPOLLOW account or special form is required.

In the intended purchase version from 1.0.0-beta.3 (code 8), Basic does not start RevenueCat without a purchase or reconciliation reason. The service starts when you explicitly load the Lifetime offer or restore purchases. Existing ownership and unresolved purchases may be checked later. Loading an offer without buying may create a pseudonymous record. Section 8 of the privacy notice explains purchase management, technical data and limited purchase analytics. Older internal test versions may connect when opening the offer or on later launches.

3. Local app data

SPOLLOW stores information on your device including selected clubs, widget assignments and display settings, language, appearance, setup status, reminder rules, locally confirmed purchase entitlements and, where applicable, calendar links. Fixture data, private settings and weather data are processed separately.

SPOLLOW has no own user account, no own cloud synchronisation of these settings and no advertising. The app does not create its own advertising profiles or send these private settings as a user profile to an own SPOLLOW server. Technical connections to data and purchase services are described separately below.

Local data serves the functions you use. Where personal data is processed under our responsibility, this provides the requested service under Article 6(1)(b) GDPR. Technically necessary storage on or access to your device is also governed by section 25(2), no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act. Unnecessary access would require separate consent; this notice is not consent.

The app excludes its private data areas from Android cloud backup and the intended Android device transfer. Exported data and copies in other apps are outside this exclusion.

4. Current fixtures — OpenLigaDB

SPOLLOW retrieves fixture data directly from OpenLigaDB through an encrypted connection. Requests concern competitions and seasons; your private club selection is not sent as a separate user profile. However, the competitions requested can depend on the fixtures needed for your selection.

The provider technically receives information including IP address, request time, requested path, response status and connection details. OpenLigaDB states a general retention period of 30 days for server logs; security incidents may require longer retention. See its privacy notice (https://www.openligadb.de/Privacy).

Retrieval displays and updates the requested fixtures, under Article 6(1)(b) GDPR. The provider's server logging under its own responsibility is separate.

The free sports data export contains the stored, adapted sports dataset and its source and licence notices. It contains no private widget settings, purchase data, calendar links or reminders managed by SPOLLOW.

5. Weather and venues

When you expressly open an available weather function, SPOLLOW downloads a Deutscher Wetterdienst forecast file for the assigned forecast point. This requires the corresponding Lifetime entitlement. There are no automatic background weather requests.

The request specifies a weather station, not your GPS location. The service technically sees your IP address and connection data. According to the DWD Open Data information (https://opendata.dwd.de/README.txt), DWD retains IP addresses for server operation and security for at most seven days.

Selection relates to the stated venue or an additional assignment labelled as a home stadium. Additional stadium data from Wikidata is already bundled with the app; the app does not query Wikidata online for this.

The weather request provides your requested function under Article 6(1)(b) GDPR. Forecasts are cached locally and replaced by subsequent requests. The six hours after which data is considered no longer fresh are not an automatic deletion period.

6. Calendars, reminders, navigation and sharing

One-off calendar entry: At your request, SPOLLOW opens a pre-filled event in your chosen calendar app, passing information such as fixture, competition, time and venue. This one-off transfer requires no calendar read access.

Ongoing calendar maintenance: Activating this Lifetime function requires Android calendar read and write permissions. The app reads the selectable writable calendars and the events it has linked, to create and update them. This includes calendar/event IDs, title, description, location, time, time zone and modification or deletion states. Links are stored locally. Your other appointments are not generally analysed.

You can disconnect and revoke permissions in Android. When disconnecting in SPOLLOW, choose whether linked entries should be kept or removed. Only unchanged SPOLLOW entries that can still be clearly linked are removed; manually added entries and entries you have edited are retained. Existing events are not automatically deleted without an explicit deletion choice. If your calendar uses cloud synchronisation, its provider may process entries independently of SPOLLOW.

Reminders: SPOLLOW schedules reminders locally. Depending on the Android version, notification permission and special system access for exact alarms are needed for the most precise timing. Without notification permission, SPOLLOW cannot display match notifications. Without separate exact-alarm access, permitted reminders may be less precisely timed. There is no own SPOLLOW server for advertising push messages.

Navigation and sharing: Only your respective action transfers match text or a venue's name and coordinates to your chosen other app. Its provider determines further processing.

These operations provide the requested functions under Article 6(1)(b) GDPR. An Android permission is technical authorisation; it does not automatically replace any legally required data protection consent.

7. Email and telephone support

Contact us at spollow@needbuilt.de. The app first creates an editable email draft. We receive the message only when you send it in your email app.

Even with extended diagnostics switched off, the draft contains basic technical details: app version, build/package information, Android version, device manufacturer and model. You can review and change it before sending.

Extended diagnostics is initially off. If you enable it, you can inspect the diagnostic block before sending. It contains limited technical states, such as language, launcher, widget count and size classes, data freshness and purchase verification, weather, reminder, calendar and legal connection status. It does not automatically attach complete calendar contents, passwords, purchase tokens or arbitrary log files. Free text may of course contain information you enter yourself.

Large local drafts may temporarily remain in the app cache. Outdated draft files are cleaned up when you next open the support screen after more than 24 hours. Copies in the clipboard or email app follow their own storage rules.

We process your email address, message, voluntary information and necessary handling notes to answer your enquiry. The basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters, otherwise (f) for questions and troubleshooting. Statutory data-protection requests are handled under (c). Please do not send unnecessary sensitive data.

Our mailbox uses Zoho Mail's EU environment. For telephone contact, we use information including your number, the time and conversation content to handle your enquiry; sipgate provides the telephone connection. Providers also process their own operational and security data. See Zoho privacy (https://www.zoho.com/de/privacy.html) and sipgate privacy (https://www.sipgate.de/datenschutz). Storage in the EU does not exclude limited remote access by Zoho from India for support and troubleshooting. Zoho cites intra-group EU Standard Contractual Clauses for this access.

SPOLLOW support is handled personally. We do not use original messages or their attachments for capture, summarisation or preparing replies through generative AI. General reply templates may be created with AI if no personal support content is transmitted.

We manually review simple support cases for deletion no later than 90 days after closure and delete data that is no longer needed. We remove diagnostic attachments sooner once they are no longer required. Information still needed for legal obligations or outstanding claims is kept separately with a documented purpose and retention period. This is not automatic deletion or a 90-day guarantee for the email provider’s backups.

8. Google Play and the planned RevenueCat purchase service

Google Play processes installation, updates, store account and payments under its own terms and privacy notice (https://policies.google.com/privacy). This gives SPOLLOW neither your Google password nor full card or bank details. Lifetime is an optional one-off purchase, not a subscription.

We use RevenueCat, Inc., USA, for offers, purchase processing and acknowledgement, unlocking, ownership checks, restoration and refund/revocation reconciliation. Transmission uses TLS encryption. In the intended purchase version from 1.0.0-beta.3 (code 8), it starts when you explicitly load the offer or restore purchases. Confirmed rights or unresolved purchases may trigger later checks; Basic without such a reason does not start it. Once activated, further connections in the same session are possible. Older internal test versions may connect when opening the offer or on later launches; this notice does not retroactively change their traffic.

RC generates a random pseudonymous App User ID and, where applicable, aliases. This is not anonymous processing or a SPOLLOW account. Data includes purchase history, product/transaction evidence including necessary Google Play purchase tokens, status/dates, price, currency, store country and entitlements; OS, device model/brand, app/SDK version, package and language, and first/last connection times to RC. It sees the request IP and may derive and retain the physical country. This differs from store country and device language. The purchase service does not request GPS location.

SPOLLOW sets no names, emails, phone numbers, Google Advertising IDs or Android IDs as RC attributes. No additional advertising, attribution or general usage-analytics integrations are planned. Private clubs, widget designs, reminder rules and complete calendar contents are not sent to RC as a user profile. Voluntary support is a separate data flow.

Requested offers, purchases and management of acquired rights serve pre-contractual steps or contract performance under Article 6(1)(b) GDPR; legally necessary records use (c). RC also provides purchase/demand and technical assignment statistics. Where we use existing data for limited purchase analysis and troubleshooting, this serves our legitimate interest in reliable purchasing and assessing product demand, (f). This does not cover extra advertising or cross-app profiling. You may object on grounds relating to your particular situation; necessary purchase management and legal obligations are assessed separately. Technically necessary device access follows section 25(2)(2) TDDDG. An Analytics category is not consent. Unnecessary access or other processing requiring consent needs the required separate consent first; reading or clicking purchase does not replace it.

RC processes supplied customer data on our behalf under its DPA; Google’s own store/payment roles are separate. Contracted subprocessors and processing in the USA or other third countries are possible. The DPA provides EU Standard Contractual Clauses for relevant transfers; adequacy decisions apply only to covered cases. We guarantee neither exclusively European processing nor complete freedom from internal AI processing. Details: privacy@needbuilt.de, RC Privacy (https://www.revenuecat.com/privacy), DPA/subprocessors (https://www.revenuecat.com/dpa).

Purchase assignment may be needed to maintain/restore Lifetime, resolve uncertain transactions and meet legal duties. We delete data no longer needed unless a lawful exception applies. RC deletion is asynchronous; active records, logs, archives and backups can have different timelines. We promise neither immediate complete erasure nor a uniform backup deadline. Uninstalling does not automatically erase external records. Contact privacy@needbuilt.de; assignment and exceptions use minimal information. Erasure is not a refund and does not automatically remove legal purchase rights. Later service access/restore may trigger processing and assignment again and affect Lifetime display/restoration.

9. Google Play reviews, recipients and international processing

SPOLLOW stores a few local usage states to time occasional review requests: setup, days of use, data updates and times of previous requests or support actions. These counters are not sent to an own SPOLLOW server. When the Google Play review function opens, Google processes what you enter under its privacy notice. SPOLLOW receives no individual star rating or review from this function. Local timing serves our interest in reasonably infrequent review requests; any relevant processing of personal data is based on Article 6(1)(f) GDPR. You do not have to submit a review.

Recipients needed for each function are identified above: data providers, Google Play, the purchase service, our email/telephone services and other apps you choose. Section 10 describes hosting.

Providers processing data on our behalf follow our instructions and the applicable data protection agreements. Providers' processing under their own responsibility, especially the store's, is separate.

RevenueCat and Cloudflare may process data, particularly in the USA and through further subprocessors. Their data protection agreements provide, in particular, EU Standard Contractual Clauses for relevant transfers to third countries. Depending on the actual circumstances, suitable adequacy decisions may also apply. We do not promise exclusively European processing. You can request information and a copy of the safeguards actually applied to your data.

RevenueCat DPA (https://www.revenuecat.com/dpa) · Cloudflare DPA (https://www.cloudflare.com/cloudflare-customer-dpa/)

10. Legal documents and help from needbuilt.de

SPOLLOW retrieves version information and the corresponding legal documents from needbuilt.de over HTTPS. Verified documents are displayed in the app and stored locally so they can also be read without an internet connection. Verified texts supplied with the app may also be available offline. The website version opens only when you select the corresponding button. For online requests, the web server technically receives information including your IP address, request time, requested address and connection details. The app request does not add club selection, a purchase identifier or a legal decision as a user profile.

needbuilt.de (https://needbuilt.de) uses Cloudflare to deliver and protect the website. Processing delivers requested content and detects technical faults and attacks. The basis is Article 6(1)(f) GDPR; our interest is a secure, accessible website. Article 6(1)(b) GDPR also applies where delivery is necessary for contractual information.

The rest of the website also has its own privacy notice (https://needbuilt.de/datenschutz/).

SPOLLOW stores version information, verified document content and the corresponding legal decisions locally. Merely reading a privacy notice is not treated as consent.

Help/FAQ content may also be updated from needbuilt.de over HTTPS while the app is in the foreground, for example when help is opened or network connectivity returns. Verified content is stored locally, separately from legal decisions, and is then available offline.

11. Retention and deletion

Local settings and data generally remain until you reset them through available functions, clear app data in Android or uninstall the app. Updated datasets may replace earlier ones sooner. No general automatic 72-hour deletion is promised for local reminder and diagnostic states.

Uninstalling does not automatically delete emails, exported files, external calendar entries or Google Play/RevenueCat data. Disconnecting a calendar stops further maintenance. You can explicitly choose to remove linked, unchanged SPOLLOW entries; without that choice, and for manually added, edited or no longer clearly linked entries, external events are retained.

Statutory retention applies only to the relevant records: generally eight years for accounting vouchers, ten for books and certain closing records, and six for business correspondence subject to retention. The start, extensions and exceptions follow applicable law. Not every support message becomes an accounting voucher.

12. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future; earlier lawful processing is unaffected.

For processing based on legitimate interests, you may object on grounds relating to your particular situation. We assess objections under Article 21 GDPR. You could object to direct marketing at any time without giving reasons; SPOLLOW currently conducts no own direct marketing.

Contact privacy@needbuilt.de; no special form or SPOLLOW account is needed. You may voluntarily provide an already available purchase-service or suitable purchase reference. Knowing it alone does not authorise disclosure of someone else’s data. We ask only for necessary information, not passwords, secret purchase tokens, full payment details or routine identity-document copies. A new purchase, restore or reinstall is not a prerequisite. If records cannot reliably be assigned, we explain the limitation and consider suitable additional information. We respond without undue delay, normally within one month; a necessary legally permitted extension of up to two further months is explained within the original period.

You may complain to a data protection supervisory authority, particularly where you live or work or where the suspected infringement occurred. For our registered location, the competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de/).

SPOLLOW makes no own solely automated decisions with legal or similarly significant effects within Article 22 GDPR. This does not describe Google's independent fraud or payment checks.

13. Changes

We update this information when relevant functions, recipients or legal requirements change. If new processing requires consent, changing this notice alone is insufficient. Notices and necessary approvals must precede the relevant processing in the respective user flow.