Privacy Policy

Last updated: 26 July 2026

1. Who we are

tomaraki. (to-maraki.gr) is a social platform for tennis. It provides social features for all users (15+), and competitive features — match recording, challenges, tournaments and ATT rating — exclusively for users aged 18 and over.

Data Controller: Maria Papanikolaou, Achaias 45 & Panormou, Athens, email: maripapanikola@gmail.com.

2. Information we collect

• Registration data: name, email, username, gender, date of birth.
• Mobile phone number: to verify account uniqueness via SMS code (OTP). Only the number is stored — the OTP code is not stored by us; it is sent and verified exclusively via Twilio and is unknown to us.
• Google Sign-In: if you choose "Sign in with Google", we receive your email, name and Google ID from Google. We do not store Google passwords.
• Content: post photos, profile picture, comments and reactions you publish.
• Game data (18+ only): match results, ATT rating, wins/losses, streaks, honors, tournament cover images, tournament and challenge participation.
• Technical data: IP, browser, login dates (for security only).
• Rate limiting data: your IP address is stored temporarily (up to 15 minutes) in the event of failed login attempts, to protect against brute-force attacks. It is deleted automatically.
• Reports: if you submit a report against a user, your request is stored (reporter ID, reported ID, reason, context, date) for review by the admin.
• Admin action log: admin actions (ban, suspension, report resolution) are logged with a timestamp for accountability.

3. Legal Basis for Processing (Article 6 GDPR)

• Registration data & game data: Performance of contract — Article 6(1)(b) GDPR. Necessary to provide the platform's services.
• Mobile number: Performance of contract — Article 6(1)(b) GDPR. Necessary for identity verification and account creation.
• Technical data (IP, browser) & rate limiting: Legitimate interest — Article 6(1)(f) GDPR. Platform security and prevention of malicious use.
• Google Sign-In: Performance of contract — Article 6(1)(b) GDPR. Facilitating access at the user's explicit choice.
• User reports & admin log: Legitimate interest — Article 6(1)(f) GDPR. Safe operation of the platform and user protection.

4. Files we store

Each user has a personal folder on the server (uploads/{username}/) containing:

• posts/ — images you have uploaded in posts.
• profile_pictures/ — profile picture.
• tournaments/ — tournament cover images you have created.

These files are accessible via URL only if you know the exact path. There is no directory listing.

5. How we use the information

• Account creation and management.
• Displaying profiles, posts and social features for all users.
• Displaying results, ATT ranking, tournaments and challenges — exclusively for 18+ users.
• Automatic age calculation to determine available features (unlocked at 18).
• ATT rating (profiling): The ATT system calculates a rating based on your results. This constitutes automated processing (profiling) under Article 22 GDPR, without legally binding legal consequences for the user. You have the right to object.
• Push notifications: Sent only if you have given explicit permission via your browser (consent — Article 6(1)(a) GDPR). You can disable them at any time from your browser or app settings.
• Sending confirmation and password reset emails.
• Reviewing reports and taking action (suspension/ban) to protect the community.
• Improving the platform.

Minors aged 15–17: Accepted under Article 21 of Law 4624/2019 (age of consent 15 in Greece). Users 15+ may consent on their own — parental consent is not required. Age is verified via the declared date of birth.

6. Data Sharing & Processors

We do not sell, rent or share your personal data with third parties for commercial purposes. To operate the platform we use the following data processors (Article 28 GDPR), with whom we comply with the relevant contractual obligations:

• Google Cloud (EU region): Server and database hosting. Data remains within the European Union.
• Google (Gmail SMTP): Sending confirmation and notification emails. Google acts as a data processor under its terms.
• Twilio Inc. (USA): SMS delivery for mobile verification (OTP). Data (mobile number + OTP code) is transferred to the USA — see paragraph 6a below.

7. Security

We apply multiple technical measures to protect your data:

• Passwords: Stored encrypted with bcrypt. Not known to us.
• Communication: Exclusively via HTTPS (TLS). Active HSTS for 1 year.
• Session cookies: HttpOnly (not accessible via JavaScript), Secure (HTTPS only), SameSite=Lax (protection against cross-site attacks).
• CSRF protection: Each session gets a unique 64-character token verified on every data-change request. Automatically renewed after each login.
• Rate limiting: Automatic limit of 10 failed login attempts per IP/15 minutes to protect against brute-force attacks.
• Session security: Session ID is automatically renewed after each successful login (session fixation prevention).
• Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy set on every response.
• Images: All images are reprocessed via GD (EXIF removal, MIME verification) before being stored.
• OTP verification: The OTP code is not stored — it is sent and verified exclusively via Twilio and is unknown to us.
• New device login notification: If a login is detected from an IP address never previously used for your account, an email alert is automatically sent. If it wasn't you, you can change your password immediately.
• Active session management: You can view all active sessions (browser, IP, last activity) from Settings and log out from any device with one click.

7a. Active session data

For each active session we store: session ID, IP address, user agent (browser/device), creation date and last activity date. This data is retained only while the session is active and is automatically deleted upon logout. Legal basis: legitimate interest — Article 6(1)(f) GDPR (account security).

7b. Security notifications

For each new IP login we store: user ID, IP address and first/last seen date. The sole purpose is detecting unauthorised access. Not used for tracking or profiling. Legal basis: legitimate interest — Article 6(1)(f) GDPR.

8. Account deletion

You can permanently delete your account from Settings. Upon deletion:

• Your personal file folder (uploads/{username}/) is deleted with all post photos, profile picture and tournament images — permanently and irreversibly.
• Deleted from the database: your profile, posts, reactions, comments, notifications, follows and messages.
• Confirmed match results remain in the system for ATT ranking integrity. Upon deletion, all references to your ID are replaced with NULL — remaining data (score, location, date) is no longer linked to any identity (anonymisation).
• Any open reports you have submitted against other users remain in the system for management integrity, without reference to your identity (reporter ID anonymised).

Deletion is immediate and irreversible. If you encounter any issue, contact us before deleting.

9. Data retention

• Account & content: For as long as the account is active. If inactive for more than 2 years, we may contact you before taking any action.
• Rate limiting (IP): Up to 15 minutes — deleted automatically.
• User reports: For as long as the relevant account is active, then anonymised.
• Admin action log: 12 months from the date of recording.

10. Your rights

Under GDPR you have the right of access, rectification, portability and erasure of your data, as well as the right to object to processing based on legitimate interest. For requests contact maripapanikola@gmail.com. We respond within 30 days.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr · Kifisias 1–3, 115 23 Athens · contact@dpa.gr.

11. Cookies

We use only a session cookie for login and, for persistent login, a long-lived cookie. Our cookies have the HttpOnly (not accessible via JavaScript), Secure (sent only over HTTPS) and SameSite=Lax (cross-site request attack protection) attributes. We do not use tracking or advertising cookies.

12. Changes

We may update this policy. The date of the last update is shown at the top.

13. Contact

For any questions regarding your data protection:
maripapanikola@gmail.com