fantaboomer.com — The first vintage fantasy football
BACK
LEGAL

Privacy policy

Last updated: 1 October 2026 · version 2026-10-01

This policy explains what personal data we process when you use FANTABOOMER, for what purposes, on what legal basis, for how long, who we share it with and what rights you have, as required by Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR»). The data controller is Composing Studio Srl, whose full details are at the bottom of this page. For any question about your data write to info@composingstudio.com. This is a translation: if it differs from the Italian version, the Italian version prevails.

1Who this policy is for

This policy covers the fantaboomer.com website, the FANTABOOMER apps for Android and iPhone and the emails we send. It is addressed to people who sign up, people invited to a league who have not signed up yet, people who write to us and visitors of the website.

It does not cover the services of others that the website links to or that you go through to use it — the Apple and Google stores, sign-in with Google or Apple, the Telegram channel — which process data as independent controllers under their own policies.

We have not appointed a data protection officer (DPO), because our activity does not fall within the cases in which Article 37 GDPR requires one: for any matter, the point of contact is the controller, at the address above.

2What data we process, why and on what legal basis

Account and sign-in
Email address, first and last name, the language you choose, the sign-up date and an internal identifier. If you sign in with Google or Apple, we receive from the provider the email and name associated with that account (with Apple it may be a «hidden» address that forwards to yours) and never the password. If you sign up with email and password, the password is kept only by Google Firebase Authentication, in hashed form: we never see it or store it. They are used to create the account, let you sign in from the website and the app, verify your address and reset your password with a single-use link.
Performance of a contract · Art. 6(1)(b)
Profile visible to others and game data
The leagues you belong to and your role, the team you manage (also together with others), its name, the squad, auction bids, line-ups, trades and votes on trades, credit movements, results and standings. The other members of your leagues see your first and last name and your team; if you have not entered a name, they see the part of your email address before the «@». Only the league administrators see your full email address.
Performance of a contract · Art. 6(1)(b)
League invitations
When an administrator invites someone, we record the email address they give us, the league, the team if any and the invitation's expiry (14 days), and we send the invitation email. An administrator can also add a person who is already registered directly to a league, by typing their full email address. If you have been invited and have not signed up yet, your address was given to us by the administrator who invited you (Article 14 GDPR): we use it only to deliver the invitation, on the basis of their and our legitimate interest in running private leagues, and you can ask us to delete it at any time.
Contract · Art. 6(1)(b) · and legitimate interest · Art. 6(1)(f)
Invitation links opened on a phone
If, from an invitation page, you choose to download the app, we record the invitation, the type of phone (iOS or Android) and an encrypted fingerprint of the IP address you opened it from, computed with a secret key: the address is not stored and cannot be derived from the fingerprint. On first launch the app asks whether an invitation was opened from the same network in the last hour, and so takes you to the right league. On Android the app also reads the Google Play install referrer, which contains only the invitation code. The app reads the phone's clipboard only when you tap «Paste from clipboard».
Pre-contractual steps at your request · Art. 6(1)(b)
Service emails
Invitations, team assignment, reminders to pick your line-up, matchday results, trade proposals and outcomes, address verification, password reset and the copy of the data of a deleted league. We record when a reminder was sent and whether it was delivered, so as not to send it twice. Reminders and results can be turned off from Preferences or from the «unsubscribe» link at the bottom of the email, which works without signing in and does not require storing anything.
Performance of a contract · Art. 6(1)(b)
Phone notifications
If you allow notifications in the app, we record the notification code that Google Firebase Cloud Messaging assigns to that installation, the type of system (Android or iOS) and the date of the last launch. We use it to send you reminders and alerts from your leagues. You can withdraw the permission at any time in your phone settings.
Performance of a contract · Art. 6(1)(b)
Real-time updates
During a live matchday or an auction we publish the scoreboard and the auction status (team names, scores, bids) on Google Firebase Realtime Database, together with the sign-in identifiers of the league members: they ensure that only members can read that data.
Performance of a contract · Art. 6(1)(b)
Support and contact
Name, email, subject and text of the message and — to help us understand a problem — the address of the page you write from and the type of browser. If you write from inside the app or the signed-in area, we take name and email from your account. We keep the message in our database and receive it by email, in order to reply. For registered users the basis is the contract; for those who write from the public form it is our legitimate interest in replying to whoever contacts us.
Contract · Art. 6(1)(b) · or legitimate interest · Art. 6(1)(f)
Copy of the data of a deleted league
When an administrator deletes a league, we email them a CSV archive with teams, squads, results, credits, auctions and trades, which also contains the first name, last name and email address of whoever managed each team. From then on that copy is in the administrator's mailbox, and they are responsible for it.
Performance of a contract · Art. 6(1)(b)
Proof of the policy and of consents
Date and version of the policy you confirmed you had read, and date of your consent to promotional messages, if given. The GDPR requires us to be able to demonstrate both.
Legal obligation · Art. 6(1)(c) · Arts. 5(2) and 7(1) GDPR
Promotional messages
News about FANTABOOMER by email, only if you ticked the dedicated box. Consent is optional, can be withdrawn at any time from Preferences or by writing to us, and refusing or withdrawing it changes nothing in how you use the service.
Consent · Art. 6(1)(a)
Website usage statistics
Only if you choose «Accept all» in the banner do we use Google Analytics 4 to measure visits: pages viewed, referrer, type of device and browser, approximate location (country or city level, derived from the IP address, which Google does not store) and clicks on the sign-up and sign-in buttons. We do not link these statistics to your account and do not use them for advertising. The details, and the button to change your mind, are in the cookie policy.
Consent · Art. 6(1)(a) · and Art. 122 Italian Privacy Code
Security and abuse prevention
To curb automated submissions, repeated attempts and excessive use, we count requests per network address, per account and — for invitations and password resets — per email address. The counters live only in the server's memory. Our hosting providers also record in their technical logs the IP address, the requested page, the time and the outcome of each request; in our own logs email addresses appear masked.
Legitimate interest · Art. 6(1)(f)
Error monitoring
When the server hits an error, we may send its technical description to Sentry, with only the context needed to understand it (for example the league or matchday number). The service is configured not to receive IP addresses, headers, cookies or request contents.
Legitimate interest · Art. 6(1)(f)
Fonts
The website's fonts are served from our own domain, together with the rest of the pages: your browser does not request them from external services such as Google Fonts, and no third party receives your IP address to deliver them.
Legal obligations and protection of rights
We keep or disclose data when a law or an authority requires it, and we use it where needed to establish, exercise or defend our legal claims.
Legal obligation · Art. 6(1)(c) · and legitimate interest · Art. 6(1)(f)

Balancing the legitimate interest. Where the basis is Article 6(1)(f), we assessed that our interest — keeping the service secure and working, replying to people who write to us, delivering an invitation — does not override your rights only because we use the bare minimum: in-memory counters reset within 24 hours, IP fingerprints instead of IP addresses, errors without data about who encountered them, logs kept by the provider for a few days. These are processing operations that anyone using an online service expects. You can still object, as explained below, and ask us for the details of the assessment.

We do not process special categories of data (Article 9 GDPR) or data relating to criminal convictions. We do not profile you and we do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR): the automatic score calculation applies the league's rules and has no such effects.

3Do you have to give us your data?

To create an account you need an email address (and a password, or a Google or Apple account): without it we cannot provide the service. First and last name are optional, but if they are missing we show the other members the first part of your email address. Phone notifications, promotional messages and statistics are entirely optional, and refusing them does not limit the game.

4Who we share data with

With the members of your leagues, within the limits described above, and with our authorised staff, who access the data only for support, maintenance and to carry out deletion requests. We also rely on providers acting as processors (Article 28 GDPR), under a contract that binds them to use the data only on our behalf:

Google Ireland Limited (Google Firebase and Google Analytics)
Authentication (Firebase Authentication), real-time data (Firebase Realtime Database, servers in Belgium), notifications (Firebase Cloud Messaging), website delivery (Firebase Hosting) and, only with your consent, statistics (Google Analytics 4). It relies on Google LLC, based in the United States.
Salesforce, Inc. (Heroku) and Amazon Web Services
Application servers and the database holding accounts and game data, in Heroku's European region; the database runs on Amazon Web Services infrastructure in Ireland.
Aruba S.p.A.
Sending emails and the mailbox where we receive messages, in Italy.
Functional Software, Inc. (Sentry)
Collecting the server's error reports, without users' personal data.

Acting instead as independent controllers, under their own policies: Google and Apple when you choose to sign in with their account, Google Play and the App Store when you install the app, Apple to deliver notifications on iOS devices.

We disclose data to authorities only when the law requires it. Your data is not sold or passed on to third parties for their own purposes.

5Transfers outside the European Economic Area

The main database and the real-time data are in the European Union. Some providers, however, are US companies or rely on US companies, and may process data in the United States: Google LLC (Firebase Authentication, Cloud Messaging, Hosting and Analytics), Salesforce, Inc. and Amazon Web Services, Inc. for support and infrastructure management, Functional Software, Inc. (Sentry).

These transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for the companies certified under it, and in any case on the standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). You can ask us for a copy of the safeguards by writing to info@composingstudio.com.

6How long we keep it

Account
As long as the account exists. When you delete it, the Firebase sign-in is deleted immediately and first name, last name and email are removed from the database at the same moment; only an internal identifier remains, with no data about you, needed to keep the league standings consistent.
Game data
As long as the league exists: the administrator deletes it by deleting the league. If you delete your account first, it remains without your name, as explained below.
Invitations
An invitation is valid for 14 days: the invited person's email address stays recorded while the invitation is valid or until the administrator revokes it, and the invitation is deleted in any case 30 days after it expires (or earlier, if the league is deleted). Invitations addressed to an email address are also deleted when the account with that address is deleted, or immediately if the invited person asks us to.
Invitation links opened on a phone
Usable for one hour and only once; deleted within 24 hours in any case.
Notification codes
As long as you stay signed in on that phone: we delete them when you sign out, when Firebase tells us the app has been uninstalled, when you delete your account and in any case after 270 days in which the app on that phone has not checked in. We keep at most ten per account, and beyond that the oldest one is removed.
Real-time data
Overwritten at every update and removed when no live matchday or auction is running; the list of members allowed to read it follows the league's membership.
Log of reminders sent
As long as the league exists.
Support and contact messages
Up to 24 months from receipt, both in the database and in the mailbox, then we delete them. If you delete your account, those sent from inside the app immediately lose name and email.
Consent to promotional messages
Until you withdraw it: on withdrawal the date is deleted.
Proof of the policy you confirmed
For the whole life of the account. After deletion it stays linked only to the internal identifier with no data, and can no longer be attributed to you.
Abuse counters
Only in the server's memory, for at most 24 hours, and reset at every restart.
Technical logs
Heroku's log stream is not archived: it keeps only the most recent lines, for one week at most.
Error reports (Sentry)
At most 90 days.
Statistics (Google Analytics)
Cookies last at most two years; event-level data is kept by Google for two months, after which only aggregated data remains.

In any case we may keep for longer the data that a law requires us to keep, or that is needed to defend our rights in a dispute that has already arisen, only for that purpose and for the time needed.

7Your rights

At any time you can ask us for access to your data and a copy, rectification of inaccurate data, erasure, restriction of processing, portability of the data you gave us in a structured, machine-readable format, and you can object to processing based on legitimate interest on grounds relating to your particular situation (Articles 15-21 GDPR). You can withdraw consent whenever you like, without affecting the lawfulness of processing carried out before (Article 7(3) GDPR): consent to promotional messages from Preferences, consent to statistics from the cookie policy.

Write to info@composingstudio.com, if you can from the address you signed up with: it is the simplest way to know the request comes from you, and if that is not enough we will ask for the bare minimum needed to verify it. We reply free of charge within one month, extendable by two further months only for complex requests and after telling you (Article 12 GDPR).

If you believe the processing infringes the GDPR you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian supervisory authority, Piazza Venezia 11, 00187 Rome) or with the authority of the EU country where you live or work, or go to court (Articles 77-79 GDPR).

You can delete your account on your own, from the app or from Preferences, without asking anyone: the steps are on this page. We delete first name, last name and email address, the sign-in, the promotional consent, the invitations addressed to your email and the phones registered for notifications, and from that moment you no longer receive any email or notification.

What we do not delete are the matches you played: results, line-ups and standings of the leagues you took part in remain, because they are also the championship of the other members, and removing them would rewrite a season that concerns them too. In those screens your name is replaced by «User no longer registered». The name you gave your team, however, stays as it is: if it contains your name, change it before deleting your account or ask us to. Teams you managed together with others pass to them. If you sign up again one day, even with the same address, it will be a new account: previous leagues and teams do not come back.

Write to info@composingstudio.comHow to delete your account

8Children

FANTABOOMER is not directed at people under 14, the age from which, in Italy, you can consent on your own to the processing of your data in online services (Article 2-quinquies of the Italian Privacy Code, Legislative Decree 196/2003). We do not ask for your date of birth and we do not knowingly collect data of people under that age. If we learn that an account belongs to someone under 14, we delete it; whoever holds parental responsibility can ask us to by writing to info@composingstudio.com.

9How we protect data

All communications with the website, the app and the server are encrypted (HTTPS). Passwords never go through our servers. Access to the database and to the providers' consoles is restricted to authorised staff. Real-time data can be read only by league members; participants' email addresses only by administrators. IP fingerprints and unsubscribe links are signed with secret keys. We limit the number of requests to block abuse. Should a personal data breach occur, we will notify the Garante within 72 hours and, if it is likely to result in a high risk to you, we will tell you directly (Articles 33-34 GDPR).

11Changes

We update this policy when the way we process data changes. The date and version at the top of the page say when that last happened. If the change is substantial, the next time you sign in we ask you to read and confirm the new version; the one you had confirmed remains recorded together with the date. If a change requires a new consent, we ask for it before applying the change.

Data controller

Composing Studio Srl
VAT no. 08037690727Via Cappuccini 53/A — 70016 Noicàttaro (BA)info@composingstudio.com
Usiamo cookie tecnici, necessari a tenerti collegato e a ricordare le tue preferenze. Con il tuo consenso usiamo anche Google Analytics per capire quali pagine vengono usate: nessuna profilazione pubblicitaria, e il sito funziona identico se dici di no. Informativa cookie · Privacy