Groundhopper
Back to site
Privacy Policy
How Groundhopper collects, uses and stores your data.
1. Who is responsible for your data
Groundhopper (groundhoppermap.com) is operated by Konrad Gawron, ul. Chłodna 26, 62-021 Paczkowo, Poland, tax identification number (NIP) 6652788247. We are the data controller for the personal data described here.
For anything about your data, write to privacy@groundhoppermap.com.
2. What we collect, and why
Your account
When you register we store your username, your email address, a hashed password (we never store or see the password itself), the date you signed up, and whether you have confirmed your email. We need this to give you an account and to let you sign back into it.
What you choose to add
Optionally, you can add a home city and its coordinates, a favourite team, a travel scope and an avatar image address. These exist so the map can measure distances from home and draw your journey. You can leave them empty and the service still works.
The matches and trips you log
Everything you record — matches, teams, dates, stadiums, competitions, your stadium bucket list, planned trips and your own notes — is stored against your account. This is the service itself; without it there is nothing to show you.
Tickets
If you attach a ticket — a PDF from the club, or a photo — the file itself is stored on our server, outside any public folder, and is served only to you. Every single time it is opened we check that it is your ticket and that your plan is active. There is no link that shows it to anyone else.
Tickets often carry more than a seat number: your name, a booking reference, sometimes a national identity number. We do not read them and we do not send them anywhere. They sit on our server exactly as you uploaded them, until you delete them.
You can delete any ticket at any time, from the Ticket Vault, and the file is removed from our servers for good — the match and the trip stay in your journey. Deleting works on the free plan too: you never have to pay to remove your own data. And you never have to upload a ticket at all — every match can be added by hand.
Tickets kept on your phone
If you tap Keep for matchday, a copy of that ticket is saved inside your browser on that one device, so it opens at the turnstile with no signal. It is not shared, not uploaded anywhere, and not visible to us.
That copy is removed automatically the day after the match, when you sign in on a different account, and when your plan is no longer active. You can also remove it yourself at any moment from the matchday screen. One honest limit: a copy already on your phone can only be cleared the next time that phone is online. A device that never reconnects is beyond our reach — which is why nothing is ever saved there unless you ask for it.
Payment
Payments are handled entirely by Stripe. Card details are entered on Stripe’s own pages and never reach our servers. From Stripe we store only two identifiers — your Stripe customer ID and subscription ID — so we know which plan your account is on.
Visit measurement
We count how the site is used with our own counter. For each event we store the event name (for example “signup started”), a random session identifier that lives only until you close the tab, your user ID if you are logged in, and a few small values such as which button was pressed.
We do not store your IP address, your browser’s user-agent string, or anything that follows you to other websites. The counter is entirely first-party: no data from it goes anywhere except our own database.
Messages you send us
When you write to us through Help in the app, we store the text of your message, whether you marked it as a question or as a problem, and the date. Our replies are stored the same way, so the two of you can read the conversation later.
If you report that something is broken, we also attach a short technical note: which screen you were on, the size of your window, your browser, and the last error message the app produced. The app shows you this before you send it. Page addresses are stripped of everything after the path, so tokens from links never reach us, and anything that looks like an e-mail address or a token is removed from the error text.
We keep a conversation for twelve months after its last message, then delete it. Deleting your account deletes it immediately.
Protection against abuse
When someone registers, we briefly keep a one-way hash of the connecting IP address so that a script cannot create hundreds of accounts. The address itself is never written down, and the hash cannot be turned back into it.
3. Cookies and data stored on your device
If you are not logged in, we set no cookies at all. Nothing is written to your device by us on the landing page, the Academy or a public profile beyond the items listed below.
| What | Where | When | Why |
|---|---|---|---|
| Session cookie | Cookie | Only after you log in | Keeps you signed in. Strictly necessary. |
| Session identifier | Session storage | Any visit | Groups events from one visit. Deleted when you close the tab. |
| Map settings | Local storage | In the app | Remembers the map options you selected yourself. |
| Install and signup flags | Session storage | Any visit | Stops us showing the same prompt twice. Deleted when you close the tab. |
None of these are advertising or cross-site tracking technologies. Fonts and map libraries are served from our own server, so opening a page does not disclose your address to any third party.
4. Your public profile
groundhoppermap.com/u/your-username and
indexed by search engines. Your email address, your password, your notes and your ticket
photos are never shown there. Switching it off makes the page unavailable
immediately.
5. Emails we send you
Two of our emails are unavoidable, because they are how the account works: confirming your address when you sign up, and resetting your password when you ask for it. Those go out whatever your settings say.
Beyond those we send three reminders, all of them about your own record:
- two days before a trip you have planned, so the ticket does not get forgotten;
- a nudge if a planned date has passed and the match never got logged;
- one summary of your season, in May.
That is the complete list. We do not send a newsletter, we do not email you about new articles, and we do not email you offers. If that ever changes we will ask first — it would be a different kind of message and would need a different kind of consent.
These reminders are on by default. Every one of them carries a one-click link that switches them off without logging in, and you can turn them on and off yourself at any time in Settings. Switching them off changes nothing else about your account.
We keep a record of which reminder went to which account and when, so that the same message is never sent twice. That record holds no message content.
6. Artificial intelligence features
Some features — finding a stadium from a club name, reading a ticket, the trip assistant — send data to Anthropic (the Claude API), acting as our processor. What is sent is only what the feature needs: the text you typed, or the ticket image you chose to upload.
We keep a record of these calls for cost control, and that record contains only counts — model name, number of tokens, estimated cost. The content of your requests is not stored in our logs.
AI output can be wrong. Treat suggested stadiums, distances and trip advice as a starting point, not as fact.
7. Who else processes data, and what they receive
| Who | What for | What they receive |
|---|---|---|
| Stripe | Payments and subscriptions | Your payment details, entered directly on their pages, and your email |
| Anthropic | AI features | The text or image you submit to that feature |
| Zenbox | Sending email | Your email address and the message content |
| MapTiler, CARTO, Esri | Map tiles | Your IP address, because your browser fetches the map images directly |
| OpenStreetMap Nominatim | Turning place names into coordinates | The place name being looked up |
| football-data.org | Fixtures and results | No personal data |
| Cyber_Folks S.A. (Poland) | Servers | Everything stored, as our hosting provider |
Anthropic and Stripe are established outside the European Economic Area. Transfers to them rely on the European Commission’s Standard Contractual Clauses.
We do not sell personal data, and we do not share it for advertising.
8. Why we are allowed to do this
- To perform our contract with you — your account, the matches you log, your subscription.
- Our legitimate interests — keeping the service secure, preventing automated abuse, and measuring how many people use the site so we know what to build. We chose the least intrusive method we could find for the last one.
- Legal obligation — keeping invoices for as long as tax law requires.
9. How long we keep things
| What | How long |
|---|---|
| Your account and everything in it | Until you delete the account |
| Visit measurement events | 13 months, then deleted automatically |
| Registration IP hashes | 24 hours |
| Poster export tokens | 1 hour |
| Invoices and payment records | As required by tax law |
10. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing based on legitimate interests.
Export is built in — you can download your matches from the app at any time.
Deletion is built in. Go to Settings → Delete my account, confirm with your password, and everything attached to your account — matches, trips, ticket photos, bucket list, measurement events — is removed straight away. If you have a paid plan, we cancel the subscription with Stripe first, so you are not charged again. Deletion is permanent and cannot be undone. If you would rather we did it for you, write to privacy@groundhoppermap.com from your registered address.
If you think we have handled your data badly, you can complain to your national data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO).
11. Security
The site is served only over HTTPS. Passwords are stored hashed, never in readable form. Poster exports use single-use signed tokens that expire in three minutes rather than exposing your session. Access to the server is by SSH key only.
No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you and the supervisory authority as the law requires.
12. Children
Groundhopper is not intended for anyone under 16. If you believe a child has created an account, write to us and we will remove it.
13. Changes
If we change this policy in a way that matters, we will say so on the site and, for changes that affect you materially, by email before they take effect. The date at the top always reflects the current version.