Privacy Policy

Effective Date: March 13, 2026

This Privacy Policy explains how the Bullfight Finder Team ("we", "us", or "our") collects, uses, and shares information about you when you use the mobile application Bullfight Finder (the "App"). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Portuguese and European Union data protection laws.

1. Data Controller

The data controller responsible for your information is:

Bullfight Finder Team
Email: bullfightfinder@gmail.com

2. Information We Collect

2.1 Information Stored on Your Device

The following data is stored locally on your device and is never transmitted to our servers:

  • Saved Events: Events you save to "My Events" are stored in local device storage (UserDefaults). This data remains entirely on your device.
  • App Preferences: Your settings, parish filters, notification preferences, and radar configuration are stored locally on your device.
  • Apple Account Information: If you choose to link your Apple ID for subscription restoration, your Apple User ID and email are stored locally on your device only. This information is not transmitted to or stored on our servers.

2.2 Location Data

The App uses your device's location services for the following purposes:

  • Radar & Geofencing: To detect when you are near a bullfight event and send local notifications. Location processing happens entirely on your device.
  • Event Proximity: To show you events near your current location.
  • Anonymous Event Presence: When you are within 500 metres of an active event during event hours, the App may share anonymous presence data with our servers to help event organisers understand general attendance patterns. See Section 2.3 for details.

Your location data is processed on-device. We do not collect, store, or have access to your precise location, except for the anonymised presence pings described below.

2.3 Anonymous Event Presence Data

To help event organisers understand attendance patterns, the App may share anonymous presence data when you are near an active bullfight. This data includes:

  • A randomly generated identifier that changes daily and cannot be linked to you or your device across days.
  • Your location rounded to approximately 10 metres of precision.
  • The associated event identifier.

This data is transmitted to Firebase Firestore only when you are within 500 metres of an active event during event hours. It is completely anonymous — we do not require user accounts or login, and there is no way to identify individual users from this data. The anonymous presence data is used solely to provide aggregate attendance estimates.

Legal Basis (GDPR): Legitimate interest in providing aggregate attendance information to event organisers (Article 6(1)(f) GDPR).

2.4 Weather Data

The App uses Apple WeatherKit to fetch weather forecasts for event locations. These requests are sent from your device directly to Apple's weather services and include the geographic coordinates of event venues. This data is subject to Apple's Privacy Policy. We do not intermediary or store these requests on our servers.

2.5 Push Notification Tokens

The App uses Firebase Cloud Messaging (FCM) to deliver push notifications about event updates, cancellations, and rescheduling. Your device's push notification token is managed client-side for topic-based subscriptions. We do not store push tokens on our servers. Tokens are used only to subscribe your device to relevant notification topics (e.g., event updates for PRO subscribers).

3. Third-Party Services

We use the following third-party services, each with their own privacy policies:

3.1 Firebase (Google)

We use Firebase for the following core services:

  • Cloud Firestore: Stores publicly available event data (sourced from the City Halls of Angra do Heroísmo and Praia da Vitória) and anonymous event presence data.
  • Cloud Messaging: Delivers push notifications about event updates.
  • Hosting: Serves event data to the App.
  • Dynamic Links: Handles deep links for event sharing.

We do not use Firebase Analytics or Google Analytics. Firebase processes data in accordance with Google's Privacy Policy and Firebase Data Processing Terms.

3.2 RevenueCat

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat processes transaction data provided by Apple's App Store, including purchase receipts and subscription status. RevenueCat does not receive your name, email, or other personal identifiers from us. For more information, see RevenueCat's Privacy Policy.

3.3 Apple Services

  • WeatherKit: Provides weather forecasts for event locations (see Section 2.4).
  • App Store / StoreKit: Processes in-app purchases and subscriptions.
  • Sign in with Apple: If you choose to link your account for subscription restoration, authentication is handled by Apple. We store only the Apple-provided user identifier and email locally on your device.

These services are subject to Apple's Privacy Policy.

4. How We Use Information

We use the information described above to:

  • Provide event discovery, notifications, and location-based features.
  • Deliver push notifications about event updates, cancellations, and new events.
  • Provide anonymous aggregate attendance estimates to event organisers.
  • Process and manage in-app subscriptions.
  • Fetch weather forecasts for event locations.

5. Data Sharing

We do not sell your personal data. We share information only as follows:

  • Anonymous presence data is stored in Firebase Firestore and may be accessible to event organisers in aggregate form.
  • Subscription transaction data is processed by RevenueCat and Apple as described in Section 3.
  • Weather requests are sent directly from your device to Apple's WeatherKit servers.

The event data displayed in the App (event names, locations, dates, and organisers) is publicly available information provided by the City Halls of Angra do Heroísmo and Praia da Vitória.

6. Data Retention

  • Anonymous presence data: Retained in Firestore for the duration of the event season. Individual session records cannot be traced to any user.
  • Event data: Public event data is retained as long as it is relevant and provided by the source municipalities.
  • On-device data (saved events, preferences, Apple ID): Retained on your device until you delete the App or clear its data.

We do not retain any personally identifiable information on our servers, as the App does not require user accounts or login.

7. Data Security

We implement appropriate technical and organisational measures to protect data, including:

  • Firebase Security Rules that restrict read and write access to data collections.
  • Anonymous presence data uses daily-rotating random identifiers and location rounding to prevent identification.
  • Subscription status is verified through RevenueCat's secure infrastructure and Apple's App Store receipts.
  • All data transmission uses HTTPS/TLS encryption.

8. Your Rights Under GDPR

As a user in the European Union, you have the following rights:

  • Right of Access (Article 15): You may request information about any personal data we process about you. As we do not collect identifiable personal data, there is no personal data to disclose.
  • Right to Erasure (Article 17): You may request deletion of your personal data. On-device data can be deleted by uninstalling the App. Anonymous presence data cannot be attributed to you and therefore cannot be individually erased.
  • Right to Restriction of Processing (Article 18): You may restrict processing by disabling location services or notifications in your device settings.
  • Right to Data Portability (Article 20): As we do not store identifiable personal data on our servers, this right is not applicable.
  • Right to Object (Article 21): You may object to the processing of anonymous presence data by disabling location services for the App.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) or any other EU supervisory authority.

To exercise any of these rights, please contact us at bullfightfinder@gmail.com.

9. Children's Privacy

The App is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at bullfightfinder@gmail.com.

10. International Data Transfers

Anonymous presence data and event data are stored on Firebase servers, which may be located outside the European Economic Area (EEA). Google (Firebase) provides appropriate safeguards for international data transfers in accordance with GDPR requirements, including Standard Contractual Clauses. For more information, see Google's Data Transfer Frameworks.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the App after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: bullfightfinder@gmail.com

This privacy policy was last updated on March 13, 2026.

Back to Home