Privacy Policy
1. Data Controller
Responsible for data processing under GDPR:
Johannes Eremin
Dunantstraße 6
79110 Freiburg im Breisgau
Email: jhnnsrmn@protonmail.com
2. What data we process
SorareTerminal processes only the data necessary for service operation:
- Account data: email address, hashed password (bcrypt 12-rounds) where applicable, account creation date
- Sorare identifiers: Sorare manager-slug, nickname, and Sorare OAuth tokens (access/refresh token, Fernet-encrypted at rest)
- Two-factor authentication (optional): TOTP secret + backup codes (Fernet-encrypted) — only if you enable 2FA
- Telegram link (optional): Telegram chat_id, Telegram username — only if user enabled Telegram notifications
- AI analysis (optional): a Google Gemini API key you provide yourself (Fernet-encrypted) — only if you use the optional AI feature
- Usage & security data: login history and audit log (IP address, user-agent, timestamp) to secure your account
- Portfolio & trading data: watchlists, alerts, cost-basis lots, buy/sell history, profit-and-loss (P&L) analysis, and holdings/vault — your personal trading configuration and analysis
- Invite attribution: which invite code was used at registration
- Market data (not personal): Sorare card prices, player statistics — globally shared, not user-specific
We do not store crypto wallet private keys server-side: wallet signing happens exclusively locally in the optional companion app on your device (non-custodial).
3. Legal basis
- Art. 6(1)(b) GDPR (contract performance) — user requested the SorareTerminal service
- Art. 6(1)(f) GDPR (legitimate interest) — audit log + Sentry error tracking for service reliability
- Art. 6(1)(a) GDPR (consent) — Telegram notifications + marketing emails
4. Retention period
- Active accounts: as long as the account exists
- Soft-deleted accounts: 30-day recovery window, then automatic hard-deletion
- Audit log: 365 days, then automatic deletion
- Login history (incl. IP address): 180 days, then automatic deletion
- Backups: automatic backups managed by our database provider (Neon)
5. Sub-Processors
The following services process user data on our behalf:
| Service | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting (application) | Germany (EU) — Nuremberg |
| Neon, Inc. | Managed database (PostgreSQL) incl. backups | EU region (Frankfurt) — to be confirmed by operator |
| Sorare SAS | Authentication, market data | France (EU) |
| Functional Software, Inc. (Sentry) | Error tracking (on errors only, PII-reduced) | USA — SCC / EU-US Data Privacy Framework |
| Telegram (Group LLP) | Notification channel (optional) | UK |
| Google LLC (Gmail SMTP) | Auth emails + notifications | USA — SCC / DPF |
| Google LLC (Gemini API, optional) | AI analysis using your own API key — only if used | USA — SCC / DPF |
6. Cookies
SorareTerminal uses only technically necessary cookies plus a language preference you choose:
session— Flask login session (HttpOnly, SameSite=Lax, Secure in production; 24-hour absolute validity, 4-hour idle timeout)sorare_csrf— CSRF protection for POST requests (SameSite=Lax, 30 days)lang— remembers your chosen language (de/en); contains no identifier and no tracking (1-year validity)st_ret— remembers, after a successful sign-in, that an account was already used on this device; only controls whether the login page proceeds without an invite code. Fixed value "1", contains no identifier and no tracking (HttpOnly, SameSite=Lax, Secure in production; 1-year validity)cookie-disclosure-acked(localStorage, not a cookie) — remembers banner-dismissal
We use no tracking cookies, no third-party cookies, no Google Analytics. As all cookies are strictly necessary or a deliberate user setting, no consent is required under § 25(2) TDDDG.
7. Your rights
- Access (Art. 15): Settings → Account → "Download my data" — JSON-ZIP export of all stored data.
- Rectification (Art. 16): change email + Telegram link in Settings. Other fields: email jhnnsrmn@protonmail.com.
- Erasure (Art. 17): Settings → Account → "Delete account". Immediate soft-delete, automatic hard-delete after 30 days.
- Restriction (Art. 18): email request to our address.
- Portability (Art. 20): identical to the access right — the JSON-ZIP export covers both.
- Object (Art. 21) + withdrawal of consent (Art. 7): email request.
- Complaint to supervisory authority (Art. 77): the data protection authority of your residence or the authority competent for the provider.
No automated decision-making: No automated decision-making or profiling within the meaning of Art. 22 GDPR producing legal effects takes place.
8. Server location, third-party content, encryption
The application server runs at Hetzner Online GmbH in Germany (Nuremberg). The database is hosted as a managed service by Neon, Inc. (EU region Frankfurt — to be confirmed by operator).
Third-party content: In the logged-in area (dashboard), images (cards, players, club logos, and your Sorare profile picture) are loaded directly from Sorare's image/CDN servers. This technically transmits your IP address to Sorare. No tracking scripts or third-party cookies are involved.
API tokens (Sorare-OAuth) and other sensitive fields (2FA, optional Gemini key) are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) at rest. Passwords are hashed with bcrypt (12 rounds).
Data transfer between your browser and our server is HTTPS-only (TLS 1.2+, Caddy + Let's Encrypt).
9. Contact
Privacy inquiries to jhnnsrmn@protonmail.com. We respond within the GDPR-mandated 1-month period.