Back

Privacy Policy

Last updated: October 30, 2026

Who we are

Slam101 is operated by EI Funsho David, a French sole proprietorship based at 11, rue Sainte Odile, 31100 Toulouse, France (contact: [email protected]; referred to here as "we" or "us").

We are the data controller for the personal data described in this policy.

Data we collect

Account data. Email address, display name, password (encrypted), account creation date, and language preference.

Gameplay data. Playgrounds, lineups, boosters used, scores, XP and level, rankings, tier, and badges.

Matchmaking and fair-play data. A skill score computed from your ranking, used for matchmaking, and records of ranking changes and account activity, used to detect cheating.

Bucket and purchase data. Your bucket balance and history, including passes bought with buckets, and your bucket pack purchases.

Referral data. If you use someone's referral link, the link between your two accounts and the rewards granted.

Social data. Your teammates and teammate requests.

Activity data. Your daily connection streak, used for skill badges.

Payment data. Payments are processed by Stripe. We never receive your card number, only the payment status and a customer reference.

Communications data. The notifications we send you and your notification preferences, including injury alert times and time zone. If you turn on browser notifications, each browser's push subscription (an address at its push service and encryption keys), linked to its device identifier.

Technical data. IP address, browser and device information, and server logs, used for security, debugging, and fraud prevention. At registration, we also record a device identifier to detect multiple accounts.

Sign-up source. If you reach Slam101 through a link with campaign tags (utm_* parameters, for example from our website or an ad), we record them with your account when you sign up.

Launch reminder. If you signed up for a launch reminder before launch, we use your email address only to tell you that Slam101 has launched. Legal basis: consent. We delete it within 3 months of launch or on request.

Player statistics come from a third-party provider (BallDontLie) and concern professional athletes, not our users.

How we use your data

To provide the game: accounts, playgrounds, scoring, and rankings. Legal basis: performance of our contract with you.
To match free agents with suitable playgrounds: using the skill score described above. Legal basis: performance of contract.
To keep the game fair and secure: detecting cheating, multiple accounts, and fraud, and analyzing logs. Legal basis: our legitimate interest in preventing fraud and keeping rankings fair.
To process purchases: bucket packs, via Stripe. Legal basis: performance of contract; legal obligations (accounting, tax).
To process referral rewards: as described in our Terms. Legal basis: performance of contract.
To provide social features: teammates. Legal basis: performance of contract.
To manage your account: email verification and password reset. Legal basis: performance of contract.
To send notifications: playground updates, lineup results, deadline and injury alerts, and reminders to start or replay a playground, by email, and as browser notifications if you turn them on. You can turn emails off in Settings or from the link in each email, and browser notifications in Settings or in your browser. Legal basis: performance of contract / legitimate interest; consent for browser notifications.
To measure our marketing: counting which campaigns and links bring new players, from the sign-up source above. Legal basis: our legitimate interest in knowing which promotion works.
To comply with law: responding to lawful requests, keeping required records. Legal basis: legal obligation.

We do not sell your personal data, and we do not use it for third-party advertising.

What other users can see

As a competitive game, Slam101 shows some of your data to other players:

Your display name, tier, division, level, skill badges, profile statistics, and leaderboard positions.
Within a versus playground: your lineups, scores, and boosters used.
Playgrounds you open to Free Agency show their members and average ranking to free agents.
Your teammates list, to any signed-in user.

Your email address is never shown to other users.

We share data only with the processors needed to run the service:

Stripe: payment processing.
Resend: sending emails.
OVHcloud: hosting the application and database.
Cloudflare: bot protection on the sign-up page (Turnstile). It receives your IP address, browser details and a technical fingerprint of your connection to tell people from bots. Cloudflare also uses these signals, under its own Turnstile privacy notice, to improve its bot detection.

Each processor acts under a data processing agreement and only on our instructions. Where a processor transfers data outside the EU/EEA, transfers are covered by an adequacy decision or Standard Contractual Clauses.

If you turn on browser notifications, they reach your device through your browser's push service (run by Google, Mozilla, Apple or Microsoft, depending on the browser). They are encrypted, so the push service can't read them.

Pages also load fonts from Google Fonts, which receives your IP address when serving them. We send Google no data ourselves, and it is not our processor.

Cookies

We only use cookies strictly necessary for the site to work, so no consent is required. None are used for tracking or advertising.

Session cookie: keeps you signed in between visits.
Returning-visitor cookie: kept for a year after you sign in, so the app opens on the sign-in page rather than sign-up.
Google sign-in cookies: short-lived (10 minutes), used during Google sign-in to prevent request forgery and to bring you back to the page you were on.
Referral attribution cookie: kept up to 7 days after you click a referral link, to credit the referrer when you register.
Invite return cookie: kept up to 7 days after you open a playground invite link, to bring you back to it once you sign up.
Device cookie: a random identifier set on your first visit and kept for 2 years, used to detect multiple accounts and to stop browser notifications on a device once you sign out of it.
Time zone cookie: your browser's time zone, kept for a year, so the times in our emails match your local time.

The app also remembers in your browser which cards and banners you dismissed, and, if you turn on browser notifications, installs the service worker that shows them.

Retention

Account and gameplay data: kept while your account is active, then deleted or anonymized within 12 months of account deletion. Finalized results may be kept in anonymized form so other players' rankings stay consistent.
Purchase and billing records: kept 10 years, as required by French accounting law.
Fair-play records: kept 12 months after the related playground is finalized.
Server logs: kept 12 months.
In-app notifications: kept 30 days.
Browser notification subscriptions: deleted when you turn notifications off, sign out on that browser or delete your account, or when the push service reports them expired.
Password-reset codes: expire after 10 minutes.

Your rights

Under the GDPR you can ask us at any time to access, correct, delete, or export your data, to restrict or object to certain processing, and to withdraw consent where processing is based on it. Write to [email protected]; we respond within one month. You can also lodge a complaint with your supervisory authority. In France, that's the CNIL (cnil.fr).

Children

Slam101 is intended for users aged 15 and over. Below that age, or below the higher minimum age set by your country, a parent or legal guardian must consent and accept these terms and this policy on your behalf. If a child has created an account without this consent, contact us at [email protected] and we will delete it.

Changes

We may update this policy. Material changes will be announced in the app or by email before they take effect.