Privacy Policy.

1. Who we are

Nomad Floripa (nomadfloripa.com) and Nomad Volleyball (nomadvolleyball.com) are one community with one account, run by Artifexon Design Ltda, CNPJ 52.422.571/0001-18, Rua Moçambique, 691, São João do Rio Vermelho, CEP 88060-415, Florianópolis, SC, Brazil (“we”, “us”). We decide how your personal data is used, so we are its controller under Brazil’s General Data Protection Law (LGPD, Lei nº 13.709/2018).

For anything about your data, write to artifexon@gmail.com. Rikki, who runs the community, answers it. As a small organisation we have not named a separate data protection officer (ANPD Resolution nº 2/2022); this address is the channel for you and for the authority.

2. What we collect and why

The legal bases are those of LGPD art. 7: to run the service you signed up for (contract), to meet a legal duty (legal obligation), our legitimate interest where it doesn’t override yours, and your consent where we ask for it.

Your account

Your email, and a password (kept by Google’s sign-in service as a one-way hash — we never see it) or your Google sign-in, which gives us your name, email and Google picture. Why: to log you in on both sites. Basis: contract.

Your profile

Your name, WhatsApp number, a picture if you add one, man or woman, whether you’ve played with us before, your level, the sports you play, whether you know the beach rules, your football position and level, and meat, vegetarian or vegan for the BBQ. Why: to put you on the lists and reach you about your place, set the price (new or existing player — decided automatically from your answer), balance teams, and plan the BBQ. Football is a men’s game, which is why we ask man or woman. We don’t ask your age, nationality or any document. Basis: contract.

Games, payments and points

The lists you join, check-ins, what you paid and when, the proof of payment you upload (a Pix receipt, which can show your name, bank and part of your CPF), credit held for you, your points and free games, and your monthly football membership — and, if you ask to be told when a mensalista place frees, your name and when you asked, on the mensalista list (signed-in members see the list, as they see the week’s). On a football night, Rikki notes whether you came late, left early or didn’t come, the Wednesdays you told him you’d be away, and what you owe from a night you played and didn’t pay — only those who played vote and rate. Why: to run the lists, confirm payments and keep the accounts. Basis: contract, and legal obligation for accounting records.

Booking as a guest

Your name and WhatsApp number, on the list you book. Basis: contract.

Football ratings and teams

After a game, players can rate each other from 1 to 5 and leave Rikki a note. Only Rikki sees who gave what, and the notes. Each player’s rating — the average the others gave them once enough have rated them, until then the level they told us — makes the teams fair, and is shown beside their name on the teams to everyone on that night’s list (never to visitors). You also see your own total. Players can also say where each teammate on their own team plays best (Attack, Midfield or Defence): only Rikki sees who said what; once enough agree, the player is told what his teammates say and decides himself — it never changes a profile, and it balances the teams only for someone who said he plays anywhere. The vote for the game’s best player (MVP) is open: signed-in members can see it. Basis: legitimate interest (balanced games). You can object — see section 6.

Tournaments

Your team, its members’ names, matches and scores, and who changed a score. Basis: contract.

What you post

Events, places to rent, “looking for” posts (and freelance profiles and jobs, when that area is open): what you write, photos, prices and area. A place’s exact address and your WhatsApp number are kept private and given only to a member who taps Enquire or Contact — we record who asked, to stop abuse. Rikki checks every post before it goes live. Reports you make about a post are kept too. Basis: contract; legitimate interest (keeping people safe from scams).

Messages from us

Notices in Your area (such as a post approved), and push notifications if you turn on the pitch alarm, which needs your browser’s push address. Football emails that run the lists: a place opened for you on the waiting list or the mensalista list (with when to pay by), and a mensalista’s reminders — confirm your week on Sunday, next month due on the 25th, this month unpaid on the 5th. Basis: contract; consent for push — turn it off any time.

Coupons, surveys and notes

The Arena Beach coupon codes you create (you send them to Arena yourself). Your answers if you fill in a tournament survey (name, email, WhatsApp and your views) — basis: consent. Notes and tags Rikki keeps about members to run the community, such as who owes a payment — basis: legitimate interest; ask and we’ll show you yours.

How the sites are used (our own analytics, and Google Analytics)

We keep our own record of how both sites are used: the screens you open and the buttons you tap; the goals you reach — joining a WhatsApp group, starting or finishing sign-up, taking a place, paying, sending a Rentals form, sharing a list; how long you stay; errors and slow loading; the link you came by (its campaign tag, such as “instagram”, and the site it came from); roughly where you are — country, state and city, which Cloudflare works out from your connection (we never see or keep your IP address); and your device (browser, operating system, phone or computer, language and time zone). Never what you type — not your name, email, phone number, or anything in a form. It is linked to your account if you’re signed in, or else to a random device number kept for 13 months. When you create an account we also save on it how you first found us: the tag of the first link you arrived by, and the page you landed on. Why: to find and fix what’s broken, and to learn who the community reaches and what brings people to it, so we can run it better. Basis: legitimate interest. We weighed it against your privacy, and it is kept narrow for that reason: only Rikki sees it (and you, in Download your data); it is never used to decide anything about you, never used for advertising, never sold and never given to anyone else; and the totals we keep for good have no person in them (section 5). You can object at any time: switch it off in section 7, or under Your data in your profile — signed in, that stops it for your account on every browser and phone, and deletes the visits we hold for it. Our own record stays in our own database (Firebase, São Paulo).

Google Analytics. We also use Google Analytics 4, run by Google, to measure how the sites are used in the way its reports show: the pages you view; the link you came by (its campaign tag and the site it came from); roughly where you are; your browser and device; and the goals above, each as a plain event name such as “paid” with at most one word, a sport or a group. We send it each page’s address cut down to its path — never a query that could carry a code or a name, and never the part after a “#” — and never what you type, your name, your email or your account. Google sets two cookies for this (section 7) and receives your connection’s IP address, as any website you visit does; Google says Analytics does not log or store it. We have switched off Google’s advertising features (Google signals and ad personalisation), so it is used for measurement only, and Google handles the data under its own privacy policy. Why: to see how people find and use the sites, alongside Google Search. Basis: your consent. It runs only after you tap Accept on the notice at the foot of the page; until then, or after Reject, nothing is sent to Google and no cookie is set. You can take it back at any time — in section 7, or under Your data in your profile — as easily as you gave it, and it stays off if your browser sends Global Privacy Control or Do Not Track, even after Accept.

3. Who sees what

• Anyone: approved events and places to rent — their text, photos, price, area and the name they’re posted under (as “Alex R.”).
• Signed-in members: your card (name as “Alex R.”, picture, level, sports, when you joined, points), your name on game lists and tournament teams.
• Everyone on a football night’s list: each player’s rating, beside their name on that night’s teams (section 2).
• The community WhatsApp groups: the week’s list, with the names on it, is posted there. On the BBQ list, a vegan or vegetarian gets a mark beside their name (🌱 or 🥗), so the cook knows they bring their own food — members see it on the BBQ list too.
• Someone you deal with: your WhatsApp number, when they enquire about your post or you enquire about theirs.
• Rikki (the only admin): what he needs to run the community — your details, payments and proofs of payment.
• Google (Analytics) and Cloudflare: the address of each page you open (without any code or name in it), the link you came by, your browser and device, and your connection — as sections 2 and 4 describe. Not your name, email, phone number or account.

We never sell or rent your data, and we don’t share it for advertising. We would disclose it only if the law or a court requires us to.

4. Our providers, and data outside Brazil

These companies process data for us, only to provide their service:

• Google (Firebase) — sign-in, the database, photo storage and our server code. The database and server code are in São Paulo, Brazil; sign-in runs on Google’s worldwide network.
• Cloudflare — hosts and delivers the sites, on a worldwide network. It also tells our server, for each visit, roughly where the connection is from (country, state, city); that is used for the analytics above, and the IP address itself is never kept by us. Cloudflare also counts page loads and how fast they were (its Web Analytics, which sets no cookies and is not used for advertising); it sees the page address and your connection, as it does for any site it delivers.
• Google Analytics — measures how the sites are used (section 2). It runs on Google’s worldwide network, so what it receives — the cleaned page address, the campaign tag, your browser and device, and your connection’s address — is processed outside Brazil, including in the United States. Only if you accept it (section 2).
• Resend — sends the emails your account relies on (confirm your email, welcome, reset your password, account deleted) and, for football, the one that says a monthly player missed the confirm deadline, the one that says a place opened for you on the waiting list, and the ones in Messages from us above: it receives your email address, your first name and the link in the email. It sends them from São Paulo, Brazil, with open and click tracking switched off; as a US company it may also process that data in the United States, which is needed to send you those emails (LGPD art. 33 IX).
• OpenStreetMap — the map tiles on Rentals; your browser fetches them directly, so OpenStreetMap sees your IP address.

Where data leaves Brazil, it does so under the safeguards these providers give under LGPD art. 33, such as standard contractual clauses. Google Analytics runs only on your consent (section 2), and what it receives goes to the United States under the Brazilian standard contractual clauses in Google’s data processing terms (LGPD art. 33 II b). When you tap a WhatsApp or Google Maps link, or sign in with Google, you are using that company’s service under its own privacy policy.

5. How long we keep it

• Your account and profile: until you delete your account. Deleting it removes your profile, picture, lists, posts, points, your ratings total, proofs of payment, Rikki’s notes about you and your usage log, on both sites, at once.
• Payment records (who paid what, when, for which game): 5 years, even after you delete your account, because Brazilian tax and accounting law requires it (LGPD art. 16).
• Places to rent: they stop showing on their end date and are deleted 30 days later unless you renew them. “Looking for” posts show for 30 days.
• The usage record (each visit, tap and goal): 13 months, then deleted. What stays are daily totals — counts such as “how many visits came from Instagram” or “how many people created an account” — with no person, device or account in them, kept so one year can be compared with the next.
• Google Analytics data: 14 months, then Google deletes it. Its two cookies last 13 months.
• Guest bookings: as long as needed to run that game and keep the accounts — ask and we’ll delete them sooner.

6. Your rights

Under LGPD art. 18 you can ask us to confirm we hold your data, show it to you, correct it, anonymise, block or delete what isn’t needed, give you a copy to take elsewhere, delete what we hold on your consent, tell you who we share it with, and withdraw your consent. You can object to what we do on legitimate interest — including the counting in section 2, which you can switch off yourself in section 7 — and ask for a person to review a decision made automatically (art. 20) — like your price, which follows your answer on whether you’ve played with us before.

• In your profile: change your details; under Your data, Download your data (a copy of everything that’s yours, the record of your visits included) and switch the counting off; and Delete account.
• By email: anything else, at artifexon@gmail.com. We answer within 15 days.

If you’re not happy with our answer, you can complain to Brazil’s data protection authority, the ANPD (gov.br/anpd).

7. Cookies and storage on your device

We use no advertising cookies and no advertising trackers. The only cookies on the sites are Google Analytics’ two, _ga and _ga_SP7EPYYMXJ, set only if you accept Google Analytics, on the site you are on, and kept for 13 months to tell one visit from another; they are not needed for the sites to work, so they wait for your yes, and Stop below removes them. The sites also keep a few things in your browser’s own storage. To work: your sign-in (kept by Google’s sign-in service), a note that you’re signed in so the right screen shows first, and recent screens so tabs open instantly — these are needed, so we don’t ask first. To count visits: a random device number (13 months) and a note of the link you first arrived by — these are not needed for the sites to work, so the counting switch below covers them. Clearing your browser’s site data removes all of it and logs you out.

What is kept, exactly:

• Cookies — Google Analytics (optional; only after you tap Accept — Stop below removes them): _ga and _ga_SP7EPYYMXJ, set on the site you are on, 13 months, to tell one visitor’s visits apart and keep a visit together.
• Browser storage — visit counting (optional; the same switch): nomad-did, a random device number, and nomad-first, the tag and landing page of the first link you came by — kept for 13 months; nomad-sid, nomad-sid-n and nomad-geo, this visit, how many batches of it were sent, and its country and city — until you close the tab.
• Browser storage — to work (needed): your sign-in, kept by Google’s sign-in service until you sign out; nomad-session* and nf-hi, a note that you are signed in and your first name, so the right screen shows first; nf-snap:*, recent screens so tabs open instantly — until you close the tab, and at most 10 minutes; nomad-legal-seen, that you have answered our notice about these pages; nomad-ga, your answer on Google Analytics (Accept or Reject); nomad-log-off, your choice on the counting switch.
• Sent to Cloudflare: its Web Analytics counts page loads without setting a cookie.

Allow Google Analytics is off in this browser.

Stop counting my visits Your visits are being counted.

The switches work for this browser. Google Analytics: Allow gives the yes the notice asks for; Stop takes it back, deletes its cookies, and nothing more is sent to Google. It also stays off if your browser sends Global Privacy Control or Do Not Track. Counting: stopping it forgets the device number and first-link note at once, records nothing more, and stops Google Analytics too. Use them again on each browser or phone you use — a browser keeps each site’s answers apart, so on nomadvolleyball.com change your Google Analytics answer on its notice. Signed in, Your data in your profile (on either site) does more: stopping the counting there stops it for your account on every browser and phone, and deletes the visits we already hold for it. To have everything else we hold about you deleted, delete your account (section 6); Google Analytics keeps nothing that is tied to your account, and its data expires after 14 months.

8. Security

Every connection is encrypted, database rules decide who can read each record, proofs of payment are visible only to you and Rikki, and only Rikki’s account has admin access. If a security incident could put you at risk, we will tell you and the ANPD (LGPD art. 48).

9. Age

The community is for adults. Don’t create an account if you’re under 18. If we learn we hold a child’s or teenager’s data, we delete it.

10. Changes and language

When this policy changes we update the date at the top, and tell you on the site or in the WhatsApp group if the change matters. This policy is also in Portuguese; if the two differ, the Portuguese version prevails. Our Terms of Use cover the rest of how the community works.