Privacy Policy

This policy explains, in plain language, what personal data Pontuu uses, why, and what you can do about it. It applies to the Pontuu app (iPhone, iPad and Android), the website pontuu.com and the web app app.pontuu.com.

Last updated: November 15, 2026For users in Brazil, the Portuguese (Brazil) version of this document prevails. For everyone else, the English version prevails.

Who we are

Pontuu is provided by R.H. MURAZAWA COMERCIO LTDA, a company registered in Brazil under CNPJ 54.811.533/0001-82. We are the controller of your personal data under Brazil’s General Data Protection Law (LGPD) and, where it applies, the European Union and United Kingdom General Data Protection Regulation (GDPR).

For any question about your data or to exercise your rights, write to support@pontuu.com. This is also our channel for the Brazilian National Data Protection Authority (ANPD).

Data we collect

We only collect what we need to run Pontuu:

Account: your e-mail address and name. If you use Sign in with Apple or Sign in with Google, we also receive your account identifier from Apple or Google. Apple may give us a private relay e-mail address instead of your real one.
Sign-in security: one-time sign-in codes, valid for 10 minutes, and session identifiers. Both are stored only in scrambled (hashed) form. We never ask for or store passwords.
Profile (optional): photo link, city, country, language, sports, level, a short bio and whether you are a player, coach or club.
Contacts (optional): WhatsApp, phone, e-mail, Instagram, Facebook, TikTok, YouTube and website. For each one, you choose who can see it: everyone, my group, or only me. “My group” means people in a group with you, your coaches or students with an accepted class, and members of the same club.
Games: matches you create or score, the points, and the names typed for the players; the groups you join, your attendance for the weekly game, and invitations.
Classes and clubs (optional): the weekly times a coach offers, class requests (date, time and an optional short note), their answers, and the links between coaches, clubs and members.
Technical data: your IP address and basic device and browser information, used briefly to keep the service secure (for example, to block repeated sign-in attempts). They also appear in server logs.

We do not show ads, we do not use ad trackers or analytics tools, and we never sell your data.

Features that are coming

Some features are not available yet. When they are, these rules will apply:

Heart rate and other watch data are health data. We will only use them with your explicit consent, which you can withdraw at any time.
Photos and videos will only be published with the consent of the people who appear in them. Minors need permission from a parent or guardian.
Payments for classes and court bookings will be processed by Stripe. Stripe keeps identity documents, tax numbers and bank details; Pontuu only stores the Stripe account identifier and its status.
Subscriptions will be sold through the Apple App Store, Google Play or our website (through Stripe), and managed with RevenueCat. We do not receive your full card details.

How we use your data, and why we are allowed to

Each use has a legal basis under the LGPD and the GDPR:

To provide Pontuu (scoring, live scores, groups, invitations, rankings, statistics, classes and your account): necessary to perform our contract with you.
To send sign-in codes and important service messages: necessary to perform our contract with you.
To keep Pontuu secure, prevent fraud and abuse, and fix problems: our legitimate interest, always balanced against your rights.
To use health data, publish photos and videos, and offer optional features: your consent, which you can withdraw at any time.
To keep records and answer authorities when the law requires it: compliance with a legal obligation.

International transfers

Some of these providers store data outside your country, mainly in the United States. We only transfer data with the safeguards required by law, such as standard contractual clauses (article 33 of the LGPD and the GDPR).

How long we keep data

Account, profile, contacts, games and classes: while your account is active.
Sign-in codes: 10 minutes. Sessions: up to 180 days, or until you sign out.
Server logs: up to 30 days.
When you delete your account, your data is removed from the service right away and purged from backups and logs within 30 days. Matches remain with the players’ names, without any link to your account. Classes and club links are deleted for both people.
We keep data longer only when the law requires it, and only for the period it requires.

Your rights

Under the LGPD (article 18) and, where it applies, the GDPR, you can:

confirm that we process your data, and access it;
correct incomplete, wrong or outdated data;
export your data (in the app or at app.pontuu.com: My account → Download my data);
delete your account and your data (see the Delete account page);
withdraw your consent at any time;
object to processing based on our legitimate interest, and ask for unnecessary data to be anonymized, blocked or deleted;
ask which companies we share your data with;
complain to the Brazilian authority (ANPD) or to the data protection authority in your country.

To exercise any right, write to support@pontuu.com. We reply within 15 days.

Cookies

We only use two cookies, and both are necessary:

pontuu_sessao: keeps you signed in. It is essential and cannot be read by scripts on the page.
idioma: remembers your language.

We do not use advertising or tracking cookies.

Children

Pontuu is not intended for children under 13. Teenagers aged 13 to 17 may use it with permission from a parent or guardian. If you believe a child under 13 has given us personal data, write to support@pontuu.com and we will delete it.

Security

We use encrypted connections (HTTPS), sign-in without passwords, codes and sessions stored in scrambled form, limits on repeated attempts, and restricted access to data. No system is 100% secure: if an incident may put you at risk, we will notify you and the authorities as the law requires.

Data from Google

When you use Sign in with Google, we only receive your name, e-mail address and Google account identifier, and we only use them to create and secure your Pontuu account.

Pontuu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If we change this policy, we will tell you in the app and on this page before the change takes effect. The date at the top shows the current version.

Contact

R.H. MURAZAWA COMERCIO LTDA · CNPJ 54.811.533/0001-82 · support@pontuu.com

Pontuu is provided by R.H. MURAZAWA COMERCIO LTDA · CNPJ 54.811.533/0001-82 · support@pontuu.com