Last updated: September 01, 2026
This Privacy Notice for KITOYA ("we", "us", or "our") describes how and why we may access, collect, store, use, and/or share ("process") your personal information when you use our mobile application Kitoya, available on the Apple App Store and Google Play Store.
Kitoya is a mobile application designed for football shirt collectors to easily manage, organize, and showcase their personal jersey collections, track statistics, and catalog details like eras, brands, and editions.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use the Service. If you still have any questions, please contact us at hello@kitoya.com.
What personal information do we process? When you use Kitoya, we process the email address you register with, and any content you choose to upload (jersey photos, collection details).
Do we process any sensitive personal information? No, we do not process sensitive personal information (such as racial or ethnic origin, sexual orientation, or religious beliefs).
Do we collect any information from third parties? No, other than the basic profile information provided through Google Sign-In if you choose to use it.
How do we process your information? We process your information to provide and operate the Service, manage your subscription, communicate with you, ensure security, and comply with legal obligations.
How do we keep your information safe? We use industry-standard technical and organizational measures, including encrypted storage and secure third-party providers.
In short: we collect personal information that you provide to us directly.
We collect personal information that you voluntarily provide when you register for an account, use the Service, or contact us. This may include:
Sensitive Information. We do not process sensitive information.
Payment Data. If you subscribe to Kitoya Premium, your subscription and payment are handled entirely by RevenueCat, in conjunction with the Apple App Store or Google Play Store. We never see or store your card details. You can review RevenueCat's privacy notice here: https://www.revenuecat.com/privacy.
Social Login Data. We offer the option to register or log in using your Google account. If you choose this, we receive certain basic profile information from Google (such as your name and email address), as described in the section "How do we handle your social logins?" below.
User Content. When you use Kitoya, you may upload photos of your jersey collection. These photos are stored securely via Cloudflare R2 and are processed through a background-removal service (currently remove.bg or FAPIhub) to isolate the jersey from its background. You retain full ownership of any content you upload.
Application Data. If you use our application, we may collect the following if you grant permission:
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In short: we process your information to provide, improve, and administer the Service, communicate with you, for security purposes, and to comply with the law.
In short: we only process your personal information when we have a valid legal reason to do so.
As we are located in the EU, we rely on the following legal bases under the GDPR:
In short: we do not sell your personal data. We share it only with the service providers necessary to operate Kitoya.
We work with the following categories of service providers, each of whom is contractually obligated to protect your data and use it only to perform services on our behalf:
| Category | Provider(s) | Purpose |
|---|---|---|
| Cloud hosting & database | Neon (PostgreSQL), OVH (VPS) | Storing account and collection data |
| File storage | Cloudflare R2 | Storing jersey photos |
| Payment processing | RevenueCat, Apple App Store, Google Play | Managing subscriptions and payments |
| Email delivery | Resend | Sending password reset and transactional emails |
| Error monitoring | Sentry | Detecting and fixing bugs |
| Authentication | Google Sign-In | Optional account login |
| Sports data & image processing | API-Football / FAPIhub, remove.bg | Club lookup and jersey photo background removal |
We may also disclose your information if required by law, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you before your data is transferred).
In short: if you register using Google, we receive certain basic profile information from Google.
Kitoya offers the option to register or log in using your Google account. If you choose this, we will receive basic profile information from Google, typically your name, email address, and profile picture. We only use this information for the purposes described in this Privacy Notice. We do not control, and are not responsible for, Google's own use of your data — please review Google's privacy policy for more information.
We keep your personal information for as long as your account is active, or as needed to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we will delete or anonymize your personal information, except where retention is required by law.
We use appropriate technical and organizational security measures to protect your personal information, including encrypted data transmission (HTTPS/SSL) and secure, reputable third-party infrastructure providers. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Kitoya is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. By using the Service, you confirm that you are at least 18 years old. If we learn that we have collected information from someone under 18, we will promptly delete that account and data. If you believe a minor has provided us with information, please contact us at hello@kitoya.com.
If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:
To exercise any of these rights, please contact us at hello@kitoya.com. We will respond within one month. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), at www.cnil.fr.
You can review or update your account information at any time from within the app's settings. You can request deletion of your account directly from the app, or by emailing hello@kitoya.com. Upon deletion, we will remove your data from our active databases, except where retention is required by law.
In short: if you are a resident of California or another US state with a comprehensive privacy law, you may have additional rights regarding your personal information.
These rights may include the right to know what personal information we hold about you, the right to request its deletion, the right to correct inaccuracies, and the right to non-discrimination for exercising these rights. To exercise these rights, please email us at hello@kitoya.com. We will verify your identity before processing your request.
We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date. If we make material changes, we will notify you via email or an in-app notification.
If you have questions or comments about this notice, you may email us at hello@kitoya.com, or contact us by post at:
KITOYA
8 Bis Rue de Quenne
Augy, Bourgogne-Franche-Comté 89290
France