Bingofy privacy policy

Updated October 1, 2026

Operator and data controller: Jose Eduardo Saura Oller

Address: Puigmarti 42, 4 2

Contact:contact@bingofy.co

About Bingofy and this policy

Bingofy is a web app for creating music bingo games from Spotify playlists and downloading printable bingo cards. This policy applies to the Bingofy website, accounts, Google sign-in, games, purchases and support. The operator and data controller responsible for this processing is identified above; contact us at contact@bingofy.co with privacy questions or requests.

Data and purposes

We manage accounts with email and password or Google sign-in. We process your account ID, email and profile information provided by the sign-in provider, and store the games and playlists you choose to generate cards. This processing is necessary to provide the service you request. Rejecting optional analytics and advertising does not prevent you from registering, signing in, creating games or accessing your purchases.

If you connect Spotify, you authorize the permissions shown by Spotify to access public, private and collaborative playlists and your email. We store the tokens needed for that connection; you can disconnect it in Bingofy or revoke access in Spotify.

We record your acceptance of the terms, with date, language and version.

Account and purchase information is necessary to create your account, process the order and provide your cards. Without it, we cannot complete those functions. Connecting Spotify and enabling optional measurement are not required to buy cards from a supported public playlist.

Google sign-in: data we access and why

Google sign-in is an optional way to create or access your Bingofy account. When you choose it, Google authenticates you and shares basic account information with our authentication provider, Supabase: your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture, when available. This corresponds to the basic OpenID Connect sign-in permissions: openid, email and profile. Bingofy does not receive your Google password or request access to Gmail messages, Google Drive files, Google Calendar or Google Contacts.

We use this information to identify you, create or link your Bingofy account, establish your signed-in session and associate your games and purchases with your account. Your name may appear in your account interface, and your email lets us provide necessary account, purchase and support communications. The legal basis for this account processing is providing the service you request. You can also register with email and password.

Google sign-in: storage, protection and sharing

Supabase stores your account and Google identity information as our authentication and database provider. Bingofy uses authentication session cookies in your browser to keep you signed in. Authentication credentials and tokens are handled by the sign-in service; Bingofy does not use Google access tokens to read other Google services. Our application uses encrypted connections and session cookies configured as Secure, HttpOnly and SameSite=Lax, together with access controls to protect account data.

Account information is processed by the service providers listed below where needed to operate Bingofy. For example, your account email is shared with Polar when you purchase cards, and with service providers handling a support request you submit. When optional analytics is enabled, your Bingofy account ID, email and profile name are sent to PostHog as described in the analytics section, including when those details came from Google sign-in. You can disable that processing in Cookie settings.

We do not sell Google user data or use it for personalized advertising. We may disclose information when required by law or necessary to protect the service and users against fraud or abuse. Google sign-in does not subscribe you to marketing emails.

Google sign-in: retention, revocation and deletion

We retain the Google identity and profile information associated with your Bingofy account while the account remains open. You can revoke Bingofy’s Google connection in the third-party connections settings of your Google Account. Revoking the connection prevents future Google sign-ins through that authorization; it does not itself delete your Bingofy account, existing session or previously stored data.

To request deletion of your Bingofy account and its stored Google information, email contact@bingofy.co from your account email address. We verify the request, delete the account information and associated data, and ask relevant service providers to delete data processed on our behalf where applicable. Information we must retain to meet legal obligations or resolve disputes is kept only for those purposes for the required period, as explained below. If you want to stop using the current session, also sign out of Bingofy.

Purchases and contact

To process purchases we share your email, IP address and game reference with Polar, and record payment status, reference and date. Polar operates checkout and acts as reseller. We do not receive your full card number. The legal bases are performance of the contract and applicable legal obligations.

We use information you submit in forms or email to reply and handle requests and refunds. The legal bases are handling your request, preparing or performing the contract and meeting applicable obligations. Contacting us does not add you to any mailing list, and we never send you advertising.

Service emails and product updates

We may email you as necessary to manage account access, confirm purchases, handle requests or communicate security incidents and changes that directly affect the service you use. These messages help provide and protect the service, based on the contractual relationship, legal obligations or our legitimate interest in security, depending on the message.

Occasionally, we may also email account holders about important product changes, such as significant changes to how Bingofy works, to features you use or to its availability. These emails are infrequent and never include advertising or promotions. The legal basis is our legitimate interest in keeping you informed about the service you use.

Every one of these emails includes a link to stop receiving them, and you can also object at any time by writing to contact@bingofy.co. Unsubscribing does not affect your use of Bingofy or the necessary service emails described above.

Optional analytics and advertising

We use PostHog to understand visits and product usage, diagnose problems and measure purchases. When analytics is enabled, this includes pages visited, URLs, clicks and other interactions, technical identifiers and usage events. Depending on our PostHog settings, this can include page content and sequences of clicks, scrolling and navigation, allowing us to reconstruct how you used Bingofy and investigate problems. Surveys and feature evaluation may also operate according to our PostHog project settings.

If you sign in while analytics is enabled, we send PostHog your account ID, email and profile name to connect activity with your account. Purchase events include the product, number of cards, checkout or order reference, amount and currency. This identification does not subscribe you to product emails.

In Europe and when the country is unknown, analytics starts only with your consent. Outside Europe this configuration starts it unless a stored choice rejects it. You can disable it in Cookie settings. We save the analytics permission with the checkout and synchronize explicit choices with your account when signed in, so payment notifications can apply that permission and later saved withdrawals. If synchronization fails, it is retried on a later page load.

Google Ads follows the same country settings: acceptance is required in Europe or when the country is unknown, and it starts outside Europe unless a stored choice rejects it. It may process device information, IP, campaign identifiers and conversion data such as purchase reference, amount and currency. Ad personalization is disabled. You can change each permission in Cookie settings.

Security and providers

Technical connection and security data help protect the service and prevent abuse, based on the legitimate interest in keeping it secure. Cloudflare supplies an approximate country derived from the IP to apply the regional cookie settings. Google reCAPTCHA loads when you activate the protected venue submission form.

Retention

We retain your account and games while you keep the account, until you request deletion. Requests are retained while being handled and for the periods needed to address potential liabilities. Records subject to tax or accounting obligations are retained for the applicable statutory periods. Cookie lifetimes are explained in the cookie policy.

International services

Providers may operate or allow access from countries outside the European Economic Area. You can request information on recipients and safeguards applicable to a transfer, including a copy of available safeguards, by contacting us. Provider policies are linked below.

Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent to optional processing. Email contact@bingofy.co with your request. We respond without undue delay and generally within one month; any legally permitted extension is communicated with its reason.

You may lodge a complaint with the Spanish Data Protection Agency or your competent supervisory authority.

Withdrawing consent does not affect the lawfulness of processing before withdrawal. We will use the minimum information necessary to confirm your identity when handling a request, and only ask for additional information if there are reasonable doubts.

Children

Participants can play with printed cards without creating an account or providing their information to Bingofy. Organizers should choose music and content suitable for their group.

If you identify unauthorized processing of a minor’s data, email contact@bingofy.co. We will investigate and take necessary action, including restricting the account or deleting data where appropriate.

Security, breaches and changes

We use access controls and encrypted connections. Where required, we notify breaches to the authority without undue delay and, where feasible, within 72 hours of becoming aware; people affected by high risk will be informed without undue delay. We publish policy changes here and request new consent when needed.