Privacy Policy

1. Data controller

The controller of your personal data is Hub Juniorista, a fan website for Junior de Barranquilla, with no official affiliation with the club.

You may contact the controller at the email address indicated at the end of this policy, which serves as its contact address for the purposes of this policy.

2. Registration and sign-in

You can create your account with an email address and password, or sign in with your Google account.

When you sign in with Google, we receive from your profile the email address, name, and profile picture that Google shares with us.

3. Data we collect

We collect only the data needed to operate the site:

• Account data: email address, display name or username, your avatar URL (taken from your Google profile or a default avatar generated with DiceBear), and your role on the site.
• Content you create in the community: votes, comments, and match predictions.
• Technical data associated with site errors, when they occur, so we can fix them.
• Tifo campaign (/tifo-102): the display name and "supporter since" year you choose to enter — both optional and intended to be public on the image you share — your juniorista number, and a technical identifier derived from your IP address (a keyed hash, not the IP itself) used solely to detect abuse of the counter.

4. Purpose of processing

We use your data for the following purposes:

• Creating, managing, and authenticating your account.
• Showing your name and avatar alongside your community activity.
• Storing and displaying your votes, comments, and predictions.
• Understanding, in aggregate and anonymous form, how the site is used, in order to improve it.
• Detecting and fixing technical errors.
• Sending you transactional emails, such as account verification or password reset.

5. Legal basis and consent

We process your data based on your prior, express, and informed consent, which you give when you create your account and accept this policy, as well as to fulfill the relationship created by your use of the site.

You may revoke your consent at any time, as described in the data subject rights section.

6. Cookies

We use two essential cookies, and no advertising or third-party tracking cookies: the session cookie (Better Auth), which keeps you signed in as you browse; and `tifo_id`, a signed 90-day cookie for the tifo campaign whose only purpose is to remember which juniorista number you were already given, so reloading the page doesn't assign you another. It does not track your browsing and is not shared with anyone.

Our analytics tool (PostHog) runs in cookieless mode (in-memory only), so it sets no analytics cookie on your device. Because analytics is cookieless and both cookies we use are strictly necessary — the session cookie and the tifo cookie, neither of which tracks or advertises — no consent banner is required; they are disclosed within this privacy policy.

7. Analytics and error monitoring

We use PostHog to measure site usage in aggregate (page views, performance metrics, and product events), without setting cookies.

We use Sentry for error monitoring, which captures error or exception events that may include technical information about the context in which the error occurred.

8. Data processors and sub-processors

To operate the site, we share data with the following providers, which act as data processors:

• MongoDB Atlas — database.
• Vercel — web hosting.
• Railway — hosting for the API, background workers, and Redis.
• PostHog — analytics (cookieless).
• Sentry — error monitoring.
• Google — sign-in (OAuth).
• Cloudflare — anti-abuse verification (Turnstile). On the auth forms, to prevent bots from mass-creating accounts; and on the tifo campaign (/tifo-102) in invisible mode, with no interaction and no visual indication, to prevent automated inflation of the counter. Turnstile sets no tracking cookies. Cloudflare's processing is governed by its Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

Transactional emails (account verification and password reset) are sent from our own server.

9. International transfers

Some of the providers listed operate servers outside Colombia. By using the site, you authorize the international transfer of your data to these providers, who are required to maintain adequate levels of security and confidentiality.

10. Data retention

We keep your data while your account is active. If you delete your account, we delete or anonymize your personal data, except for data we must keep to comply with a legal obligation.

Tifo campaign data (/tifo-102) is kept for 90 days from your participation and then deleted automatically, whether or not you have an account.

11. Sensitive data

We do not collect sensitive data, understood as data that affects the data subject's privacy or whose misuse may lead to discrimination, as defined in article 6 of Law 1581 of 2012 (for example, racial or ethnic origin, political leanings, religious beliefs, health or sex-life data, among others).

If in the future we were to request sensitive data, providing it would be optional and would require your express, prior authorization.

12. Data subject rights

As the data subject, under Law 1581 of 2012, you have the right to:

• Know, update, and rectify your personal data.
• Request proof of the authorization given for its processing.
• Be informed about the use given to your personal data.
• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of the law.
• Revoke the authorization and/or request the deletion of the data.
• Access your personal data free of charge.

You can exercise these rights by writing to us at the contact email listed at the end of this policy; the procedure and time limits are detailed in the following section.

13. Procedure for queries and complaints

You can submit queries and complaints about the processing of your data through the contact email listed at the end of this policy.

• Queries: they will be answered within a maximum of ten (10) business days from receipt. When it is not possible to answer the query within that term, the interested party will be informed of the reasons for the delay and the date on which it will be answered, which in no case will exceed five (5) business days following the expiry of the first term.
• Complaints: if the complaint is incomplete, the interested party will be required, within five (5) days following its receipt, to correct the deficiencies. The complaint will be resolved within a maximum of fifteen (15) business days from the day following the date of its receipt. When it is not possible to resolve it within that term, the interested party will be informed of the reasons for the delay and the date on which it will be resolved, which in no case will exceed eight (8) business days following the expiry of the first term.

14. Complaint to the SIC

If you believe your rights have not been properly addressed, you have the right to file a complaint with the Superintendency of Industry and Commerce (SIC), Colombia's data-protection authority. Beforehand, you must have exhausted the query or complaint process with us.

15. Minors

The site is not directed at minors. If you are a minor, you should only use the site with the authorization and supervision of your parents or legal guardians.

16. Effective date and validity

This policy takes effect on the last-updated date shown at the top of this document.

As for the validity period of the database, your personal data is kept while your account is active and for as long as necessary to fulfill the purposes described in this policy or a legal obligation, in line with the data retention section.

17. Changes to this policy

We may update this privacy policy when necessary. We will publish the current version along with its last-updated date. Continued use of the site implies acceptance of the current version.