Privacy notice

Messi Moments is an unofficial fan community. We are not affiliated with Lionel Messi, his representatives, clubs, federations, or licensed brands. This notice explains how we process data when you use the site.

Who we are

We operate a web service without traditional user accounts. You can browse, vote, and publish fan memories without signing up. Contact the site operator at abuse@messimoments.example (placeholder mailbox — replace with a monitored address before public launch).

What we process

• Visitor identifier — sealed httpOnly cookie (HMAC) so we can offer one active vote per moment, rate-limit abuse, and associate posts with a creator.
• IP and user-agent hashes — we do not store raw IP; hashes support rate limits and safety forensics.
• Content you publish — text, photos, short videos, optional nickname, country, and category.
• Votes and reports — visitor↔moment links and report reasons/notes.
• Product analytics events — only if you consent to non-essential analytics (when enabled).
• Manage token — shown once at create time; we store only a SHA-256 hash.

Legal bases (draft)

Legitimate interest (vote integrity, abuse prevention, security) for the essential visitor cookie and hashes. Publishing content is at your request. Non-essential analytics, if any, rely on consent. This text is not legal advice and will be counsel-reviewed before open EU traffic.

Cookies

We use an essential visitor cookie so voting and create work and so we can limit abuse. It is not an advertising cookie. Optional analytics only run with consent. Clearing cookies mints a new visitor identity — vote integrity is best-effort, not cryptographic one-person-one-vote.

Retention

• Idle visitor: target ~13 months, then cleanup.
• IP/UA hashes: ~90 days operational use.
• Moments and media: until you delete them or we moderate; backups ≤30 days.
• Reports: ~12 months.
• Security logs: ~30 days.

Your rights (access & erase)

While you still have the visitor cookie, you can request a summary via the visitor API (id, owned moments, active vote count — no IP). You can erase your visitor footprint (deleted_at tombstone; the same id is never revived). That retracts votes, adjusts counts, and soft-removes moments you own.

For a single post: use the manage token shown at create. If you lose it, email abuse@messimoments.example with the share URL and approximate create time. We may hide content on policy grounds; you accept permanent loss of manage control if proof is insufficient. We cannot re-send the token.

Transfers & subprocessors

Depending on deployment: hosting (e.g. Vercel), database (e.g. Neon/Postgres), object storage/CDN (e.g. Cloudflare R2), rate limits (Upstash), CAPTCHA (Cloudflare Turnstile), and optional analytics. We prefer EU regions where feasible and vendor DPAs / SCCs.

Children

There is no age gate because there are no accounts. Sexualization of minors is prohibited. Non-sexual family photos may be acceptable under the content policy; minor-safety reports are prioritized.

Contact

Privacy, DSR, abuse, or copyright: abuse@messimoments.example. Target for serious abuse hide/response: 48 business hours once the mailbox is monitored.

Unofficial fan community. Not affiliated with Lionel Messi, his representatives, or clubs.