This document is a pre-release DRAFT — it must be reviewed by a lawyer before publication.
Privacy Notice
1. Data controller
TO BE COMPLETED: the controller's name, registered address and email address, plus the contact details of the data protection officer if one has been appointed.
2. What data we process
Account data: email address, display name and sign-in timestamps. Application data: the matches, teams, players and events you record. Subscription data: the state of your trial and subscription, along with the subscription identifier we receive from Paddle.
3. Where we store your data
Your data is stored by Supabase (PostgreSQL) in a project running inside the European Union, in the eu-west-1 region. Only your own account can reach your data; access is restricted by database-level authorisation rules.
4. Signing in with Google
If you sign in with a Google account, Google OAuth gives us your email address, your name and the URL of your profile picture. No password is stored in that case, and we have no access to any other content in your Google account.
5. Payment data
Payments are handled by Paddle.com Market Ltd. acting as reseller (Merchant of Record). Card and billing details are processed by Paddle; the provider neither sees nor stores them, and receives only the status and identifier of the subscription.
6. Retention and deletion
We keep your data for as long as your account exists. You can request deletion of your account at the support email address; the match and statistics data belonging to the account are deleted along with it. TO BE COMPLETED: the statutory retention period for billing records.
7. Your rights
Under the GDPR you may request access to your data, its rectification or erasure, and restriction of processing; you may also exercise your right to data portability and object to processing. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
8. Contact
TO BE COMPLETED: the email address to use for data protection enquiries.