Privacy Policy

Last updated: [[DATE]]

This policy explains what happens to your data when you use Score Guru — the website at [[DOMAIN]] and the Android app. We keep it short because we collect very little.

The short version

• You do not need an account. We do not ask for your name, email or phone number.
• We do not use analytics, tracking or ads today.
• Our servers see your IP address when you connect, like every website. We keep these logs for a short time, for security.
• If you turn on match alerts, we store a push token so we can send them. Turn alerts off and the token is deleted.
• Your settings (like your time zone) stay on your own device.

1. Who we are

The service is run by one person, who is the "controller" of your data under the GDPR:

• Name: [[OPERATOR FULL NAME]]
• Address: [[POSTAL ADDRESS]], [[OPERATOR COUNTRY]]
• Email: [[PRIVACY EMAIL, e.g. privacy@DOMAIN]]

We do not have a Data Protection Officer. We are not required to have one. Write to the email above with any question.

2. What data we handle, and why

2.1 Connection data (website and app)

When your browser or the app connects to our servers, they receive technical data:

• your IP address,
• date and time of the request,
• the page or data requested,
• browser or app version and device type (the "user agent").

Why: to deliver the scores to you, keep the service running, stop abuse (for example too many requests from one address) and fix errors.

Legal basis: our legitimate interest in running a safe and working service (GDPR Art. 6(1)(f)).

How long: server logs are deleted after [[14]] days. If a log shows an attack, we may keep that part longer, only as long as needed to deal with it.

We do not use IP addresses to find out who you are, and we do not build profiles.

2.2 Cloudflare (website and app)

Our website and servers are behind Cloudflare. Cloudflare protects us from attacks and makes pages load faster. To do this, Cloudflare processes your connection data (including IP address) for us. It may set a strictly necessary security cookie (for example __cf_bm) to tell people from bots. This cookie is not used for tracking.

Legal basis: our legitimate interest in security and speed (GDPR Art. 6(1)(f)).

2.3 Match alerts — push notifications (Android app, only if you turn them on)

If you turn on alerts (for example wickets, fours, sixes, results), the app gets a push token from Google's Firebase Cloud Messaging. A push token is a random code for this app on this device. It does not show your name. We store the token and your alert choices (which matches or teams you follow) so we can send the alerts you asked for. Firebase also uses a random installation ID and the app version to deliver messages.

Why: only to send the alerts you chose.

Legal basis: you asked for this feature (GDPR Art. 6(1)(b)). You can switch it off at any time.

How long: until you turn alerts off, uninstall the app, or the token stops working. We delete tokens that Firebase reports as invalid, and tokens we have not been able to use for [[270]] days.

2.4 Data stored on your device

• Website: your browser's local storage keeps your preferences, such as your chosen time zone and display settings. This data stays in your browser. We do not receive it. You can delete it by clearing your browser data for [[DOMAIN]].
• Android app: the app keeps your settings, the matches you follow, and a copy of recent scores on your phone, so the app opens fast and works on a weak connection. This stays on your phone. It is not backed up to the cloud. Uninstalling the app or clearing its storage deletes it.

Legal basis: this storage is strictly necessary to give you the service you asked for, so no consent is needed (ePrivacy rules on storing data on your device). See our Cookie Notice.

2.5 Emails you send us

If you email us, we use your email address and message only to answer you. We delete the conversation [[12 months]] after it ends, unless we need it longer to deal with a legal claim. Legal basis: our legitimate interest in answering you (GDPR Art. 6(1)(f)).

2.6 What we do not do

• No accounts, no names, no emails collected in the app.
• No analytics, no advertising, no tracking across apps or websites.
• No precise location. Your time zone is read from your device and stays on your device.
• We do not sell your data. We do not share it for advertising.

If this changes (for example if we add ads or analytics), we will update this policy first and ask for your consent where the law requires it.

3. Where the scores come from

Match data (scores, players, teams, logos) is licensed from [[DATA PROVIDER, e.g. EntitySport]]. Our server fetches this data. Your device only talks to our servers. We do not send any data about you to the data provider.

4. Who processes data for us

We use these service providers. They process data only on our instructions, under a data processing agreement:

We may share data with authorities only if the law requires it.

5. Transfers outside the EU

Cloudflare and Google may process data in the USA. Both take part in the EU–U.S. Data Privacy Framework. They also use the European Commission's Standard Contractual Clauses. These protect your data when it leaves the EU. [[If the hosting provider is outside the EU/EEA, add it here.]]

6. Your rights

Under the GDPR you have the right to:

• access the data we hold about you,
• correct it,
• delete it ("right to be forgotten"),
• restrict how we use it,
• object to our use based on legitimate interest,
• data portability, where it applies,
• withdraw consent at any time, where we rely on consent.

Because we do not know who you are, we may need your help to find your data — for example the date, time and IP address of your visit. The easiest way to delete your push token is to turn alerts off or uninstall the app.

To use your rights, email [[PRIVACY EMAIL]]. We answer within one month.

You can also complain to a data protection authority. Ours is [[SUPERVISORY AUTHORITY NAME AND WEBSITE]]. You can also complain in the EU country where you live or work. The list of all authorities is here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

7. Security

All connections use encryption (HTTPS/WSS). Our databases are not reachable from the internet. Only the operator can access the servers, using secure keys.

8. Children

The service is not made for children under 16. We do not knowingly collect data from children. If you think a child has sent us personal data, email us and we will delete it.

9. Changes to this policy

We will update this page when the service changes. The date at the top shows the latest version. If a change is important (for example adding ads), we will tell you in the app or on the website before it takes effect.

10. Contact

[[OPERATOR FULL NAME]] · [[POSTAL ADDRESS]] · [[PRIVACY EMAIL]]