Privacy Policy

1.1 Device Identifier (No Account Required)

ScoreGPT does not require you to create an account, and we do not ask for your name or any sign-in credentials. We collect an email address only if you choose to provide one — for example, when you include it with in-app feedback so that we can reply to you (see Section 1.5). To provide core functionality such as your free weekly prediction allowance, the app generates a random, anonymous device identifier (a UUID) the first time you open it:

• This identifier is anonymous and is not linked to your real-world identity.
• It is stored in your device's secure storage (Apple Keychain / Android Keystore) and, by design, persists across app reinstalls — so your free allowance cannot be reset simply by reinstalling.

1.2 Purchase and Subscription Data

We collect information related to your purchases and subscriptions:

• Purchase history, subscription status, and renewal dates
• An anonymous purchase identifier provided by RevenueCat

We never receive or store your payment card details. All payments are processed directly by the Apple App Store or Google Play; RevenueCat manages subscription status on our behalf.

1.3 Usage Data

To improve our service, we collect:

• App usage statistics, feature interactions, and prediction views
• Device information (model, operating system version, app version)
• Crash reports, error logs, and the IP address associated with them
• A mobile advertising identifier (Apple IDFA / Google Advertising ID), used only to measure the effectiveness of our app-install advertising

1.4 Third-Party Services

We use the following third-party services that may collect data:

• RevenueCat: Subscription management and purchase attribution
• Apple App Store & Google Play: Payment processing and app distribution
• PostHog: Product analytics, keyed to the anonymous device identifier
• Sentry: Crash and error reporting
• Meta (Facebook): Measurement and attribution of our advertising (we do not display ads inside the app)
• Supabase: Hosting of match data and predictions
• Sports data providers: Football fixtures, results, and statistics

1.5 Information You Provide (Feedback)

When you send feedback through the app, we collect the message you write and, if you choose to add it, your email address. Providing an email is entirely optional — you can send feedback without one. We use this information solely to understand your feedback and, where you have given an email, to reply to you. Feedback is processed through our analytics provider (PostHog).

GDPR (European Users)

• Right to access your personal data
• Right to rectify inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing

CCPA (California Users)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

9.1 Consent Management

When you first visit our website, a cookie banner asks whether you agree to the use of analytics and marketing technologies. Nothing in those categories loads before you make a choice, and no choice is pre-selected. You can accept all, reject all, or enable individual categories — rejecting is just as easy as accepting, and the website works identically either way.

• Your choice is stored in your browser's local storage (key scoregpt-consent) together with a timestamp and the version of the consent notice you responded to. This storage is strictly necessary to remember your decision (§25(2) TTDSG) and is kept until you delete it or a new consent version requires asking again.
• You can change or withdraw your consent at any time — with effect for the future — via the “Cookie settings” link in the website footer (Art. 7(3) GDPR). Withdrawing a category stops the associated processing and deletes the cookies it set.
• The consent tool is built and hosted by us; no third-party consent provider receives your data.

9.2 PostHog (Website Analytics) — with Your Consent

If you consent to the “Analytics” category, we use PostHog (PostHog, Inc.), hosted on PostHog's EU cloud in the European Union, to understand how our website is used.

• Data categories: pages viewed, clicks on app-download buttons, referrer, approximate location derived from your IP address, device and browser information, web performance metrics, and a random visitor identifier stored in a first-party cookie / local storage (prefix ph_, retained for up to 12 months).
• Purpose: aggregate usage statistics and improving the website and its conversion funnel.
• Legal basis: your consent (Art. 6(1)(a) GDPR, §25(1) TTDSG).
• Retention: event data is retained in PostHog for as long as needed for the purposes above; you can request deletion at any time (see Section 5).
• Withdrawal: via “Cookie settings” in the footer. Collection stops immediately and PostHog's cookies and local storage are deleted.

9.3 Meta Pixel (Marketing) — with Your Consent

If you consent to the “Marketing” category, we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”), to measure the effectiveness of our advertising on Meta platforms (Facebook, Instagram) and to build advertising audiences (including lookalike audiences) from website visitors.

• Data categories: pages viewed, clicks on app-download buttons (sent as a “Lead” event with the page surface and target store), IP address, browser and device information, and cookie identifiers (in particular the _fbp cookie, retained for 3 months). If you have a Meta account, Meta may link this data to it.
• Purpose: ad measurement and attribution, retargeting, and creation of custom and lookalike audiences for our app-install advertising.
• Legal basis: your consent (Art. 6(1)(a) GDPR, §25(1) TTDSG).
• Joint controllership: for the collection of data via the pixel and its transmission to Meta, we and Meta Platforms Ireland are joint controllers (Art. 26 GDPR). The essence of this arrangement is set out in Meta's Controller Addendum. For the subsequent processing of the data, Meta is the sole controller; details are in Meta's Privacy Policy.
• US transfer: data may be transferred to Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework, which the European Commission has recognized as providing an adequate level of data protection (Art. 45 GDPR).
• Withdrawal: via “Cookie settings” in the footer. The pixel stops sending data immediately and its cookies are deleted.