Privacy Policy

1. Introduction & Controller

This Privacy Policy explains how the iScore Football mobile application for iOS and Android ("App", "we", "our") collects, processes, and uses your data. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR / DSGVO) and the California Consumer Privacy Act (CCPA).

A formal Data Protection Officer is not required under Art. 37 GDPR for this application, as the processing is not carried out on a large scale and does not involve special categories of data as a core activity.

2. Data We Collect

The App can be used without an account — live scores, fixtures, and statistics require no sign-in and no personal data. Additional data is processed only when you use optional features (account, iScore Plus, AI Smart Search, feedback) and, in the free version, for the banner advertisement described in §6.

We do not collect: your precise (GPS) location, contacts, photos, or biometric data. We never see or store your payment details — payments are handled entirely by Apple and Google (see §5). Your email address and name are processed only if you voluntarily create an account.

Advertising is the one exception to the above, and only in the free version: our advertising partner Google AdMob accesses your device's advertising identifier and derives an approximate location from your IP address in order to deliver and measure ads. This happens only after you have made a choice in the consent dialog, and never at all for iScore Plus subscribers. We ourselves never receive your advertising identifier. See §6 for full details.

3. Legal Basis for Processing (GDPR Art. 6)

• Contract Performance (Art. 6(1)(b)) — fetching football data, managing your account, providing the iScore Plus subscription, and answering your AI search questions are necessary to deliver the services you request.
• Legitimate Interest (Art. 6(1)(f)) — server logs and usage counters to keep the service stable, prevent abuse, and enforce fair-use limits.
• Consent (Art. 6(1)(a), and § 25(1) TDDDG for access to your device) — advertising and any reading of or writing to information on your device for advertising purposes take place only after you have given consent in the in-app consent dialog (see §6). Feedback text is only sent when you explicitly submit it. You may withdraw consent at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out beforehand.

4. Account & Sign-In (Supabase)

Creating an account is optional and only required for premium features such as AI Smart Search and the iScore Plus subscription. You sign in with Sign in with Google or Sign in with Apple; we never receive or store a password.

• Data stored: your email address, the display name provided by Google/Apple, a unique account ID, and sign-in timestamps.
• Where: our authentication and database provider is Supabase, with data hosted in the European Union (Frankfurt, Germany).
• Identity providers: Google LLC and Apple Inc. process the sign-in itself under their own privacy policies (Google, Apple).
• Deletion: you can permanently delete your account at any time directly in the App (Settings → Account → Delete account). This removes your account data and usage counters from our systems.

5. iScore Plus Subscription

iScore Plus is an optional paid subscription. Payments are processed entirely by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We never receive your payment details (no card numbers, no billing address).

To recognise your subscription across devices and platforms, we use RevenueCat, Inc. (San Francisco, USA) as a processor. RevenueCat receives your account ID and store purchase metadata (product, purchase and expiry dates, store receipt tokens) — no payment details. RevenueCat processes data under GDPR Standard Contractual Clauses; see revenuecat.com/privacy.

Our server checks your subscription status (via your account ID) each time you use a premium feature, so your subscription follows your account on all your devices.

6. Advertising (Google AdMob)

The free version of the App displays a single banner advertisement above the navigation bar on the main screen. Advertising is what finances the free version. iScore Plus subscribers see no advertising at all.

Ads are delivered by Google AdMob, operated in the EEA by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google acts as an independent controller for the advertising data it receives.

• What Google receives: your device's advertising identifier (IDFA on iOS, Advertising ID on Android), your IP address and the approximate location derived from it, device and operating-system information, and data about which ads were requested, shown, clicked, or interacted with. Google uses this to select and deliver ads, to measure their performance, and to detect invalid traffic and fraud.
• Your consent (EEA, UK, Switzerland): before the first ad request, the App shows a consent dialog from Google's certified Consent Management Platform (User Messaging Platform), based on the IAB Transparency & Consent Framework. No advertising identifier is read and no ad is loaded before you have made your choice. If you decline personalised advertising, you will still see ads, but non-personalised ones — selected from coarse context such as the app's content and your approximate region, not from a profile about you.
• Withdrawing or changing your choice: you can reopen the consent dialog at any time from the App's settings under Ad Privacy Options. In addition, iOS offers a system-level control under Settings → Privacy & Security → Tracking, and Android lets you reset or delete your Advertising ID under Settings → Privacy → Ads.
• Apple App Tracking Transparency (iOS): personalised advertising on iOS additionally requires the system tracking permission. If you decline it, neither we nor Google access the IDFA, and you will only see non-personalised ads.
• Ad measurement: the Google Mobile Ads SDK includes Google's app measurement component, which records ad impressions and conversions in order to bill advertisers and report performance.
• International transfers: Google may process this data in the United States and other countries outside the EEA. The transfer is based on the EU Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework.
• Retention: advertising data is retained by Google under its own retention rules. We do not store advertising data ourselves.

We do not receive your advertising identifier and we do not build advertising profiles. From Google we only receive aggregated statistics such as the number of impressions, clicks, and the resulting revenue. Details on how Google processes data in its advertising products are available at business.safety.google/privacy, and the current list of Google's advertising partners at support.google.com/admob/answer/9012903. You can opt out of personalised Google advertising across services at adssettings.google.com.

7. AI Smart Search

Smart Search lets you ask free-form football questions that are answered by an AI model using our licensed sports data. When you send a question, the following processing takes place:

• What is transmitted: the text of your question, your app language, and your account ID. Please do not include personal data in your questions — it is not needed to answer them.
• Our server: the question is processed on our server hosted by Railway in the EU (Amsterdam, Netherlands).
• AI processing: to generate the answer, the question text is forwarded to an AI language model via OpenRouter, Inc. (USA) and its model hosting partners in the USA/EU under GDPR Standard Contractual Clauses (openrouter.ai/privacy).
• Logging: we store your questions together with your account ID, the answer status, and timestamps in our EU-hosted database. We use these logs to operate the service, enforce free-trial and fair-use limits, prevent abuse, and improve answer quality.

8. Sports Data & Backend Server

To fetch football fixtures, standings, lineups, and statistics, the App talks to our own backend server (hosted by Hetzner Online GmbH in Germany), which in turn retrieves sports data from RapidAPI / API-Football. Requests contain only sport-related identifiers (league IDs, team IDs, fixture IDs) and standard HTTP metadata (IP address, user-agent). Team and league images are served through our own server as well.

9. Feedback (Featurebase)

The in-app feedback and roadmap section is provided by Featurebase. If you choose to submit feedback or vote there, the data you enter is processed by Featurebase under its own privacy policy: featurebase.app/privacy. Browsing football data in the App never sends anything to Featurebase.

10. Data Retention

Deleting your account: you can delete your account and its data directly in the app, or request deletion without the app. See Delete Your Account for the exact steps and what is removed or retained.

11. Your Rights (GDPR)

If you are located in the EU / EEA, you have the following rights under the GDPR:

• Right of access (Art. 15) — request a copy of your data.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data (account deletion is available directly in the App).
• Right to restriction (Art. 18) — limit how your data is used.
• Right to data portability (Art. 20) — receive data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — where processing is based on your consent, in particular advertising, you can withdraw it at any time with effect for the future (see §6).
• Right to lodge a complaint with a supervisory authority — for this App the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), as the controller is established in North Rhine-Westphalia. You may also lodge a complaint with the supervisory authority of your own place of residence.

To exercise any right, contact us at the address in §1. We will respond within 30 days (as required by GDPR Art. 12).

12. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the "sale" or "sharing" of personal information.

We do not sell personal information for money. However, showing personalised advertising through Google AdMob involves sharing your advertising identifier and device data for cross-context behavioural advertising, which the CCPA/CPRA treats as a "sale" or "sharing". You can opt out at any time by reopening the consent dialog from the App's settings under Ad Privacy Options and declining personalised advertising — you will then only see non-personalised ads. iScore Plus subscribers are not shown advertising at all.

We do not knowingly sell or share the personal information of consumers under 16 years of age. To submit any other CCPA request, contact us at the address in §1.

13. Children's Privacy

The App is not directed at children under the age of 13 (or 16 where required by law). We do not knowingly collect personal information from children. If you believe a child has provided personal information through the App, please contact us and we will delete it promptly.

14. Security

We implement reasonable technical measures to protect data in transit and at rest. All network communication uses HTTPS encryption; sign-in tokens are kept in your device's secure storage, and local preferences never leave your device. However, no transmission over the internet can be guaranteed to be completely secure.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted at this URL. Material changes will be communicated via an in-app notice. The date at the top of this page reflects the most recent update. Continued use of the App after changes constitutes acceptance.

16. Contact