Privacy Policy

Last updated: 2 October 2026 · Türkçe

About this notice

This Privacy Policy is the information notice under Articles 13 and 14 of the EU General Data Protection Regulation (2016/679, "GDPR") and the disclosure notice (aydınlatma metni) under Turkish Personal Data Protection Law No. 6698 ("KVKK"). It explains which personal data we process when you use the ScoreBil app (the "App") and the scorebil.app website, for which purposes and on which legal bases, who we share it with, how long we keep it and what your rights are. This notice is not a consent form; it only informs you. The only processing based on your consent (optional crash reports) is described in the Cookie and Device Storage Notice and requires a separate opt-in.

1. Controller and contact

The controller of your personal data is Umut Sadıkoğlu (an individual, Toulouse, France). For any question or request about this policy, your personal data or your rights: destek@scorebil.app. A data protection officer is not legally required and has not been appointed; this address reaches the controller directly.

2. What data we process

• Account data: your email address; your password (only stored in irreversibly hashed form); if you sign in with Google, Apple or Facebook, the account ID, email address and name that service sends us.
• Profile data: your username, profile photo (if you upload one), favourite team and league, profile cover.
• Game data: your predictions, X2 usage, points, rankings, badges, and the leagues you create or join.
• Social data: friend requests and friendships; messages and photos you send in league chats and direct chats; read receipts; users you block; reports you make and reports made about you.
• Preferences: language, time zone, notification and privacy settings, chats you mute or hide.
• Device and notification data: your device's push token and which session it belongs to, so we can send notifications.
• Acceptance records: which version of the Terms of Use and Community Guidelines you accepted and when, and your declaration that you are 16 or older.
• Technical and security data: IP address, request time and similar information in server logs; device/browser signals processed during the anti-bot check at sign-up, sign-in and password reset.
• Crash reports (only if you opt in): error log, device model, operating system and app version when the App crashes; not linked to your account.
• Support correspondence: if you email us, your email address and the content of the correspondence.
• Advertising data: when ads are shown in the App, Google's ad software processes your IP address (for approximate location), device and app information (model, operating system, language, app version), ad interactions (impressions, clicks), on Android the device advertising ID, and your ad consent choice. This data is not linked to your account, username or email; we do not send it to Google.
• Usage statistics: only the COUNT of certain actions in the App (e.g. opening the App, switching tabs, saving a prediction, joining a league, sending a message), a random installation ID created on your device, the device type (iOS/Android) and the app version. This is not linked to your account, username, email or content (your predictions or messages) and is not sent to any third-party company.

Embedded information in photos you send in chats, such as location (GPS), device model and capture date, is removed before the photo leaves your device. There is no cross-app or cross-site ad tracking (on iOS the "tracking permission" is never requested), no third-party analytics tool and no location tracking; the App does not access your contacts, location or microphone. Your camera and gallery are only accessed when you pick a photo, to the extent you allow. We do not ask for special categories of data (health, religion, political opinions, etc.); please do not share them in chats either.

3. Purposes and legal bases

• Creating your account and managing your session; saving and scoring your predictions; running leagues, rankings, profiles and chats; sending the notifications you choose. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Security of the service; preventing abuse, cheating and automated attacks; enforcing the Community Guidelines and handling reports; improving the service. Legal basis: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)), namely keeping the community safe and the service running; the data processed is limited to what is needed for this.
• Answering support requests and requests to exercise your rights. Legal basis: performance of a contract and legal obligations (GDPR Art. 6(1)(b) and 6(1)(c); KVKK Art. 5(2)(c) and 5(2)(ç)).
• Keeping acceptance records, responding to legal requests, and establishing, exercising or defending legal claims. Legal basis: legal obligations and the protection of rights (GDPR Art. 6(1)(c) and 6(1)(f); KVKK Art. 5(2)(ç) and 5(2)(e)).
• Optional crash reports. Legal basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You can withdraw it at any time in Settings > Crash reports; withdrawal does not affect the lawfulness of earlier processing.
• Showing ads (the revenue that keeps the service free). Personalised ads, and storing information on your device for them, only happen with your consent: whichever country you are in, you choose in Google's consent screen when you first use the App (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3); KVKK Art. 5(1)). If you do not consent, only non-personalised ads are requested; these are not chosen based on your interests, only on the current app content and approximate location. Processing strictly needed to serve non-personalised ads, prevent fraud and cap frequency is based on our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You can change your consent at any time in Settings > Ad privacy options.
• Usage statistics: seeing in aggregate how the service is used (e.g. how many people make their first prediction, which screens are used) and improving it. Legal basis: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)); measurement is for us only, aggregated and not linked to you. You can turn it off at any time in Settings > Usage statistics; nothing is sent once it is off.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). Automatically hiding a league chat message reported by three different users until it is reviewed is a temporary safety measure; the final decision is made by a human.

4. Who can see your data

• Signed-in users: your username, profile photo and cover, favourite team, points in the overall rankings and your badges.
• Signed-in users, on your profile: your predictions on started (live or finished) matches and the points they earned. In Settings > Privacy you can limit these to your friends and league mates. Your predictions on matches that have not started are never visible to anyone.
• League mates: your points and rank in that league and your messages in the league chat.
• Friends: your direct messages.
• Everyone: predictions are only shown as aggregate percentages (e.g. "42% home win") and only when there are at least 10 predictions; individual predictions cannot be inferred this way.

Your email address, real name, IP address and preferences are never shown to other users. Nobody who is not signed in (including from outside the App) can see profile or game data.

5. Who we share data with

We do not sell or rent your data and do not share it with anyone for advertising (for the data that the ad software processes directly, see the end of this section). To provide the service we only work with the following providers, who process data on our behalf and on our instructions as processors (under GDPR Art. 28 agreements):

• Supabase Pte. Ltd. (Singapore) - database, file storage and authentication. Data is stored on servers in Frankfurt, Germany (EU).
• Plus Five Five, Inc. (Resend, USA) - delivery of account emails (sign-up confirmation, password reset): your email address and the email content. Emails are sent from servers in the EU (Ireland).
• Google LLC / Google Ireland Ltd. (Firebase Cloud Messaging) - only your push token and notification content, to deliver notifications.
• Google LLC (Firebase Crashlytics) - crash reports, only if you opt in.
• Cloudflare, Inc. - anti-bot verification (Turnstile) at sign-up, sign-in and password reset; hosting of the scorebil.app website and forwarding of support emails.
• Google LLC / Google Ireland Ltd. (Gmail) - the mailbox where support emails are received and answered.
• Google, Apple and Meta (Facebook) - only if you choose to sign in with these accounts, for the sign-in itself. Their own privacy policies also apply.

Ads are served by Google Ireland Ltd. / Google LLC (AdMob). For the data it processes for advertising, Google acts not on our behalf but as an independent controller under its own privacy policy (policies.google.com/privacy); our relationship is governed by Google's controller-to-controller data protection terms. We block ad categories such as betting, gambling, alcohol and dating.

Match data comes from an external sports data provider; no personal data is sent to it. Data may be disclosed to competent public authorities upon a lawful request, under the applicable law and only to the extent necessary.

6. International transfers

The controller is in France and your data is mainly stored in the European Union (Frankfurt). If you use the App from Turkey, your data is therefore transferred abroad. Some providers (Google, Cloudflare, Resend, Apple, Meta) may also process data in other countries, including the United States.

• Transfers outside the EU/EEA rely on adequacy decisions under GDPR Art. 45 (e.g. for providers certified under the EU-U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses under Art. 46.
• Transfers from Turkey abroad rely on appropriate safeguards under KVKK Art. 9, in particular the standard contracts published by the Turkish Personal Data Protection Board.

You can request a copy of these safeguards at destek@scorebil.app.

7. How long we keep data

• Account, profile, game, chat and preference data is kept for as long as your account exists.
• When you delete a message or photo, it is deleted from the server immediately. Content with an open report is kept only for review until the report is resolved.
• The content of a message removed by a league owner is kept for 30 days for possible reports or appeals, then deleted.
• When you delete your account (Settings > Delete account), your account, profile, predictions, points, badges, messages, direct chats, friendships and acceptance records are deleted immediately and your photos within a few minutes. Leagues you created are handed over to the oldest member; leagues with no other members are deleted.
• In-app notifications are deleted automatically after 90 days once read and after 180 days if unread.
• Encrypted technical backups are kept for at most 14 days and then deleted automatically; data you delete also disappears from backups within this period.
• Report records (including the reported message text and username) are kept for 1 year after the report is resolved, for community safety, detecting repeated violations and possible legal proceedings; they may be kept for this period even if the account is deleted. If the reporting user deletes their account, their identity is removed from the record.
• If an account suspended for violations is deleted, an irreversible hash of the email address is kept for the duration of the suspension to prevent re-registration with the same email; the address itself is not kept.
• Support correspondence is kept for 1 year after the request is resolved, for possible appeals and legal proceedings, then deleted.
• Server and security logs are kept for the provider's short log retention period.
• Usage statistics are kept for at most 13 months and then deleted automatically.
• Advertising data is subject to Google's own retention periods (policies.google.com/technologies/retention). Your ad consent choice is stored on your device until you change it or delete the App.
• Notifications already sent to other users before you deleted your account (e.g. "X wants to add you as a friend") may contain your username until those notifications are deleted.

8. Security

Your data is transmitted over encrypted connections (TLS) and stored encrypted. Each user can only access the data they are authorised to see; these rules are enforced on the server. Chat photos are not public; they are only shown to the chat participants through short-lived links. Your session keys are kept in your device's secure storage. If a personal data breach occurs, we will notify the competent authorities within the legal deadlines (72 hours under the GDPR) and, where required, you.

9. Your rights

Under GDPR Articles 15-22 and KVKK Article 11 you have the right to:

• learn whether your data is processed and obtain a copy (access);
• have inaccurate or incomplete data corrected (rectification);
• have your data deleted (erasure);
• restrict processing in certain cases;
• receive the data you provided in a structured, commonly used and machine-readable format and have it transmitted to another service (portability);
• object to processing based on legitimate interests;
• withdraw your consent at any time;
• learn the purpose of processing and whether data is used accordingly, know the third parties it is transferred to, and have corrections and deletions notified to them;
• object to an outcome against you resulting exclusively from automated analysis;
• claim compensation for damage caused by unlawful processing.

You can change your ad consent in Settings > Ad privacy options and, on Android, reset or delete the advertising ID in your device settings (Privacy > Ads).

You can correct your profile in Settings and delete your account yourself in Settings > Delete account. For other requests, write to destek@scorebil.app from your registered email address; we may ask for additional information to verify your identity. We answer free of charge within 30 days at the latest (under the GDPR this may be extended by two months where necessary, in which case we will tell you).

You also have the right to lodge a complaint with a supervisory authority: in France the Commission Nationale de l'Informatique et des Libertés (CNIL, cnil.fr), in Turkey the Personal Data Protection Board (kvkk.gov.tr), or the data protection authority of the EU country where you live or work. Under the KVKK you must first apply to us.

10. Children

ScoreBil is not intended for anyone under 16, and you are asked to confirm that you are 16 or older when you sign up. If you are under 16, do not use the App. If we learn that we process data of someone under this age, we will delete the account and its data; you can report such a case to destek@scorebil.app.

11. Changes

We may update this policy. We will inform you in the App of material changes and ask for your acceptance again where required. Last updated: 2 October 2026.