Privacy Policy

At a glance

futcup is a football prediction game. We only process the data we need to run it:

• No advertising, no tracking or analytics tools, no selling of data
• No location data, no access to your contacts or photos
• Your app data is stored in the EU (Frankfurt, Germany)
• You can download or delete your data in the app at any time under Profile → Data & Privacy

The details follow below.

1. Controller

The controller within the meaning of the GDPR for the futcup app and the website www.futcup.app is:

Emre Dirlik
Eichhorster Weg 29
13435 Berlin, Germany
Email: support@futcup.app

We have not appointed a data protection officer, as we are not legally required to do so. Please send any privacy question directly to the address above.

2. Legal bases

Sections 3 to 9 explain each processing activity: which data, for what purpose, on which legal basis and for how long. We rely on the following legal bases:

• Art. 6(1)(b) GDPR: performance of our contract with you (the Terms of Service)
• Art. 6(1)(a) GDPR: your consent, which you can withdraw at any time with effect for the future
• Art. 6(1)(c) GDPR: compliance with a legal obligation
• Art. 6(1)(f) GDPR: our legitimate interests, which we name in each case

3. Account and guest onboarding

Age check: Before the guest session starts, we ask for your date of birth. Your answer stays on your device and is not sent to us. If you are 16 or older, it is only used for your account when you register (it is not asked again) and is removed from the device as soon as you are signed in to an account (after registering or logging in). If you are under 16, no guest account is created; we only store a note on the device that the age check was not passed, so that it cannot simply be repeated with a different date.

Guest session: When you tap “Get started”, we create a temporary guest account without a name or email address, so that your competition picks and any friend requests you send are saved. While you are a guest, your profile is invisible to other users. If you do not complete the signup, the guest account and all data attached to it are deleted automatically after 30 days.

Registration: To create an account we process your email address, your username, your password and your date of birth. Your password is stored only as a salted hash by our authentication provider; we never see it in plain text. We use your date of birth solely to confirm that you are at least 16 years old (section 17). We also record when you accepted this policy and the Terms of Service, and which version you accepted.

Sign-in security: When you sign in, our authentication provider processes the time and IP address of the request to protect your account against misuse.

Legal basis: Art. 6(1)(b) GDPR for the account; Art. 6(1)(f) GDPR for the acceptance record and sign-in security (our legitimate interest in proving which terms apply and in keeping accounts secure).
Retention: as long as your account exists; sign-in log data (incl. IP addresses) for no longer than 90 days.

4. Playing futcup and what others can see

When you play, we process your predictions and the points calculated from them, the competitions you follow, the match alerts you set, your friends and friend requests, the groups you create or join and group invitations, the trophies and tournament ranks you earn, your in-app notifications, and your privacy settings (e.g. whether others may send you friend requests or group invitations).

What other users can see:

• Your username and display name: for example in search, on leaderboards, in groups and in friend lists
• Your predictions, points, ranks and trophies: these are part of the competition and can be seen by other signed-in users, in particular your friends and the members of your groups. Group leaders can decide whether members see each other’s predictions before kick-off.

Your email address, date of birth and settings are never shown to other users.

Match data such as fixtures and results comes from football-data.org. We only retrieve data from this provider; none of your data is sent to it.

To protect futcup against abuse (e.g. automated mass requests), we count how often certain actions are triggered from your account within a short time window. For functions that work without an account (sign-in with a username, the contact form and the waitlist), we count requests per IP address instead; we only store a one-way hash of the IP address, never the address itself. These counters are deleted after 48 hours at the latest.

Legal basis: Art. 6(1)(b) GDPR; abuse protection Art. 6(1)(f) GDPR (our legitimate interest in a secure and fair game).
Retention: as long as your account exists (see section 13 for groups you lead).

5. Notifications

Match reminders: If you set a match alert, your device schedules a local reminder (e.g. “Kickoff in 30 min”). The alert itself is saved in your account.

Push notifications: If you allow notifications when your device asks, we store your device’s push token so we can send you push messages about your account and your groups (e.g. when you become the leader of a group). Push messages are delivered via the Expo push service (650 Industries, Inc., USA) and the Apple Push Notification service. These services only receive the push token and the content of the message.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time by turning off notifications for futcup in your device settings. The push token is deleted together with your account.

In-app notifications (e.g. about group changes) are stored in your account to show them to you in the app (Art. 6(1)(b) GDPR).

6. Storage on your device

The app stores a login session token in encrypted secure storage on your device, together with a few app settings and, before registration, the result of the age check (section 3). This keeps you signed in and makes the app work. It is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG), so no consent is required. We do not use cookies or similar technologies for tracking or advertising.

7. Emails

We only send emails that are needed for your account or your request, e.g. to confirm your email address, to reset your password, or to reply to you. We do not send newsletters or advertising emails.

Our email provider is Resend (resend.com, USA).
Legal basis: Art. 6(1)(b) GDPR.

8. Purchases

futcup is free to use. If we offer optional paid features, the purchase is processed entirely by Apple (App Store) as an independent controller under their own privacy policies. We only receive and store whether and which entitlement is active (e.g. subscription status and expiry date), never your payment details.

Legal basis: Art. 6(1)(b) GDPR. Retention: as long as your account exists, subject to statutory retention obligations (e.g. under tax law).

9. Our website

Hosting: www.futcup.app is hosted by Vercel Inc. (USA). When you visit the website, Vercel automatically processes technical access data: IP address, date and time, requested page, referrer, browser and operating system. This is necessary to deliver the website and protect it against attacks (Art. 6(1)(f) GDPR: our legitimate interest in secure and stable operation). The data is deleted as soon as it is no longer needed for these purposes. The website uses no cookies, no analytics and no tracking.

Contact form: If you use the contact form, we process your name, email address and message to answer your request. The message is sent to us by email via Resend. Legal basis: Art. 6(1)(b) GDPR if your request concerns your account, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries). We delete requests once they have been dealt with, unless statutory retention obligations apply.

Launch waitlist: If you join the waitlist, we store your email address and language so we can confirm your registration and notify you once when futcup launches. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by email. We delete the waitlist after the launch notification has been sent.

10. Recipients and processors

We use the following service providers, who process data on our behalf and according to our instructions (Art. 28 GDPR):

• Supabase Inc. (USA): database, authentication and server functions; your app data is hosted in the EU (Frankfurt)
• Resend (USA): sending emails
• 650 Industries, Inc. (Expo, USA): delivering push notifications
• Vercel Inc. (USA): hosting the website
• Functional Software, Inc. (Sentry, USA): crash and error reports (section 12); stored in the EU (Frankfurt)

Apple distributes the app, delivers push notifications (APNs) and processes in-app payments, partly as an independent controller.

Other users see the data described in section 4. We do not sell your data and do not share it for advertising. We only disclose data to authorities where we are legally obliged to do so (Art. 6(1)(c) GDPR).

11. Transfers outside the EU

Some of the providers named above are based in the USA. For the USA, the European Commission has adopted an adequacy decision (EU-U.S. Data Privacy Framework, 10 July 2023). Vercel, Resend, Expo, Sentry and Apple are certified under it. Where a provider is not certified, we additionally rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); this applies to Supabase.

Your app data itself is stored in the EU. Transfers to the USA are limited to what the respective provider needs for its service (e.g. email or push delivery, support). On request, we will provide you with a copy of the safeguards.

12. Security

All connections are encrypted (TLS). Access rules in our database (row-level security) ensure that each user can only access the data they are entitled to. Passwords are stored only as hashes, session tokens on mobile devices in encrypted storage, and access to our production systems is restricted.

Crash reports: If the app crashes or runs into an error, it sends a technical error report to Sentry: the error message and stack trace, the app version, device model and operating system version, and the screens used shortly before the error. The report contains no name, email address, user ID or IP address. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable, error-free app); the information read from your device for this is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG). Reports are deleted after 90 days at the latest.

13. Retention and deletion

• Account data: until you delete your account
• Guest accounts without signup: automatically after 30 days
• Account deletion (Profile → Data & Privacy → Delete account): your profile, predictions, friendships, group memberships, trophies, notifications, settings and all other personal data are deleted immediately and irreversibly. Groups you lead are handed over to the member who has been registered the longest; empty groups are deleted.
• Backups: deleted data disappears from our rolling backups within 30 days
• Contact requests: once dealt with; waitlist: after the launch notification

Where statutory retention obligations apply, we restrict processing to that purpose and delete the data when the period ends.

14. Your rights

You have the right to:

• Access (Art. 15 GDPR): “Download my data” in the app gives you a copy of your account data as a file; a full copy is available by email at any time
• Rectification (Art. 16 GDPR): you can change your username in the app, or contact us
• Erasure (Art. 17 GDPR): “Delete account” in the app
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): the export is a machine-readable JSON file
• Withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, email support@futcup.app. We will respond within one month.

15. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin, Germany
www.datenschutz-berlin.de

16. Required data and automated decisions

To create an account you need to provide your email address, a username, a password and your date of birth; without them we cannot conclude the contract with you. Everything else (such as push notifications or the waitlist) is optional.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Points are calculated automatically according to the scoring rules shown in the app; this is part of the game and has no legal effect.

17. Minimum age

futcup is for people aged 16 and over. We ask for the date of birth before the guest session starts and store it with your account at registration (section 3), our servers reject accounts with a date of birth under 16, and we do not knowingly process data of younger children. If we learn that a user is under 16, we delete the account. Parents who believe their child has registered can contact us at any time.

18. Changes to this policy

We update this policy when our service or the law changes. The current version is always available in the app and on our website. If we make material changes, we will inform you in the app before they take effect and ask you to confirm the new version.