Privacy Policy

Last updated: 5 May 2026 · Scoranza

This Privacy Policy describes how Scoranza ("we", "us", or "our") collects, uses, shares, retains, and protects your information when you use our mobile application (the "App"). By using the App, you agree to the practices described here.

1. Information we collect

• Account information: name, email address, profile picture, and Google account ID, when signing in via Google.
• App-chosen identifiers: the username/display name you choose, fan-identity selection, theme/badge selection.
• Usage data: your predictions, points, daily mission progress, favourite team preferences, login streak, prediction history.
• Challenge data: challenges you send to and receive from other users, including your prediction picks.
• FCM token: a device-bound identifier used to deliver push notifications.
• Country code: a two-letter ISO code (e.g., "SA", "EG") used for country-specific leaderboards. We do not collect precise geolocation.
• Coin / economy events: in-app coin balance and transaction history (for fraud prevention and dispute resolution).
• Diagnostic data: crash logs and performance metrics via Firebase services.
• Advertising ID (GAID on Android): used by Google AdMob to serve ads. See section 13.
• App Check token: a short-lived device-integrity attestation (Play Integrity) used solely to block scrapers and modded clients. Does not identify the user.
• Install referrer: read once at install via the Google Play Install Referrer API to credit invite/referral rewards.
• Consent state (EEA/UK): your responses to the in-app personalised-ad consent prompt, stored locally and via Google's User Messaging Platform (UMP).
• IP address: automatically processed by Firebase services (Authentication, Firestore, Cloud Functions, Crashlytics) and Google AdMob. Used to derive coarse country/region (no precise GPS), to apply abuse-prevention rate limits, and to serve geographically appropriate advertisements. Not stored long-term by us in user-identifiable form.
• Server logs: Cloud Functions automatically log request metadata (timestamp, function name, user ID, truncated IP) for up to 30 days for debugging and abuse investigation.

We do not collect or store: precise GPS location, contacts, calendar, photos, files, microphone audio, SMS, browsing history, health data, biometric data, or payment card details. The App does not process payments and does not offer in-app purchases.

2. How we use your information & legal basis

We use your data for the following purposes. For users in the European Economic Area (EEA) and United Kingdom, the legal basis under the GDPR is shown alongside each.

Purpose	Data used	GDPR legal basis
Account creation, authentication	Account info, App Check token	Contract
Operate App features (predictions, leaderboards, challenges, World Cup picks)	Usage data, challenge data, country code	Contract
Push notifications	FCM token	Contract (transactional) / Consent (promotional)
Fraud and abuse prevention	App Check token, coin events, install referrer	Legitimate interest
Analytics & performance monitoring	Diagnostic data	Legitimate interest
Personalised advertising (AdMob)	Advertising ID, app interactions	Consent (EEA/UK via UMP) / Legitimate interest (other regions, opt-out available)
Legal compliance	As required by law	Legal obligation

3. Information sharing & third-party SDKs

We never sell your personal information. We share specific data with the following service providers:

Third party	Data shared	Purpose
Firebase Authentication (Google)	Email, name, profile picture URL, Google account ID	Sign-in
Firebase Cloud Firestore (Google)	All app data above	Backend storage
Firebase Cloud Functions (Google)	User UID, request payloads, IP address (transient)	Server-side game logic (challenge resolution, prediction scoring, abuse prevention)
Firebase Cloud Messaging (Google)	FCM token	Push notification delivery
Firebase Analytics & Crashlytics (Google)	App interactions, diagnostic data, device IDs	Usage analytics & crash reporting
Firebase App Check (Google)	Play Integrity attestation token	Abuse prevention
Google AdMob	Advertising ID, ad-interaction events, coarse device info	Display advertisements; for personalised ads, only with consent in EEA/UK
Google User Messaging Platform (UMP)	Consent state	GDPR/CCPA consent management
TikTok Business SDK (TikTok)	Advertising ID (GAID), device model, OS version, install & app-open events, session timestamps	Measure the effectiveness of TikTok ad campaigns and attribute installs to specific ads. See TikTok's privacy policy.
API-Football (api-sports.io)	None — server-side only	Match & league data; no user identifiers leave our backend
Legal authorities	As required	Legal compliance, when validly requested

4. Data retention

We retain your account data for as long as your account is active. When you delete your account (see section 7), all associated personal data is permanently removed from our active systems within 30 days.

We retain limited data beyond account deletion only when:

• Other users' challenges: historical challenge records visible to other participants are kept so their match histories remain intact. Your username is replaced with an anonymous placeholder once your account is deleted.
• Audit logs: referral and coin-grant audit trails are retained for up to 12 months for fraud detection. These contain only opaque user IDs after account deletion.
• Aggregate / anonymous analytics: non-identifying aggregate metrics (e.g., total predictions per league per day) are kept indefinitely for app improvement.

Backups are purged on a rolling schedule and never exceed 90 days.

5. International data transfer

Your data is stored on Google Cloud / Firebase infrastructure, which may process data in locations outside your country of residence (typically the United States or the European Union). Where required by applicable law, Google maintains the Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers.

6. Data security

We use Firebase Cloud Firestore with strict server-side security rules. Your data is encrypted in transit (TLS 1.2+) and at rest (AES-256, applied by Google Cloud). Cleartext HTTP is disabled at the application level. Sensitive operations are gated behind Firebase App Check (Play Integrity) to block automated abuse.

7. Your rights

You can, at any time:

• Access and correct your personal data — visible in Profile and Settings within the App.
• Delete your account and all associated data directly from within the App: open Menu → Delete Account. The deletion runs immediately, removes your account credentials, your Firestore profile, predictions, World Cup picks, and notification subscriptions, and signs you out. This action is permanent and cannot be undone.
• Opt out of promotional notifications from Settings → Notifications. Transactional notifications (results, points, challenges) can also be disabled individually.
• Opt out of personalised ads at the OS level — see section 13.
• Request a copy of your data by emailing support@scoranza.com with your registered email address.

If you cannot access the in-app deletion path (for example, you have lost access to your Google account), you have two options:

• Web request: visit scoranza.com/delete-account and submit the deletion form. No app install required.
• Email: email privacy@scoranza.com from any address with proof of identity (the Google email associated with the account, plus your in-app display name).

We process verified deletion requests within 30 days, in line with applicable law.

8. California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you the following additional rights:

• The right to know what personal information we collect, use, disclose, or share.
• The right to delete personal information collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of "sale" or "sharing" of your personal information for cross-context behavioural advertising.
• The right to limit use and disclosure of sensitive personal information (we do not collect sensitive PI under CPRA's definition).
• The right to non-discrimination for exercising these rights.

Sale & sharing: We do not sell your personal information for monetary consideration. However, we use Google AdMob to display advertisements, and personalised advertising may be considered "sharing" for cross-context behavioural advertising under the CPRA. You can opt out at any time:

• Android: Settings → Google → Ads → "Opt out of Ads Personalisation". This signal applies app-wide.
• Browser-based opt-out (where applicable): optout.aboutads.info.

To exercise CCPA/CPRA rights, email support@scoranza.com.

9. EEA / UK residents (GDPR)

If you are in the EEA or UK, you have the rights to access, rectify, erase, restrict, port, and object to processing under the GDPR. The legal basis for each processing purpose is identified in section 2.

Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent (personalised ads, promotional notifications), you may withdraw consent at any time via the controls listed in sections 12 and 13. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For personalised advertising, we collect your consent through Google's User Messaging Platform (UMP). You can change your consent at any time from Settings → Privacy → Ad consent within the App.

EU representative (Art. 27 GDPR): Scoranza is a small fan application whose processing of EEA users' personal data does not currently meet the thresholds requiring a designated EU representative under Article 27(2). EEA users may contact us directly using the addresses in section 17. We will reassess this position as the user base grows.

To exercise your GDPR rights or to lodge a complaint, contact privacy@scoranza.com. You may also lodge a complaint with your national data protection authority.

10. Saudi Arabia residents (PDPL)

Scoranza serves users primarily in the MENA region. For users in Saudi Arabia, the Personal Data Protection Law (PDPL) provides rights to access, correct, and delete personal data, as well as the right to be informed of data processing. Scoranza acts as the data controller. To exercise your PDPL rights, email support@scoranza.com. Cross-border data transfers are made in compliance with PDPL Article 29; data is stored on Google Cloud infrastructure with appropriate safeguards.

11. Children

Scoranza carries a 3+ content rating on Google Play because the App contains no violence, profanity, or other content unsuitable for younger viewers. However, the minimum age to register or use the service is 13 years, in line with our data-collection practices and applicable privacy laws (COPPA in the US, GDPR-K in the EEA / UK). Users under 13 are not permitted to create an account.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact privacy@scoranza.com and we will delete it promptly.

AdMob configuration for children: the App is not a "child-directed" app under COPPA / Google Play Families. Ad requests are tagged with tagForChildDirectedTreatment = false. For users in the EEA / UK who have not granted UMP consent, ad requests are tagged tagForUnderAgeOfConsent = true (where applicable) and only non-personalised ads are served. We do not enable "neighbouring rewarded" or other ad formats that may be inappropriate for general audiences.

12. Notifications

We send transactional notifications (match results, points awarded, challenge invitations, friend requests) and operational reminders (kickoff alerts, re-engagement). Promotional notifications (special events, double-coin days) are opt-in — you must enable them in Settings → Notifications. You may disable any notification type individually at any time.

Android 13+ permission: on Android 13 (API 33) and later, the App requests the runtime POST_NOTIFICATIONS permission at first launch. Denying or revoking the permission disables all notifications, including transactional ones; this may reduce the utility of features such as match-bell alerts and challenge invitations.

13. Advertising

We use Google AdMob to display banner, interstitial, native, app-open, and rewarded video advertisements. AdMob may use your device's Advertising ID (GAID on Android) to serve personalised ads.

For users in the EEA / UK, we obtain explicit consent for personalised ads via Google's User Messaging Platform (UMP). For users in other regions, personalised ads are enabled by default; you can opt out:

• Android: Settings → Google → Ads → "Opt out of Ads Personalisation".
• You may also reset your Advertising ID from the same settings screen at any time.
• For more information on Google's ad practices, see policies.google.com/technologies/ads.

Rewarded ads are user-initiated only — ads never play automatically without your tap. Ad placements are rate-capped to avoid disruption.

Ad mediation: we do not currently use AdMob mediation or third-party ad networks (e.g. AppLovin, Meta Audience Network, Unity Ads). If we add mediation partners in the future, this section will be updated and, where required by law, your consent will be re-collected via UMP before any new partner serves you.

14. In-game currency

In-game currency ("coins"). Coins are earned through gameplay (predictions, daily missions, login streaks, rewarded ads, and similar in-app rewards). The App does not offer in-app purchases, and coins cannot be bought with real money. Coins are not real money and have no monetary value outside the App. Coins:

• Cannot be exchanged for cash, goods, or services outside the App.
• Cannot be transferred to other users in any form that constitutes a withdrawal.
• Are used solely for in-app entry fees, cosmetic purchases (themes, badges, fan identities), and gameplay features.
• Are forfeited when an account is deleted; no compensation is owed for unused coins.

Challenges between users involve a fixed entry fee deducted from each participant's coin balance. The fee is consumed on entry and is not paid out to the winner; winners receive bragging rights and statistical credit only. This is a skill-based contest, not a wager pool, and no real-money prizes are awarded.

15. Trademark notice

Scoranza is an independent fan application. It is not affiliated with, endorsed by, or sponsored by FIFA, UEFA, the Premier League, La Liga, any football governing body, or any individual football club. All trademarks, team names, league names, and crests are the property of their respective owners and are used for descriptive purposes only.

16. Changes to this policy

We may update this policy from time to time. Material changes will be announced via an in-app notification. Your continued use of the App after such changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this page reflects the most recent revision.

17. Contact

• Privacy & data-protection email: privacy@scoranza.com
• General support email: support@scoranza.com
• Account-deletion form: scoranza.com/delete-account
• Website: scoranza.com

Data controller: Scoranza is operated by its individual proprietor (legal entity name and registered address available on written request to privacy@scoranza.com). The controller is the operator named in this section.

For data protection / privacy queries, please mark your email subject as "Privacy request" so we can route it appropriately. We respond within 30 days as required by applicable law.

Legal disclosures: personal data may be processed for legal purposes by the controller in court or in the stages leading to possible legal action arising from improper use of the App or related services (e.g., abuse, fraud, takedown notices).