Privacy Policy

1. Who is responsible

Andrey Ivanov Borisov, Mladost 3, bl. 373, entrance A, apt. 22, 1712 Sofia, Bulgaria, runs the Service and is the controller of your personal data. Contact: [email protected].

2. What we collect

• Account: your email address and a bcrypt hash of your password (we cannot read your password), when you registered, whether you confirmed your email, and when and which version of the Terms you accepted.
• Use of the Service: the predictions you open, the picks and favourites you save, your daily usage count, your last login time and how many times you logged in.
• Technical data: your IP address and request details (page, time, browser) in our server logs, used to run the Service, limit abuse and fix faults.
• Payments (Pro plan only): your Stripe customer number and subscription number, the plan you chose, its status and renewal date. For tax and accounting we also keep a record of each payment: its date and amount, the Stripe payment number and the country of your billing address (or of your card); this is all we keep from Stripe. To create your customer record we send Stripe your email address and our internal account number. Stripe itself collects and keeps your card and billing details (for example your card, name and billing address or country, as its checkout asks for them); we do not store your card number or billing details.
• Emails we send: confirmation and password-reset messages and, if you were invited, the invitation and notices about complimentary access. Our email provider records whether each one was delivered.
• Messages to us: whatever you write if you email [email protected].

On our own pages we do not ask for your name, phone number, payment details or location, and we do not collect data about children. If you subscribe to Pro, Stripe’s checkout and billing pages ask for the payment and billing details described above and process them under Stripe’s own privacy policy.

3. Why, and on what basis

• To create and run your account, show you predictions and keep your picks (performance of the contract with you).
• To send the confirmation and password-reset emails you need (performance of the contract).
• To keep the Service secure, prevent abuse and fix problems: rate limiting, logs, protecting accounts (our legitimate interest in running a safe service).
• To take payment for Pro, keep the subscription running and keep the accounting records the law requires (performance of the contract and legal obligation).
• To keep proof that you accepted the Terms, and to meet legal obligations if they apply (legitimate interest and legal obligation).

We do not sell your data, do not use it for advertising and do not profile you for marketing. If that ever changes we will update this page and ask for your consent where the law requires it.

4. Who else handles it

We use a few providers to run the Service. They process data on our behalf:

• Oracle Cloud (Frankfurt, Germany): hosts the servers and the database.
• Cloudflare: DNS, a security and caching layer in front of the site, routing of mail sent to [email protected], and storage (R2, European Union) for our encrypted database backups. It sees the traffic to the site and may set strictly technical cookies for security.
• Stripe: processes card payments for the Pro plan. It receives your email address and payment details and is responsible for them under its own privacy policy as well; it is based in the United States and Ireland.
• Resend: sends our confirmation and password-reset emails (it receives your address and the message).

Football data comes from a third-party data provider; we send it match identifiers, not personal data. Some providers are based outside the European Economic Area; where that is so, transfers rely on safeguards the law recognises, such as standard contractual clauses. We may also disclose data if a court or authority lawfully requires it.

5. Cookies and local storage

We do not use advertising or analytics cookies. Your browser’s local storage keeps your login token and a small cache of your favourites, which the site needs to work; they stay on your device until you log out or clear your browser data.

6. How long we keep it

• Account and usage data: for as long as your account exists. If you delete your account under Settings it is erased at once; if you ask us by email, within 30 days.
• Password-reset and email-confirmation links: they expire after 60 minutes and 24 hours, and only a hash of them is stored.
• Server logs with IP addresses: up to 30 days.
• Backups of the database: encrypted copies are kept for up to 30 days, so a deleted account can remain in a backup for that long before it disappears.
• Proof of acceptance of the Terms is kept with the account.
• Payment records (invoices, payment confirmations) are kept by us and by Stripe for as long as tax and accounting law requires, even after you delete your account. Deleting your account also cancels any active subscription.

7. Security

Connections use HTTPS, passwords are stored only as bcrypt hashes, and tokens for password reset and email confirmation are stored only as hashes. No system is perfectly secure; if a breach affects your data in a way the law requires us to report, we will tell you and the authority.

8. Your rights

You can ask us for access to your data, a copy of it, correction, deletion, restriction of its use, or to object to processing based on our legitimate interest. You can delete your account yourself under Settings. For anything else, email [email protected] from the address of your account; we reply within one month. You can also complain to the data protection authority: Commission for Personal Data Protection (CPDP), Bulgaria, or the authority in your own country.

9. Age

The Service is for people aged 18 and over. If you believe a child has registered, tell us and we will delete the account.

10. Changes

We will update this page when our practices change; the date at the top shows the current version. Significant changes will be announced by email or in the Service.