Privacy Policy

1. Who We Are

FootyIQ ("we", "us", "our") is a football quiz web application operated from Germany. For contact details, see our Imprint.

2. Data We Collect

We collect the following categories of personal data:

• Account data — email address, display name, and hashed password (or Google OAuth profile data) when you create an account.
• Game activity — XP earned, current level, daily streak, skip/joker usage, custom quiz usage, and leaderboard scores.
• Payment data — processed exclusively by Stripe. We store only your Stripe Customer ID, subscription status, and user role (free/premium). We never see or store your credit card number.
• Local storage — we store preferences and game state in your browser's localStorage (e.g. league selection, skip cooldowns, intro offer timestamp). This data never leaves your device unless explicitly synced.
• Technical data — IP address, browser type, and request timestamps in server logs (retained for security and debugging).

3. How We Use Your Data

• To provide and personalize the quiz experience (game state, XP, streaks, leaderboards).
• To manage your account and authenticate you.
• To process payments and manage subscriptions via Stripe.
• To enforce fair-use limits (e.g. custom quiz weekly limits for free users).
• To improve our service and fix bugs (server logs).

4. Legal Basis (GDPR Art. 6)

• Consent (Art. 6(1)(a)) — when you sign up and accept our Terms of Service and Privacy Policy.
• Contract performance (Art. 6(1)(b)) — to provide the service you signed up for, including premium subscriptions.
• Legitimate interest (Art. 6(1)(f)) — server logs for security, fraud prevention, and service improvement.

5. Third-Party Services

We use the following third-party services that may process your data:

• Supabase (database & authentication) — hosted in EU (eu-west-1). Stores account data, game activity, and authentication sessions. Supabase Privacy Policy
• Stripe (payment processing) — processes subscription payments. Stripe Privacy Policy
• Google (OAuth authentication) — if you sign in with Google, we receive your email and profile name. Google Privacy Policy
• Vercel (hosting) — serves the application and processes HTTP requests. Vercel Privacy Policy

6. Cookies & Local Storage

We use the following browser storage mechanisms:

• Session cookies (essential) — set by Supabase Auth to maintain your login session. These are strictly necessary and do not require consent.
• localStorage (functional) — stores game preferences (league selection, skip/joker cooldowns, intro offer timestamps, cookie consent status). This data stays on your device.

We do not use any advertising or analytics cookies.

7. Data Retention

• Account data — retained as long as your account is active. Deleted upon account deletion request.
• Game activity — retained as long as your account is active.
• Server logs — retained for up to 30 days.
• Payment records — retained as required by tax law (up to 10 years for German tax obligations).

8. Your Rights (GDPR Art. 15–21)

As an EU resident, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data (you can edit your display name in your profile).
• Right to erasure (Art. 17) — request deletion of your account and all associated data via your profile page or by contacting us.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent — you may withdraw consent at any time by deleting your account.

To exercise any of these rights, contact us at footyiq@mail.online-impressum.de.

9. Data Transfers

Your data is primarily processed within the European Union (Supabase EU region). Some third-party services (Stripe, Google, Vercel) may process data in the United States under the EU–US Data Privacy Framework or Standard Contractual Clauses.

10. Children's Privacy

FootyIQ is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-app notice. The "Last updated" date at the top indicates the latest revision.

12. Contact & Supervisory Authority

For privacy-related questions, contact us at footyiq@mail.online-impressum.de.

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, you may contact the supervisory authority of the federal state where you reside, or the Federal Commissioner for Data Protection (BfDI).