Privacy Policy

1. Data we collect

We only collect what the game needs to work:

• Account: email address, username, creation date. Your password is never stored in clear text — authentication is handled by Supabase Auth, which only keeps an encrypted hash.
• Gameplay: your athlete picks for each stage, your scores, the leagues you create or join, and your league admin role.
• Notifications (optional): your Expo push token, platform (iOS/Android), device name and display language (so notifications reach you in your language) — only if you turn notifications on.
• Technical: server logs (IP address, timestamp, page or request called), kept for security and incident diagnosis.
• Preferences: your chosen language and your sign-in session, stored locally on your device.

2. Why we process this data, and on what legal basis

• Running the game — account, teams, leagues, standings: performance of our contract with you (GDPR art. 6.1.b).
• Sending push notifications (deadline reminders, published results): your consent, which you can withdraw at any time (art. 6.1.a).
• Keeping the service secure, preventing abuse and diagnosing outages, including internal alerts on unusual sign-in activity: legitimate interest (art. 6.1.f).
• Answering the requests you send us by email: legitimate interest (art. 6.1.f).

We use no data for advertising, no advertising trackers and no third-party analytics, and we neither sell nor rent your data.

3. Push notifications

Notifications are off by default. If you turn them on, your device receives an anonymous token that we link to your account in order to send deadline reminders and result announcements. You can turn them off at any time from Settings in the app, or in your phone's system settings — the token is then deleted from our servers.

4. Who hosts and processes your data

We rely on technical providers (processors) that only use your data on our behalf:

• Supabase — database and authentication (hosted in the European Union).
• Render — hosting for the game API.
• Expo (Expo Application Services) — push notification delivery, then relayed by Apple (APNs) on iOS and Google (FCM) on Android.
• Hostinger — website hosting and the mailbox used for service emails.
• Apple App Store and Google Play — distribution of the mobile app.

Some of these providers are established outside the European Union. Those transfers are covered by the European Commission's standard contractual clauses or an equivalent mechanism.

5. How long we keep your data

• Account and gameplay data: kept for as long as your account exists.
• Push tokens: deleted as soon as you turn notifications off or sign out.
• Technical logs: about 30 days.
• After account deletion: personal data is erased immediately and permanently (see next section).

6. Deleting your account

You can delete your account yourself, without contacting us: in the mobile app, open Settings and tap "Delete my account".

Deletion is immediate and permanent: profile, teams, picks, score history, league memberships, notification preferences and registered devices are all erased. If you are a league's only admin, that league is handed over to its longest-standing member; if you are its only member, the league is deleted. Nothing can be recovered once you confirm.

From the website, email us at the contact address above: deletion is carried out within 30 days at most.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, email us at the contact address above; we answer within one month.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

8. Security

Traffic to our servers is encrypted (HTTPS). Database access is controlled row by row (Row Level Security) and authenticated by token: a player can only read or change what belongs to them. Passwords are handled by Supabase Auth and are never accessible to us.

9. Cookies and local storage

We use no advertising cookies and no analytics cookies. The website and the app only store, on your device, your sign-in session and your language preference — both required for the service to work.

10. Minors

The game is free, with no stake and no money to be won. It is not intended for children under 15 without the consent of their legal guardian. If you notice an account created by a minor without that consent, email us and we will delete it.

11. Changes to this policy

This policy may change, for instance when we add a feature. The last updated date appears at the top of this page, and any significant change will be announced in the app.