Privacy Policy

1. Controller

The controller responsible for data processing is:

Sam Haghnejad
ProFootballQuiz
Vaalser Strasse 257C
52074 Aachen
Germany

E-mail for privacy requests: [email protected]

2. Data We Process

Depending on how you use the App, we may process the following data:

• Account data: username, optional e-mail address, language, internal user ID, authentication status and account settings.
• Game and profile data: avatar, points, coins, hearts, items, answers, progress, levels, categories, rankings, tournaments, challenges, duels, friend lists, invitations, party rooms and multiplayer progress.
• Purchase and subscription data: product identifier, purchase status, Premium entitlement, expiration dates, restoration status and technical purchase receipts. We do not receive full payment details such as credit card numbers.
• Advertising data: information about displayed ads, ad interactions, Rewarded Ads, ad cooldowns and technical reward verification.
• Analytics and usage data: app opens, sessions, screen views, interactions, feature usage, approximate region, device model, operating system, app version and performance data.
• Technical security and diagnostic data: IP address in server logs, API requests, device and app information, error, crash and abuse indicators.
• Push data: push token and notification settings where push notifications are enabled.
• Local data: language, session, settings, cache, game progress and other app data stored locally on the device.

3. Purposes of Processing

We process personal data for the following purposes:

• Providing account, login, guest access, quizzes, solo challenges, Nationality Team Challenge, live duels, tournaments, party games, friend features, rankings and game progress.
• Storing and synchronizing results, points, coins, items, Premium status, categories, level progress and rewards.
• Processing and restoring in-app purchases, subscriptions and Premium entitlements.
• Displaying and measuring advertising, especially Interstitial Ads and Rewarded Ads.
• Analyzing App usage with Firebase / Google Analytics for Firebase to improve stability, performance, navigation and features.
• Preventing fraud, abuse and security risks, for example manipulated rewards, unauthorized access or unusual API usage.
• Troubleshooting, crash diagnostics, technical maintenance and further development of the App.
• Sending push notifications where enabled.
• Complying with legal retention, documentation and compliance obligations.

4. Legal Bases

Depending on the purpose, processing is based on:

• Art. 6(1)(b) GDPR where processing is necessary to provide App features, accounts, multiplayer features, purchases or Premium services.
• Art. 6(1)(a) GDPR where consent is required, for example for certain analytics, advertising, tracking or push features.
• Art. 6(1)(f) GDPR where we have a legitimate interest in security, fraud prevention, troubleshooting, stability, product improvement and abuse prevention.
• Art. 6(1)(c) GDPR where we must comply with legal obligations.

5. Advertising, Analytics and Consent

The App may display advertising via Google AdMob. This includes Interstitial Ads and Rewarded Ads. Depending on region, platform and consent, advertising SDKs may process device identifiers, ad interactions, approximate location data and technical data.

Google User Messaging Platform may be used to manage consent. Where required, a privacy or consent form is shown when the App starts or when certain features are used. You can change your choices where this option is provided in the App, by your operating system or by your region.

We use Firebase / Google Analytics for Firebase to understand App usage and technical stability. This may include app-instance IDs, app opens, sessions, screen views, interactions, in-app purchases, device model, operating system, app version and approximate geography. Where consent is required under applicable law, processing takes place only on the basis of that consent.

Our public web pages for privacy, support, legal notice, account deletion and invitations do not use cookies for tracking and do not include third-party analytics scripts.

6. In-App Purchases and Premium

In-app purchases and subscriptions are processed through the Apple App Store or Google Play. We use RevenueCat to manage purchase status, Premium entitlements and purchase restoration. We do not receive full payment details such as credit card numbers or bank details.

Purchase-related data may be necessary to correctly process Premium features, coin packages, restorations, refund status and support requests.

7. Service Providers and Recipients

We may transfer data to, or have data processed by, the following service providers:

• Google AdMob and Google User Messaging Platform for advertising and consent management.
• Firebase / Google Analytics for Firebase for app analytics, technical measurement and product improvement.
• RevenueCat for in-app purchases, subscriptions, purchase status and Premium entitlements.
• Apple App Store and Google Play for app distribution, purchases, subscriptions and payment processing.
• Expo, Apple Push Notification service and Firebase Cloud Messaging for technical app services and push notifications.
• Hosting, database and infrastructure providers for API, account, multiplayer, ranking, challenge and backend features.

Where service providers act as processors, we use data processing agreements or comparable data protection terms.

These service providers may also process data outside the European Union or the European Economic Area. In such cases, we ensure appropriate safeguards where legally required, in particular adequacy decisions, EU Standard Contractual Clauses or other recognized transfer mechanisms.

8. Retention Period

Account and game data is generally stored as long as the account exists or the data is required for App features, synchronization, rankings, rewards, fraud prevention or support. Purchase data is stored as long as necessary to manage entitlements, restore purchases or comply with legal obligations.

Analytics, diagnostic and crash data is stored only as long as necessary for analytics, security, stability and product improvement or processed by the respective service providers according to their settings and policies.

9. Account Deletion

You can delete your account in the App under Settings where this function is available. Alternatively, you can send a deletion request by e-mail to [email protected].

When an account is deleted, account and game data is deleted or anonymized unless legal retention obligations, fraud-prevention reasons, security reasons or legitimate documentation requirements prevent deletion. You can additionally remove locally stored data from your device by deleting the App or using your device settings.

10. Data Subject Rights

Depending on applicable law, you have rights to access, rectification, deletion, restriction of processing, data portability, objection to certain processing and withdrawal of consent.

Requests can be sent to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority may include the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Consent for advertising, analytics or push notifications can be managed, depending on the feature, in the App, through consent dialogs or through your operating system settings.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

11. Children and Young People

ProFootballQuiz is not specifically directed at children under 13 years of age or below the locally required minimum age. If we learn that personal data of a child has been processed without required consent, we will take appropriate steps to delete that data.

12. Security

We use appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access and unauthorized disclosure. These measures include access restrictions, encrypted transmission, server-side validation and abuse-prevention measures. However, no system can guarantee complete security.