Privacy Policy

1. Introduction

At Soccer Fire ("us", "we", "our" or the "Company") we value your privacy and the importance of safeguarding your data. This Privacy Policy (the "Policy") describes our privacy practices for the activities set out below. As per your rights, we inform you how we collect, store, access, and otherwise process information relating to individuals. In this Policy, personal data ("Personal Data") refers to any information that on its own, or in combination with other available information, can identify an individual.

We are committed to protecting your privacy in accordance with the highest level of privacy regulation. As such, we follow the obligations under the below regulations:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial legislations
• Quebec Law 25
• The EU's General Data Protection Regulation (GDPR)
• Brazil's Data Protection Legislation (LGPD)
• California's Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and California Online Privacy Protection Act (CalOPPA)
• Colorado Privacy Act (CPA)
• Utah Consumer Privacy Act (UCPA)
• Connecticut Data Privacy Act (CTDPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Texas Data Privacy and Security Act (TDPSA)
• Oregon Consumer Privacy Act (OCPA)
• Montana Consumer Data Privacy Act
• Delaware Personal Data Privacy Act
• Nebraska Data Privacy Law
• New Hampshire Data Privacy Act
• New Jersey Data Privacy Act
• Minnesota Consumer Data Privacy Act
• Maryland Online Consumer Protection Act
• Kentucky Consumer Data Protection Act (KCDPA)
• Tennessee Information Protection Act (TIPA)
• The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
• Indiana Consumer Data Protection Act (INCDPA)
• Iowa Consumer Data Protection Act (ICDPA)
• South Africa's Protection of Personal Information Act (POPIA)
• Switzerland's Federal Act on Data Protection (FADP)
• Saudi Arabia's Personal Data Protection Law (PDPL)

Scope

This policy applies to the Soccer Fire website (soccerfire.app), mobile applications (iOS and Android), and all related services and products.

This Policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through links that we may provide to you. These sites are owned and operated independently from us, and they have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed by the third-party's own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites.

Processing Activities

This Policy applies when you interact with us by doing any of the following:

• Make use of our mobile application and services as a registered user
• Visit our website at soccerfire.app
• Participate in trivia challenges, multiplayer battles, or leaderboard competitions
• Contact us through our contact form or support channels

2. Personal Data We Collect

What Personal Data We Collect

When you create an account and use Soccer Fire, we collect the following types of Personal Data:

Account Information:

• Email address
• Display name (user-chosen)
• Password (stored securely using industry-standard hashing)
• Account creation and last login timestamps
• Authentication provider information (if you sign in via Google or Apple)

Profile Data:

• Avatar selection or custom avatar photo (if you choose to upload one)
• Cosmetic and customization preferences

Gameplay Data:

• Games played, correct answers, and total questions answered
• Experience points (XP) and rank tier progression
• Energy tokens and refill timestamps
• Daily streak data (current streak, longest streak)
• Challenge and multiplayer match history (opponents, results)
• Leaderboard position

Device and Technical Data:

• Push notification tokens (for delivering notifications to your device)
• Device type, operating system, and platform (iOS or Android)
• IP address (collected automatically via server logs)
• Crash reports and error diagnostics (via Sentry)
• Advertising identifier (on Android, with your consent)

Communication Data:

• Name, email, and message content when you submit our contact form

How We Collect Your Personal Data

We collect Personal Data from the following sources:

From You. You provide us your Account Information and Profile Data when you:

• Create an account (via email/password, Google Sign-In, or Apple Sign-In)
• Set your display name and choose or upload an avatar
• Play trivia challenges and participate in multiplayer battles
• Contact us through our contact form
• Grant permissions for push notifications or camera/photo library access

Automated Technologies. As you interact with our app and website, we automatically collect Device and Technical Data, including crash reports, usage patterns, and network information. On our website, we use cookies and similar technologies (see Section 3 below).

Third-Party Authentication Providers. When you sign in using Google or Apple, we receive your email address and basic profile information as authorized by you through those providers.

Device and Usage Data

When you use the Soccer Fire mobile app or visit our website, we automatically collect and store information about your visit using cookies (on the website) or similar technology. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, you may not be able to use some features of our website.

Purpose and Legal Basis for the Processing of Personal Data

We collect and use your Personal Data for the following purposes and legal bases:

• Contract Performance: To provide, maintain, and operate the Soccer Fire game — including account management, gameplay, matchmaking, leaderboards, and push notifications.
• Consent: To send you marketing communications, personalize advertising, and enable analytics tracking. You may withdraw consent at any time.
• Legitimate Interest: To improve our products and services, ensure security, prevent fraud, and monitor app stability through crash reporting.
• Legal Obligation: To comply with applicable laws, respond to legal requests, and fulfill data subject rights.

International Data Transfer and Storage

Your Personal Data is stored and processed on servers provided by Supabase (our database provider) and may be located outside of your country of residence. Our website is hosted on Vercel, which uses a global CDN. Your data may be transferred to, and maintained on, servers in the United States or other jurisdictions where data protection laws may differ from those in your jurisdiction.

We take appropriate steps to ensure that your Personal Data is treated securely and in accordance with this Policy and applicable data protection law, including the use of Standard Contractual Clauses where required. More information: EU Standard Contractual Clauses.

Sharing and Disclosure

We will share your Personal Data with third parties only as set out in this Policy. We use the following third-party service providers to operate Soccer Fire:

• Supabase — Database hosting, authentication, and file storage
• Vercel — Website hosting and deployment
• Expo — Mobile app build and push notification delivery
• Google AdMob — In-app advertising (mobile)
• Google AdSense — Website advertising
• Google Analytics — Website usage analytics
• Sentry — Error tracking and crash reporting
• Google Sign-In / Apple Sign-In — Authentication providers

Each of these providers processes data on our behalf and is contractually obligated to protect your data. We may also disclose your Personal Data to comply with a legal obligation, in connection with a request from a public authority, or to protect our rights or property.

3. Cookies

What Are Cookies?

A cookie is a small file with information that your browser stores on your device. Information in this file is typically shared with the owner of the site in addition to potential partners and third parties.

How We Use Cookies

On our website (soccerfire.app), we use the following categories of cookies:

• Essential Cookies: Required for the website to function properly, including session management and language preferences. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our website (powered by Google Analytics). These are only activated with your consent.
• Advertising Cookies: Used for personalized advertising and ad performance measurement (powered by Google AdSense). These are only activated with your consent.

We implement Google Consent Mode v2, which ensures that analytics and advertising cookies default to "denied" until you provide explicit consent via our cookie banner. You can manage your cookie preferences at any time through the cookie settings on our website.

Our mobile application does not use browser cookies. However, it may use device identifiers for advertising purposes (such as the Android Advertising ID), subject to your consent and App Tracking Transparency preferences on iOS.

4. Retention & Deletion

We will only retain your Personal Data for as long as necessary for the purpose for which it was collected and to the extent required by applicable law. Specifically:

• Account Data: Retained for as long as your account is active. When you delete your account, your profile is soft-deleted (display name changed to "Deleted User", push tokens removed). You may request full deletion by contacting us.
• Gameplay Data: Retained for as long as your account exists to maintain leaderboards and match history.
• Crash Reports: Retained by Sentry according to their data retention policies (typically 90 days).
• Contact Form Submissions: Retained for as long as needed to resolve your inquiry.

When we no longer need Personal Data, we will remove it from our systems and/or take steps to anonymize it.

5. Merger or Acquisition

If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different Privacy Policy. Under certain circumstances, we may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

6. How We Keep Your Data Safe

We have appropriate organizational safeguards and security measures in place to protect your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

• All communication between your device and our servers uses secure encrypted connections (HTTPS/TLS).
• Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• Our database uses Row Level Security (RLS) policies to ensure users can only access their own data.
• Sensitive tokens and credentials are stored using platform-secure storage (Keychain on iOS, Keystore on Android).
• We require any third party contracted to process your Personal Data to have security measures in place and to treat such data in accordance with the law.

In the unfortunate event of a Personal Data breach, we will notify you and any applicable regulator when we are legally required to do so.

7. Children's Privacy

Soccer Fire is not directed at children under the age of 13. We do not knowingly collect Personal Data from children under the age of 13. If you are a parent or guardian and you believe your child under 13 has provided us with Personal Data, please contact us at the address below so we can take steps to delete such information. If we become aware that we have collected Personal Data from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

8. Your Rights for Your Personal Data

Depending on your geographical location and citizenship, your rights are subject to local data privacy regulations. These may include:

Right to Access (PIPEDA, GDPR Article 15, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)
You have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we are processing about you.

Right to Rectification (PIPEDA, GDPR Article 16, CPRA, CPA, VCDPA, CTDPA, LGPD, POPIA)
You have the right to have incomplete or inaccurate Personal Data that we process about you rectified.

Right to be Forgotten (Right to Erasure) (GDPR Article 17, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)
You have the right to request that we delete Personal Data that we process about you, unless we need to retain such data to comply with a legal obligation or to establish, exercise or defend legal claims. You can delete your account directly within the Soccer Fire app under Settings.

Right to Restriction of Processing (GDPR Article 18, LGPD)
You have the right to restrict our processing of your Personal Data under certain circumstances. In this case, we will not process your Data for any purpose other than storing it.

Right to Portability (PIPEDA, GDPR Article 20, LGPD)
You have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such Personal Data to another data controller.

Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA)
You have the right to opt out of the processing of your Personal Data for purposes of: (1) Targeted advertising; (2) The sale of Personal Data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell your Personal Data. You can opt out of personalized advertising through our cookie consent settings on the website or your device's privacy settings in the mobile app.

Right to Objection (GDPR Article 21, LGPD, POPIA)
Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation.

Nondiscrimination and Nonretaliation (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA)
You have the right not to be denied service or have an altered experience for exercising your rights.

File an Appeal (CPA, VCDPA, CTDPA)
You have the right to file an appeal based on our response to you exercising any of these rights. In the event you disagree with how we resolved the appeal, you have the right to contact the attorney general in your state.

File a Complaint (GDPR Article 77, LGPD, POPIA)
You have the right to bring a claim before your competent data protection authority. If you are based in the EEA, please visit this website for a list of local data protection authorities.

Withdrawing Consent
If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge. If you wish to withdraw your consent, please contact us using the information found at the bottom of this page, or manage your preferences directly within the app or website.

How to Exercise Your Rights

You can make a request to exercise any of these rights by contacting us at privacy@soccerfire.app or through our contact form. For your own privacy and security, we may require you to verify your identity before processing your request.

9. Changes

We may modify this Policy at any time. If we make changes to this Policy, we will post an updated version on this page and update the "Last Updated" date. For material changes, we may notify you through the app or by email. Your continued use of Soccer Fire after any changes constitutes your acceptance of the updated Policy.

10. Contact Us

To request a copy of your information, unsubscribe from communications, request data deletion, or ask a question about your data privacy, you can reach us through:

• Email: privacy@soccerfire.app
• Contact Form: soccerfire.app/contact
• In-App: Use the account deletion feature in Settings to delete your account

We aim to respond to all data privacy requests within 30 days.