Privacy Policy

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include:

• IP address (used for rate limiting and security)
• Device platform (iOS or Android)
• Push notification token
• Log and usage data (API requests, timestamps, error logs)
• General usage and performance data

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Sensitive Information. We do not process sensitive information.

2. How Do We Process Your Information?

We process your personal information for the following reasons:

• To authenticate users: We use email addresses to send one-time passwords (OTP) that verify user identity and grant secure access to the platform.
• To deliver and facilitate the delivery of services: Core app functionality including competitions, games, stats, and standings.
• To manage competition participation: We use player profile information to facilitate roster management, match participation, and performance tracking within competitions.
• To calculate and display sports statistics: We use match data and player identifiers to automatically calculate goals, assists, appearances, standings, and other sports statistics.
• To send administrative information: OTP codes, welcome emails, Terms update notifications, and competition invite notifications.
• To respond to user inquiries: Support communications via our contact email.
• To enforce rate limiting and prevent abuse: We monitor API request patterns and IP addresses to detect and prevent excessive or abusive use of the platform.
• To maintain platform integrity: We log match data entry patterns to detect suspicious activity such as falsified scores or statistics.
• To investigate and resolve disputes: We retain logs of match data changes, invite acceptances, and account activity to assist in resolving disputes between competition owners, team owners, and players.
• To identify usage trends: To analyze how our Services are used so we can improve them.
• To protect our Services: To diagnose problems and prevent fraudulent activities.

3. When and With Whom Do We Share Your Personal Information?

We may need to share your personal information in the following situations:

Service Providers

Each of these providers has entered into data processing agreements and is contractually obligated to protect your personal information and process it only as directed by Sportykore. We do not sell, trade, or rent your personal information to third parties.

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. Do We Use Cookies and Other Tracking Technologies?

Sportykore is a mobile application and does not use browser cookies, web beacons, tracking pixels, or similar tracking technologies. Authentication is handled via Bearer tokens stored securely on your device using Expo Secure Store.

We do not use Google Analytics, advertising networks, or any third-party tracking services.

5. How Do We Handle Your Social Logins?

Sportykore currently uses a passwordless One-Time Password (OTP) system for authentication. We do not currently offer registration or login via third-party social media accounts such as Google or Apple.

When social login is introduced in a future update, this section will be updated to describe what information we receive from those providers and how it is used. You will be notified of any such changes via email at legal@notifications.sportykore.com.

6. Is Your Information Transferred Internationally?

Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored by, and processed by us in the United States and by the third parties with whom we share your personal information.

European Economic Area (EEA), UK, and Switzerland users

If you are a resident in the EEA, UK, or Switzerland, your data may be transferred to countries that do not have data protection laws as comprehensive as those in your country. However, we take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the lawful transfer mechanism for transferring personal information from the EEA/UK to the United States. All our third-party service providers maintain SCCs as part of their data processing agreements.

7. How Long Do We Keep Your Information?

We retain your personal information for as long as you maintain an account with Sportykore. Upon account deletion:

• Personal account data (email address, display name, bio, and profile photo) will be permanently deleted within 30 days
• Match statistics, game records, and competition history associated with your player profile will be retained indefinitely as part of the competition's historical record but will be anonymized and no longer linked to your identity
• Authentication codes (OTPs) are automatically deleted within 10 minutes of generation regardless of whether they are used
• Device tokens are deleted immediately upon account deletion

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information.

8. Do We Collect Information From Minors?

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 years old.

If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at legal@notifications.sportykore.com.

9. What Are Your Privacy Rights?

Your rights include:

• Right to access — request a copy of the personal information we hold about you
• Right to rectification — request that we correct inaccurate or incomplete personal information
• Right to erasure — request deletion of your personal information
• Right to restrict processing — request that we limit how we use your personal information
• Right to data portability — request your data in a portable format
• Right to object — object to our processing of your personal information
• Right to withdraw consent — withdraw consent at any time where we rely on consent to process your information

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account
• Use the in-app "Delete Account" option found in Profile → Settings → Account → Delete Account
• Contact us using the contact information provided below

Upon your request to terminate your account, we will deactivate or delete your account and personal information from our active databases within 30 days. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

To exercise your rights

Submit a request to: legal@notifications.sportykore.com

We will consider and act upon any request in accordance with applicable data protection laws within 30 days.

10. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

As Sportykore is a mobile application that does not use cookies or online tracking technologies, DNT signals do not apply to our Services. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

11. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice.

If we make material changes to this Privacy Notice, we will notify you by sending an email notification to the email address associated with your account from legal@notifications.sportykore.com at least 30 days before the changes take effect.

We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact us at:

13. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.

To request to review, update, or delete your personal information, please contact us at:

14. Nigeria Data Protection Act (NDPA) 2023

Sportykore is committed to complying with the Nigeria Data Protection Act (NDPA) 2023 administered by the Nigeria Data Protection Commission (NDPC). Nigerian users have the following rights regarding their personal data:

• The right to access their personal data
• The right to rectification of inaccurate data
• The right to erasure of their data
• The right to object to processing
• The right to data portability

To exercise any of these rights, Nigerian users may contact us at legal@notifications.sportykore.com. We will respond to all requests within 30 days.

15. Sports Statistics and Competition Records

Match statistics, game results, player performance data, and competition standings entered into Sportykore by competition administrators and team owners constitute competition records. These records are retained indefinitely to preserve the integrity and history of competitions.

Upon account deletion, your personal identifiers (name, email, avatar) will be removed and your player record anonymized, but associated match statistics and competition history will be retained as part of the competition's permanent record.

Competition owners are responsible for the accuracy of data entered on behalf of their competitions.

16. Invite Links and Player Roster Data

Competition administrators may generate invite links to add users to competitions. When you accept an invite link, your player profile information including your display name and avatar will be visible to:

• All members and administrators of that competition
• Any user who views that competition's public page
• General users browsing the Sportykore platform

Competition administrators may view, edit, and remove player roster entries within their competitions. If you wish to be removed from a competition roster, contact your competition administrator directly or contact us at legal@notifications.sportykore.com.

17. One-Time Password (OTP) Authentication

Sportykore uses a passwordless authentication system. When you sign in, a one-time password (OTP) is sent to your email address via our email provider Resend. This code is:

• Valid for 10 minutes only
• Single-use — can only be used once
• Permanently deleted immediately after use or upon expiry
• Stored in encrypted form during its validity window

Sportykore does not store passwords of any kind. Your email address is the sole authentication credential associated with your account.