Privacy
Policy

Call the Scores is operated by White Arc (sole trader, UK) - the data controller. Contact: contact@whitearc.co.uk.

• Account data - email address, password (stored hashed), display name.
• Google sign-in data - if you choose to sign in with Google, Google gives us your email address, your Google account name and a link to your Google profile picture. We store these to create and identify your account. We never see or receive your Google password.
• Your preferences - favourite teams, sports, competitions, email preferences.
• Your activity - predictions, points, league memberships, tournament participation.
• Feedback you submit.
• Technical data needed to run the service (authentication session).
• Approximate location - we derive your country (a two-letter country code such as GB or US) from your IP address the first time you sign in, so we can understand where our users are based. We do not store your IP address and we do not collect precise or GPS-level location data.

• Visit and device data - pseudonymous device and session ids, pages viewed, the referring address, campaign source, medium and name, and the time each event is recorded. Campaign and referral details may also be saved on your account.
• Diagnostic data - error messages, technical error traces, the page address including its query string, browser and device details from the user agent, browser window size, online status, browser language, page language, translation status and the time of the fault. For slow or stuck pages, we also record loading times, the step still waiting, whether the page is visible and whether it is running as an installed app. Where the browser supplies them, we record connection type, estimated speed and delay, and data-saving mode. Save failures can include error codes and the match, sport or league involved.
• Notifications - if you enable push notifications, we store the delivery address and technical keys needed to send them to your browser or device.
• Marketing measurement - if you accept non-essential cookies, Meta's pixel can receive page-view and completed sign-up events, along with browser information it collects.

Most of the data we hold comes directly from you. If you sign in with Google, we also receive your email address, name and profile picture link from Google. You can review or remove Call the Scores' access at any time in your Google account settings. Doing so stops you signing in with Google, but it does not delete your Call the Scores account: to delete it, use the account deletion option in your profile.

• Providing the game (contract) - accounts, predictions, scoring, leaderboards and leagues.
• Service emails - account confirmation, password resets and prediction deadline reminders (contract / legitimate interests). Reminders can be switched off in your profile.
• Marketing emails (consent) - only if you opt in. Withdraw any time in your profile or via unsubscribe.
• Visit statistics (legitimate interests) - using pseudonymous device and session ids to measure and improve the service. Reject non-essential in Cookie settings to stop new device-storage writes for these statistics. Temporary in-memory event recording continues, and separate campaign and referral storage is not switched off. See our Cookie Policy for details.
• Fault diagnosis and security (legitimate interests) - finding and fixing errors, investigating slow or stuck pages, preventing abuse and keeping the service safe.
• Safety and moderation - legitimate interests.
• Marketing measurement (consent) - Meta's pixel measures our marketing when you accept non-essential cookies. This is separate from our own visit statistics.

Your display name, favourite team, points and ranks are visible to other signed-in users - this is core to the game. Choose a display name you are happy to show. Your email address is never shown to other users.

• Hosting, database, sign-in and fault reporting - Lovable Cloud stores and processes app data on our behalf. Cloudflare provides hosting infrastructure and the Turnstile security check, which receives technical request and browser information to help prevent abuse.
• Email delivery - Lovable's email delivery service receives recipient addresses and message content for account and other service emails. Brevo receives addresses and message content for prediction reminders, with the Lovable email service used as a fallback. Brevo also receives opted-in marketing contacts, including display name and country where available, and manages unsubscribe information.
• Google sign-in - if you choose it, Google acts as your identity provider and confirms your identity to us. We do not send Google information about your predictions, leagues or game activity.
• Push delivery - if you enable notifications, your browser or device's push service receives the delivery information and encrypted notification needed to deliver them.
• Marketing measurement - Meta receives pixel events if you accept non-essential cookies. These are separate from the first-party visit records kept in our database.

Sports data providers supply match data. We do not send them your account details or predictions as part of our match-data requests.

We do not sell your data. We show advertising through Google AdSense. Google and its advertising partners may use cookies and similar technologies to show ads, including based on your activity on this and other sites - this only happens with your consent, which you can give or withdraw at any time in Cookie settings. We do not send Google any information about your predictions, leagues or activity for advertising purposes. You can opt out of personalised advertising generally at Google's Ads Settings (adssettings.google.com), and read more about how Google uses data at policies.google.com/technologies/partner-sites.

We keep your data while your account exists. Deleting your account permanently removes your personal data (profile, predictions, memberships, email); leagues you created remain for their members without your ownership; anonymous aggregate statistics are retained.

Visit-statistics records currently have no automatic deletion period and remain until removed. Diagnostic records in our app error log are cleaned up when they are more than 30 days old by the nightly fixture sync. Repeated faults can refresh an existing record's date, so a continuing fault can remain longer. Cleanup depends on that sync completing successfully.

Browser-storage lifetimes are listed in our Cookie Policy. The app's diagnostic cleanup does not set a retention period for logs held separately by our service providers.

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Exercise them in-app (profile settings and account deletion) or by emailing contact@whitearc.co.uk. You can complain to the Information Commissioner's Office (ico.org.uk).

Call the Scores is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you believe your child has provided us with personal information, please contact us and we will take steps to remove that information from our systems. Users between 13 and 18 may use the service with the consent of a parent or guardian.

Data is stored within the UK/EEA or transferred with appropriate safeguards by our providers.

We will flag material changes in the app.