Privacy Policy

Last updated: February 14, 2026

1. Introduction

This Privacy Policy describes how the CupNation application (hereinafter "Application", "we", "us") collects, uses, stores, and protects your personal data. The Application is available on the Android platform and is used for predicting results of sports matches within tournaments.

By using the Application, you agree to the practices described in this policy. If you do not agree, please do not use the Application.

2. Data Controller

The controller of your personal data is the operator of the CupNation application. If you have any questions regarding the protection of personal data, please contact us at:

3. What Data We Collect

3.1 Data Provided by the User

Data	Purpose
Email address	Account creation and management, authentication
Password	Account security (stored in encrypted form via Firebase Authentication)
Display name	Identification within tournaments, leaderboards, and chat
Profile photo	Optional profile personalization (uploaded from gallery or camera)
Favorite team	Optional profile personalization

3.2 Data Generated by Using the Application

Data	Purpose
Betting tips	Your predictions for match results, scoring
Chat messages	Communication with other tournament participants
Tournament participation	Membership records and tournament statistics
Global statistics	Aggregate statistics of your predictions across tournaments

3.3 Automatically Collected Data

Data	Purpose
FCM tokens (push notifications)	Delivering notifications about match results
Online/offline status	Displaying presence within the Application
Last activity time	Session management and presence display
Language preference	Content and push notification localization

3.4 Purchase Data

If you make a purchase within the Application (subscriptions, tournament passes, template credits), we process:

• Purchase tokens from Google Play to verify transaction validity
• Entitlement type and status (premium subscription, tournament passes, credits)

We do not collect actual payment details (card numbers, etc.) – these are processed exclusively by Google Play.

4. Purpose of Data Processing

1. Service provision – account creation and management, enabling predictions, tournament participation, chat communication
2. Personalization – displaying your profile to other users, language localization
3. Notifications – sending push notifications about match results and important tournament events
4. Purchases – processing and verifying in-app purchases
5. Security – protection against service abuse through Firebase App Check (Play Integrity)
6. Service improvement – evaluating aggregate statistics and Application functionality

5. Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b) GDPR) – processing necessary for providing the Application's service
• Legitimate interest (Art. 6(1)(f) GDPR) – ensuring the security and functionality of the Application
• Consent (Art. 6(1)(a) GDPR) – sending push notifications (consent can be withdrawn at any time in device settings)

6. Third-Party Services

6.1 Google Firebase

Service	Purpose	Data Processed
Firebase Authentication	Login and account management	Email, password (hash), Google ID
Cloud Firestore	Database – profiles, tournaments, bets, chat	All Application user data
Firebase Storage	Image storage	Profile photos, tournament logos
Firebase Cloud Messaging	Push notifications	Device FCM tokens
Firebase Cloud Functions	Server-side logic	Purchase verification, entitlement management
Firebase App Check	Abuse protection	Device metadata (Play Integrity)

Google Privacy Policy: https://policies.google.com/privacy

6.2 Google Sign-In

If you sign in using your Google account, we receive your email and profile information (name, profile photo) from your Google account. We only access the email and profile scopes.

6.3 Google Play (In-App Purchases)

In-app purchases are processed through Google Play. We only receive transaction tokens to verify purchase validity. Payment details are processed exclusively by Google.

Google Play Privacy Policy: https://play.google.com/about/privacy-security-deception/

6.4 Google Fonts

The Application downloads fonts from the Google Fonts service. During download, Google may record your device's IP address.

Google Fonts Privacy: https://developers.google.com/fonts/faq/privacy

7. Data Sharing

7.1 Data Visible to Other Users

• Display name and profile photo – in public profile
• Favorite team – in public profile
• Betting tips – visible to participants of the same tournament
• Chat messages – visible to participants of the respective tournament
• Global statistics – aggregate statistics visible to all logged-in users

7.2 Data We Do Not Share

• Email address
• FCM tokens
• Online/offline status (visible only to the system)
• Purchase data and entitlements

7.3 Third Parties

We do not sell or provide your personal data to third parties for marketing purposes. We only share data with the services listed in Section 6 to the extent necessary for the operation of the Application.

8. Application Permissions

Permission	Purpose
Internet	Communication with Firebase and other services
Push notifications	Displaying match result notifications
Billing	In-app purchases via Google Play

9. Data Retention

• We retain your personal data for the duration of your user account's existence.
• Data is stored on Google Firebase servers (region: United States – us-central1).
• Chat messages and betting tips are retained for the duration of the respective tournament.
• Purchase records are retained for the period required by applicable laws.

10. Data Security

• Firebase Authentication – secure identity verification
• Firebase Security Rules – access rules restricting data read/write to authorized users
• Firebase App Check (Play Integrity) – protection against unauthorized API access
• HTTPS encryption – all communication between the Application and servers is encrypted
• File size limits – profile photos and logos are size-restricted
• Sensitive data separation – server-side collections (purchase records, access codes) are not accessible from the client application

11. Your Rights

In accordance with the GDPR, you have the following rights:

1. Right of access – you may request a copy of your personal data
2. Right to rectification – you may update your personal data in profile settings
3. Right to erasure – you can delete your account at any time directly in the Application (Profile → Delete Account). Upon account deletion, the following will be permanently removed: your profile, tips, bets, statistics, tournament participation, and profile photo. Chat messages will be anonymized. Tournaments you created will remain available for other participants. You may also request account deletion by email.
4. Right to restriction of processing – you may request restriction of your data processing
5. Right to data portability – you may request an export of your data in a machine-readable format
6. Right to object – you may object to the processing of your data
7. Right to withdraw consent – you may withdraw consent for push notifications at any time in device settings

12. Children's Privacy

The Application is not intended for persons under 16 years of age. We do not knowingly collect personal data from children under 16. If we discover that we have collected data from a child under 16, we will promptly delete such data.

13. International Data Transfers

Your data is stored on Google Firebase servers in the USA (region us-central1). Google ensures an adequate level of personal data protection in accordance with applicable legal regulations, including Standard Contractual Clauses (SCC) for data transfers outside the European Economic Area.

14. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the Application or via push notification. We recommend regularly reviewing this page.

15. Contact

16. Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority: