Privacy Policy

Last updated: October 18, 2026

This document is available in English only. The English version is the one that applies.

This policy explains what Fantascores (fantascores.com and the iPhone app) collects, why, and what you can do about it. Fantascores is run by Simone Dinato, an individual based in the United States, who decides how your data is used (the “controller”, in the GDPR’s words). It is a football prediction game — we sell nothing, advertise nothing, and share nothing with data brokers. It is written to be read, not to be survived.

1. What We Collect

• Account — your email address and username. If you use a password, it is held by our authentication provider as a salted hash; we never see or store the password itself. The iPhone app signs you in with a six-digit code instead.
• Profile — anything you choose to add, such as a bio, plus your friend connections.
• Game data — your predictions, banker picks, skill tokens and objective progress, the leagues you join, your points and standings, and your archived finishing positions.
• Chat — the messages, pick cards and reactions you post in a game’s chat rooms, the players you block, and any message you report.
• Preferences — theme, language, and your notification and privacy toggles.
• Technical data — our hosting and database providers log request metadata (IP address, user agent, timestamps) for security and operations. We also run privacy-friendly, aggregate page analytics that do not use cookies and do not build a profile of you.
• Notifications (iPhone app) — if you allow notifications, the push token Apple gives your device, the device’s timezone, and the app’s language, so a notification reaches you in it. We keep them only while you are signed in on that device with notifications allowed.
• Your notifications on Social (iPhone app) — the bell on Social keeps the notifications we write for you (friend requests, people joining your groups, which games a friend has picked, and news from Fantascores) for 30 days, and whether you have read them.
• When you last opened the app — the time only, so we don’t tell you about a friend’s picks you have already seen.
• Usage data (website and iPhone app) — to see what is used and what is not, we record a short list of events against your account: that you opened the app or the site, which screens you viewed (as a page pattern such as “/leagues”, never a full address or a search), that you saved, cleared or skipped picks (counts only, never your scorelines), that you joined or created a league, that you opened a notification, how long the app took to show its first data when you opened it, and the app version, platform and a random session identifier. Events are chosen from a fixed list; we never record what you type, your messages, your contacts or your location. You can switch this off at any time — see §5.
• Invite funnel counters — before you have an account we only count, per day, how many invite pages were opened and how many sign-in codes were requested and used. These counters hold no identifier of any kind.
• Errors and diagnostics — when something fails on our servers we log the page or route involved, a one-line error message with any email address removed, and the time. If you were signed in, your account identifier is attached so we can fix the fault.
• Feedback you send — the text you write in Settings → Send feedback (or in the app), its type, the screen you sent it from, and your app version and platform.
• On the iPhone app — your sign-in is kept in the iPhone’s Keychain, your Look and welcome settings on the phone itself, and a copy of the last Home, Predict and league screens the app showed you, so it opens without waiting; that copy is deleted when you sign out. The app contains no advertising, no tracking and no third-party analytics software; the only usage data it sends is the first-party events described above, to our own servers. Apple handles downloads and updates under its own privacy policy.

We do not collect payment details, location data, or contacts, and we do not use advertising or cross-site tracking of any kind.

2. Why We Use It

• To run the game — record your predictions, score them, and rank you in leagues. Legal basis: performance of our contract with you.
• To keep the service secure and working, and to diagnose faults. Legal basis: our legitimate interest in a functioning, non-abused service.
• To send you matchday and reminder emails, if you have those switched on. Legal basis: consent, withdrawable at any time — see §5.
• To send the app notifications you have switched on: games closing soon, your results, friends and groups, games your friends have picked that you haven’t, and news from Fantascores. Legal basis: consent, withdrawable at any time in the app’s Settings or in iOS Settings — see §5.
• To understand which parts of the game are used, to find and fix faults, and to decide what to build next — using the usage data, error logs and feedback described in §1. Legal basis: our legitimate interest in improving a service we run for free, balanced by a switch that turns usage data off (§5). Feedback is sent by you on purpose, so it rests on your consent.
• To send account and security emails (confirmation, password reset). These are necessary to operate your account and cannot be switched off while the account exists.

3. What Other Users Can See

Fantascores is a social game, so some of your data is deliberately public to other signed-in users:

• Your username, and your profile bio if you set one.
• Your predictions — but only after the deadline has passed. Before kickoff your picks are hidden from everyone, which is the point of the game. Once a match locks, they are revealed on the league board alongside everyone else’s, including a marker if you amended a pick using a skill.
• Which games you have picked, to your friends — never the score before kick-off. When you pick games an accepted friend has not, they can see which games, in their bell on Social and, if they have switched it on, in one notification a day. Your scores stay hidden until each game kicks off, exactly as on the league board. You can turn this off in the app under Settings → Show friends what I pick.
• Your points, accuracy and league position, and your archived finishing positions (your palmarès).
• Your chat messages, pick cards and reactions, to everyone in that room: the players of that competition in a public room, or your group’s members in a group room. Players you block, and players who block you, do not see each other’s messages.

A private group’s table — usernames, points and accuracy — is also visible to anyone who has its invite link, so the people you invite can see who is playing before they join.

Your email address is never shown to other users.

4. Who We Share It With

We do not sell or rent your data. It is handled on our behalf by a small number of service providers, each bound to process it only on our instructions:

• Supabase — database and authentication (where your account and game data live).
• Vercel — application hosting and aggregate analytics.
• Resend — delivery of the emails we send you.
• Apple — delivery of app notifications through its Push Notification service. The text of each notification passes through Apple.
• Telegram — we receive a weekly summary of aggregate numbers (how many people joined, picked and came back, how many errors occurred) and a notice that feedback has arrived. These messages contain no names, email addresses, usernames or feedback text.

Usage events, error logs and feedback are stored in our own database at Supabase. They are not sent to any analytics or advertising company.

Fantascores is run from the United States, and your data is stored and processed there by the providers above. Our football data source, API-Football (run by API-Sports), supplies fixtures, scores and other match information to us and receives no personal data about you. We will also disclose data where we are legally obliged to, or where it is necessary to protect the service or someone’s safety.

5. Emails, Notifications, and How to Stop Them

Matchday and reminder emails are optional. You can turn them off in Settings, or use the one-click unsubscribe link that every one of those emails carries — including the unsubscribe button your mail app shows at the top of the message. Either route takes effect immediately, without you needing to sign in. Account and security emails are not affected.

App notifications are optional too, and iOS asks before any are sent. Each kind has its own switch in the app under Settings → Notifications, and you can turn them all off in iOS Settings. News from Fantascores is off until you turn it on. None are sent between 23:00 and 08:00 on your device’s clock.

Usage data is on by default and can be switched off in Settings → Share usage data, on the website and in the app. Switching it off stops us recording events for your account and erases the events we already hold for it. Errors on our servers and the anonymous invite counters are not tied to this switch, because they do not describe what you do.

6. Your Rights

Under the GDPR you can access, correct, export, delete, restrict or object to our use of your data, and withdraw consent at any time. Two of these are built into the app and need no request:

• Export your data — Settings → “Export my data” downloads everything we hold about you as a single JSON file, immediately — including your usage events and any feedback you sent.
• Delete your account — Settings → Danger Zone on the website, or Settings → Delete account in the iPhone app. See §7 for exactly what this does.

For anything else, contact us at the address in §13. You also have the right to complain to the data protection authority in your country — in Italy, the Garante per la protezione dei dati personali.

7. What Deletion Actually Does

We would rather describe this precisely than promise something we do not do. When you delete your account:

• Deleted outright — your login, your predictions and their history, your points and standings, your skills and objectives, your preferences, your activity, your league memberships and your friend connections, your chat messages and reactions, the players you blocked, the reports you made, and your devices’ notification tokens, your usage events and the feedback you sent. Error-log lines that mention your account lose that link.
• Kept, without your identity — your archived finishing positions in completed seasons (a league’s final table would otherwise become false for everyone else in it). If you have any, your profile is replaced by an anonymous placeholder such as “Deleted user” with your email and all other personal fields erased. If you have none, your profile is deleted outright.
• Already anonymous — how often each scoreline was predicted for a given match is stored as a frozen count with no link to any user, and is unaffected by your deletion.

Deletion is immediate and cannot be undone. Export your data first if you want to keep it. Backups taken before deletion age out on our providers’ ordinary retention cycles.

8. How Long We Keep It

We keep your account data for as long as your account exists, because the game is cumulative — your record only means anything if it is kept. Once you delete your account, §7 applies. Operational logs held by our providers are retained on their standard short cycles.

Chat messages are deleted 30 minutes after the game they belong to. When a message is reported, a copy of it is kept with the report for up to 90 days so it can be reviewed; the email we receive about a report carries neither the message nor anyone’s name. Blocks last until you unblock or delete your account; a chat ban lasts until it is lifted.

A device’s notification token and timezone are deleted when you sign out on it, when you delete your account, or when Apple tells us the app is no longer installed. The record of notifications sent to you is kept for 30 days, and so are the notifications in your bell on Social.

Usage events are deleted 13 months after they were recorded, error-log lines after 60 days. Feedback is kept until you delete your account. The anonymous invite counters hold no personal data and are kept.

9. Cookies

We use a small number of cookies, all of them necessary for the site to work. We set no advertising or cross-site tracking cookies, which is why you are not being asked to dismiss a consent banner:

• Session cookies — keep you signed in. Set by our authentication provider.
• fantascore-theme — remembers which colour theme you chose.
• locale — remembers your language.

While you are signed in, the website also keeps a random session identifier in your browser’s session storage (not a cookie). It groups the pages you view in one visit, is not shared with anyone, and disappears when you close the tab.

10. Security

Data is encrypted in transit, passwords are stored only as hashes, and access to your rows is enforced in the database itself rather than only in the application. No system is perfectly secure, and we will not claim otherwise — but if a breach ever affects your data, we will notify you and the supervisory authority as the GDPR requires.

11. Children

Fantascores is not intended for children under 14, the age of digital consent in Italy. We do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will remove it.

12. Changes to This Policy

We may update this policy. Changes are published on this page with a new “Last updated” date, and anything significant will be flagged in the app.

13. Contact Us

For any question about this policy, or to exercise a right that is not already a button in Settings:

Fantascores is run by Simone Dinato, United States.