Preddify ("Preddify", "the app", "the Service", "we", "us", "our") is a football prediction game. This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the rights you have.
Plain-language summary
This summary is for convenience only and is not a substitute for the full policy below.
- Who runs Preddify: Hadarau Rares-Horatiu, an individual based in Romania.
- What we collect: your Google or Apple account name and email, or the email address you sign in with if you choose Continue with email (so you can sign in), the display name and favourite competitions you choose, the predictions you make and the leagues you join or create, your device’s time zone, a notification token if you turn on push notifications, and standard server logs.
- What we don’t do: no advertising, no advertising identifiers, no third-party analytics or tracking SDKs, and we never sell or rent your data.
- Why we can process it: mostly to run your account and the game (contract), plus security (legitimate interest) and — for push notifications — your consent.
- Your control: you can edit your display name and favourite competitions, turn notifications off at any time, and ask us to delete your account and personal data.
- Contact: hello@preddify.com.
1. Who we are
The Service is operated by Hadarau Rares-Horatiu, an individual resident in Romania, acting as the data controller for the personal data described in this policy.
Contact for any privacy matter, including to exercise your rights: hello@preddify.com.
We have not appointed a Data Protection Officer, as we are not required to. You can raise any data-protection question with us directly at the address above.
2. Scope
This policy applies to the Preddify mobile apps (iOS and Android) and the Preddify website (preddify.com). It applies to everyone who creates a Preddify account or uses the Service.
It does not cover third-party services that have their own relationship with you — most importantly Google Sign-In and Sign in with Apple, which are governed by Google’s and Apple’s own privacy policies.
3. The data we collect
We only collect what we need to run the game. We do not ask for your real name, postal address, phone number, date of birth, or any payment information, and the app contains no in-app purchases.
3.1 Information you give us
| Data | Why we have it |
|---|---|
| Google account name | Received from Google when you sign in. Used to create your account and shown to you until you set a display name. |
| Google account email address | Received from Google when you sign in. Used as the unique identifier for your account, to prevent duplicate accounts, and to contact you about the Service or your account if needed. We do not send marketing email. |
| Google account identifier | An opaque ID from Google used to link your sign-ins to the same Preddify account. |
| Apple account email address | Received from Apple when you sign in with Apple (iOS app only). This is either your real email address or, if you choose "Hide My Email", a private relay address Apple creates for Preddify. Used the same way as a Google account email. If it matches the email of an existing Preddify account, signing in with Apple opens that same account. |
| Apple account identifier | An opaque ID from Apple used to link your sign-ins to the same Preddify account. |
| Apple account name | Only if you choose to share it the first time you sign in with Apple. Used to create your account and shown to you until you set a display name. |
| Email address you sign in with | Only if you choose "Continue with email": the address you type. We email it a six-digit sign-in code, which we keep only as a one-way hash and which works once, for 10 minutes. The address is used the same way as a Google account email. If it matches the email of an existing Preddify account, the code opens that same account. |
| Display name | A nickname you choose. Shown to other players on leaderboards, in leagues, and on shared predictions. |
| Favourite competitions | The competitions you pick and the order you put them in. Used to order your Home screen. |
| Predictions and gameplay data | The scorelines you predict, the leagues you create or join, the team you pick in a "One Team" or "Sniper" league, league names and invite codes, your points and results, and your head-to-head "snipes". This is the core content of the game. |
| Content in free-text fields | Currently limited to your display name and the names you give leagues you create. |
3.2 Information collected automatically
| Data | Why we have it |
|---|---|
| Time zone | Your device’s IANA time zone (e.g. Europe/Bucharest), sent when you enable notifications. Used to send the daily "predictions lock today" reminder at a sensible local time. |
| Push notification token | If you enable push notifications, a device-specific token issued by Apple (APNs) or Google (FCM) via the Expo push service, so we can deliver notifications about your results, snipes, and lock reminders. Stored only while notifications are enabled and deleted when you turn them off. |
| Session tokens | To keep you signed in, we issue a short-lived access token and a longer-lived refresh token. The refresh token is stored on our servers only as a one-way hash and is rotated every time it is used. |
| Server logs | Our servers and our network provider (Cloudflare) automatically record technical request data — your IP address, the approximate time, the pages or API endpoints requested, response codes, and your browser/app user-agent string. Used to keep the Service secure and available (including rate-limiting and abuse prevention) and to diagnose faults. |
| Diagnostic data | If the app encounters an error, we may record technical details of that error (such as the screen, the error type, and app version) on our own servers to help us fix it. We do not attach this to advertising profiles and it is sent only to our own servers, never to a third-party crash-reporting service. |
3.3 What we do not collect or do
- No advertising, and no advertising or device tracking identifiers (no IDFA, no Android Advertising ID).
- No third-party analytics, attribution, or tracking SDKs (no Google Analytics, Firebase Analytics, Meta SDK, and so on).
- No location data beyond the coarse country/city that any website can infer from an IP address.
- No access to your contacts, photos, microphone, or camera.
- We never sell, rent, or trade your personal data, and we do not "share" it for cross-context behavioural advertising.
4. How we use your data and our legal bases
Under the EU General Data Protection Regulation (GDPR) and Romanian data protection law, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account; letting you sign in; running the prediction game, leagues, scoring, and leaderboards | Performance of a contract with you (Art. 6(1)(b)) |
| Keeping the Service secure — authentication, rate-limiting, preventing abuse, fraud, and cheating; keeping backups; diagnosing and fixing faults | Our legitimate interests in operating a safe, working service (Art. 6(1)(f)) |
| Sending you push notifications (results, snipes, lock reminders) | Your consent (Art. 6(1)(a) and, where applicable, the ePrivacy rules), given when you allow notifications; you can withdraw it at any time in the app or your device settings |
| Responding to your requests and support messages | Performance of a contract and our legitimate interests in helping users |
| Complying with legal obligations, and establishing, exercising, or defending legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you. League standings and points are just the arithmetic of the game.
5. Who we share data with
We keep the number of third parties to a minimum. We use the following processors and infrastructure providers, who act on our instructions:
| Provider | Role and data involved |
|---|---|
| Google LLC / Google Ireland Ltd | Sign-In (identity provider). When you choose "Continue with Google", Google authenticates you and returns your name, email, and account ID. Your use of Google Sign-In is also subject to Google’s own privacy policy. |
| Resend (Plus Five Five, Inc., USA) | Email delivery. When you choose "Continue with email", Resend sends the email with your sign-in code: it receives your email address and the code, for delivery only. Nothing else is sent through it. |
| Apple Inc. / Apple Distribution International Ltd | Sign in with Apple (identity provider, iOS app). When you choose "Continue with Apple", Apple authenticates you and returns an account ID, your email or a private relay address, and your name if you choose to share it. When you delete your account, we ask Apple to revoke Preddify’s access to your Apple Account. Your use of Sign in with Apple is also subject to Apple’s own privacy policy. |
| EU-based cloud hosting provider | Server and database hosting. All account and gameplay data, stored on servers in the European Union. |
| Cloudflare, Inc. | DNS, CDN, TLS, and DDoS protection sitting in front of our servers. Connection metadata and IP addresses of requests to our domains. |
| Expo (Expo, Inc., USA) | Push notification relay. Your push token and the content of the notification (e.g. "Gameweek 4 results are in"). Only if you enable push notifications. |
| Apple Push Notification service and Google Firebase Cloud Messaging | Operating-system push delivery to your device. Your push token and notification content, for delivery only. |
We also retrieve football fixture, result, and standings data from football-data.org. We send them no personal data — the flow is one-way, into the app.
Beyond processors, we will disclose personal data only: to comply with a valid legal request, court order, or applicable law; to enforce our Terms of Service or protect the rights, safety, or property of Preddify, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you and any new controller will be bound by a policy at least as protective as this one.
6. International transfers
Our servers and database are located in the European Union, with an EU-based cloud hosting provider. Your data is stored and processed in the EU.
Some processors are established outside the EU/EEA: Expo (USA) for push notification relay; Resend (USA) for sign-in code emails; Apple and Google for sign-in and OS-level push delivery; and Cloudflare, which operates a global edge network that traffic may transit outside the EEA.
Where personal data is transferred outside the EEA, it is protected by appropriate safeguards, primarily the European Commission’s Standard Contractual Clauses incorporated into those providers’ data-processing terms, and/or an applicable adequacy decision. You can ask us for more detail at hello@preddify.com.
7. How long we keep your data
| Data | Retention |
|---|---|
| Account data (identity, display name, favourite competitions) | Until you delete your account, or until we close a long-dormant account after prior notice to you. |
| Predictions, leagues, results, snipes | For the life of your account. After account deletion, removed or irreversibly anonymised (see Section 8). |
| Push tokens | Until you disable notifications or delete your account. |
| Refresh tokens (hashed) | Rotated on each use; expired or revoked tokens are purged automatically (revoked ones within about 7 days). |
| Sign-in codes (hashed) | Deleted when used; an unused code stops working after 10 minutes and is purged automatically within about two days. |
| Server request logs | A short period for security and debugging — normally no longer than 90 days — then deleted or aggregated. |
| Backups | Rotating backups retained for up to 30 days, after which deleted data ages out. |
| Support correspondence | Up to 24 months after the matter is resolved. |
8. Deleting your account and data
You can ask us to delete your Preddify account and associated personal data at any time:
- In the app: where a "Delete account" option is available in your profile settings, use that.
- On the web: preddify.com/delete-account explains how, with or without the app.
- By email: write to hello@preddify.com from the email address on your account, or otherwise give us enough information to verify your identity.
When you delete your account, we will delete or irreversibly anonymise your personal data within 30 days, except where we are legally required to keep certain information, or need to keep limited records to resolve a dispute or enforce our agreements.
Because leagues are shared between players, where your past predictions or results contribute to another player’s league history or a leaderboard, we may keep those records in a form that no longer identifies you (for example, shown as "Former player") so the league’s history stays intact.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data rectified;
- have your data erased ("right to be forgotten");
- restrict or object to our processing in certain circumstances, including processing based on our legitimate interests;
- data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible;
- withdraw consent at any time, where we rely on consent (for example, push notifications) — this does not affect processing carried out before withdrawal.
To exercise any of these, email hello@preddify.com. We will respond within one month, as required by the GDPR (extendable by two further months for complex requests, in which case we will tell you). We do not charge a fee unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro — or the data protection authority in your country of residence. We would appreciate the chance to address your concern first.
10. Children
The Service is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal data from anyone under 13.
If you are 13 to 15 years old — or younger than the age of digital consent in your country of residence (16 in Romania) — you may only use Preddify with the consent and involvement of a parent or legal guardian, who must agree to the Terms of Service on your behalf.
If you believe a child has provided us with personal data without the required consent, contact us at hello@preddify.com and we will delete it.
11. Security
We take reasonable technical and organisational measures to protect your data, including:
- encryption of all traffic in transit (HTTPS/TLS) for the app, website, and API;
- storing refresh tokens only as one-way hashes, with automatic rotation and theft detection;
- short-lived access tokens;
- restricting administrative access to the system, over a private network only;
- hosting with a reputable EU provider and keeping software up to date.
No system is perfectly secure. If we become aware of a personal data breach that is likely to present a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users as required by law.
12. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date and post the new version in the app and on the website. If the changes are material, we will give you prominent notice and, where the change affects how we use data or your consent, ask you to review and accept the updated policy before you continue using the Service.
13. Contact
Questions, requests, or complaints about this policy or your personal data: Hadarau Rares-Horatiu, hello@preddify.com, Romania.