Privacy Policy

Last updated: March 25, 2026

Your privacy is important to us. This Privacy Policy explains what personal data Penyela ("we", "us", "our") collects, how we use it, and your rights regarding your data. By using Penyela, you agree to the practices described in this policy.

1. Data We Collect

Account Information (provided by you):

Username and display name
Email address (via Google Sign-In or Apple Sign-In)
Profile avatar (uploaded or selected from presets)

Usage Data (generated by your activity):

Predictions, scores, and rankings
Followed teams, competitions, and favorite competitors
Pool (penyela) memberships and settings
Notification preferences

Device Data:

Push notification token (to send notifications to your device)
Local preferences stored on your device (theme, sort order)

Data We Do NOT Collect:

Financial or payment data (handled entirely by Apple App Store / Google Play Store)
Location data
Advertising identifiers (IDFA/GAID)
Browsing history or tracking data

2. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on:

Contract: To provide the Penyela service (account, predictions, rankings, notifications).
Legitimate Interest: To improve the application, prevent abuse, and ensure service security.
Consent: For push notifications (you can opt out at any time via device settings or in-app preferences).

3. How We Use Your Data

Provide the service: predictions, rankings, pools, leaderboards.
Send push notifications: goals, results, reminders, invitations (configurable per type).
Personalize your experience: favorite teams, followed competitions, stories.
Manage subscriptions and in-app purchases (via RevenueCat).
Improve the application and fix bugs.

We do not sell, share, or monetize your personal data. Your data is used solely to provide and improve Penyela.

4. Data Storage and Security

Data is stored securely on Supabase servers located in the European Union (Paris, France). All data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorized personnel only.

Local data (preferences, cached images) is stored on your device using secure storage mechanisms (expo-secure-store for sensitive data, AsyncStorage for preferences).

5. Data Retention

Account data is retained as long as your account is active.
When you delete your account, all associated data is permanently removed within 30 days.
Push notification tokens are cleared immediately upon logout or account deletion.
Anonymized, aggregated statistics (e.g., total predictions count) may be retained for service improvement.

6. Third-Party Services

We use the following third-party services, each with their own privacy policies:

Supabase (database, authentication, EU): Privacy Policy
Expo (push notifications, build service): Privacy Policy
RevenueCat (subscription management): Privacy Policy
Apple Sign-In / Google Sign-In (authentication): subject to Apple/Google privacy policies
API-Sports, FIBA, MotoGP (sports data): used server-side only, no user data shared

We are not responsible for the privacy practices of third-party services. We encourage you to review their policies.

7. International Data Transfers

Your data is stored in the EU (Paris). However, some third-party services (Expo, RevenueCat, Apple, Google) may process data in the United States or other countries. These transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.

8. Your Rights (GDPR / CCPA)

Under GDPR (EU/EEA users), you have the right to:

Access your personal data (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data / "right to be forgotten" (Art. 17)
Restrict processing (Art. 18)
Data portability (Art. 20)
Object to processing (Art. 21)
Lodge a complaint with your local Data Protection Authority

Under CCPA (California residents), you have the right to:

Know what personal information is collected and how it is used
Request deletion of your personal information
Opt out of the sale of personal information (we do not sell your data)
Non-discrimination for exercising your rights

You can exercise most rights directly in the app (Profile > Settings > Delete Account). For other requests, contact us at info@penyela.app.

9. Push Notifications

Push notification tokens are used exclusively to deliver notifications you have opted into. Tokens are encrypted and stored securely. You can disable notifications entirely from your device settings, or configure notification types individually within the app (Settings > Notifications).

When you log out or delete your account, your push token is immediately removed from our servers.

10. Children's Privacy

Penyela is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If we discover that we have collected data from a child under 13, we will delete it promptly.

11. Cookies and Tracking

Penyela does not use cookies, tracking pixels, advertising identifiers, or third-party analytics services. We do not track your activity across other apps or websites.

12. Automated Decision-Making

Penyela does not use automated decision-making or profiling that produces legal or significant effects on users. Scores and rankings are calculated based on transparent, publicly known rules.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the application or via push notification. Continued use of Penyela after changes constitutes acceptance of the updated policy.

14. Contact

For any questions about your privacy or to exercise your rights, contact us at:

Email: info@penyela.app