Privacy Policy

1.1 Information you provide directly

1.2 Information collected automatically

1.3 Information from third-party sign-in providers

When you use Sign in with Google or Sign in with Apple, the provider returns a signed identity token that we verify on our backend. The token contains your provider-issued subject identifier and your email address (Apple users may choose to share a private relay email, which we accept).

We do not receive your Google or Apple account password and we do not gain ongoing access to your provider account.

1.4 Information we do NOT collect

We do not collect:

• GPS coordinates or precise device location
• Your contacts, calendar, photos, microphone, or camera content
• Health, fitness, or biometric data
• Information about your race, ethnicity, religion, political beliefs, union membership, sexual orientation, or criminal record
• Browsing history outside the IFSCORES app and Landing Page
• The contents of your in-app searches (we removed search query logging on 2026-05-27 as a data-minimization measure)
• Your date of birth (the Service has no in-app age gate; the App Store and Google Play handle age rating at the store level)

We process your information for the following purposes and on the following legal bases under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK):

You may withdraw any consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3.1 In-app advertising (mobile)

We display advertisements to free-tier users only through Google AdSense for Mobile. Pro subscribers see no advertising.

AdSense may collect a resettable advertising identifier (Google Advertising ID on Android, IDFA on iOS), interact with your device's "Limit Ad Tracking" / "App Tracking Transparency" settings, and serve personalized or non-personalized ads accordingly.

To opt out of personalized advertising:

• iOS: Settings → Privacy & Security → Tracking → disable "Allow Apps to Request to Track", or decline the in-app tracking permission prompt
• Android: Settings → Privacy → Ads → "Delete advertising ID"
• Google account-wide: https://adssettings.google.com

3.2 Landing Page cookies and tracking pixels

The Landing Page at https://ifscores.com uses cookies for analytics and marketing purposes. See our separate Cookie Policy at https://ifscores.com/cookies for the full list of cookies and their purposes.

Notably, the Landing Page may set:

A cookie consent banner on the Landing Page allows you to accept or reject non-essential cookies. The mobile app itself does not use cookies; auth tokens are stored in your device's secure keystore (Apple Keychain on iOS, Android Keystore on Android).

We do not sell or rent your personal information. We share it only in the ways described below.

4.1 Sub-processors (service providers that process data on our behalf)

4.2 Third-party identity providers

If you sign in with Google or Apple, those providers operate independently as data controllers for your interaction with their sign-in service. Their policies apply alongside ours:

• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/

4.3 Sports data provider

The Service uses Live-Score-API.com as the source of all sports, league, and match data. We do not share any personal data with Live-Score-API. Match and team data flows one way: from the provider to us.

4.4 Marketplace and public surfaces

If you choose to publish a preset to the in-app community marketplace, the following information becomes visible to other IFSCORES users:

• Your username
• The preset name and description
• The preset's condition rules

If you do not want this content to be public, do not publish presets to the marketplace. You may withdraw a marketplace submission at any time from the in-app Settings.

4.5 Legal disclosures

We may disclose information when required by law, court order, or governmental request, or when necessary to protect our rights, the rights of users, or the safety of the public.

Some of our sub-processors are located in the United States. When personal data is transferred outside the European Economic Area or Turkey, we rely on safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–U.S. Data Privacy Framework.

You may request a copy of these safeguards by contacting us (see Section 12).

We keep personal data only as long as needed for the purposes described in this Policy. Specifically:

After deletion, residual copies may persist in backup snapshots for up to 30 days before they are overwritten.

Depending on your jurisdiction, you have some or all of the following rights:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Restrict or object to specific processing
• Port your data to another service in a structured, machine-readable format
• Withdraw consent at any time
• Lodge a complaint with your local supervisory authority (in Turkey, the KVKK Kurulu; in the EU, your national Data Protection Authority)

7.1 How to delete your account

You may delete your account at any time from within the mobile app: Settings → Account → Delete Account. You may also delete from the web at https://ifscores.com/delete-account.

Deletion triggers a 30-day soft-delete grace period (see Section 6). During this window your data is hidden and inaccessible but recoverable if you sign in again. After 30 days, your data is permanently erased from our active database. Backup snapshots containing your data are overwritten within an additional 30 days.

7.2 How to exercise other rights

Contact us at the address in Section 12. We will respond within 30 days (or sooner where required by law).

7.3 Users in Türkiye (KVKK)

If you are located in Türkiye, you have all of the rights enumerated in Article 11 of the Turkish Personal Data Protection Law (Kanun No. 6698). You may exercise these rights by contacting our data controller representative at the address in Section 12.

7.4 Users in the European Economic Area (GDPR)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the rights enumerated in Articles 15 through 22 of the GDPR. You may also lodge a complaint with your national supervisory authority.

7.5 Users in California (CCPA / CPRA)

If you are a California resident, you have the rights enumerated under the California Consumer Privacy Act and the California Privacy Rights Act. We do not sell or share personal information in the sense defined by the CCPA. To exercise CCPA rights, contact us at the address in Section 12.

The Service is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. The mobile app store age rating (set by Apple and Google) reflects the recommended minimum age.

If you believe a child under 13 has provided us with personal data, please contact us at privacy@ifscores.com and we will delete the account promptly.

We implement industry-standard administrative, technical, and physical safeguards including:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for database backups
• bcrypt password hashing
• Optional two-factor authentication for accounts
• Atomic claim and rate-limit primitives in the database to prevent race conditions and abuse
• A 24-hour Redis dedup layer plus a persistent per-favorite database claim to prevent duplicate notifications
• Separate moderation queue for user-submitted content (presets, usernames) before public exposure
• Regular dependency security audits

No method of transmission or storage is 100% secure. If we become aware of a personal data breach affecting your account, we will notify you and the relevant supervisory authority as required by applicable law.

The Service includes an AI Preset Draft feature that converts a natural-language description (typed by you) into a structured preset rule. The text you submit is sent to Anthropic's Claude API for processing.

• The AI feature is optional. You can use the rest of the Service without ever invoking it.
• Anthropic processes your input under its API terms. As of the effective date of this Policy, Anthropic states that it does not use API inputs to train its public models by default. See Anthropic's privacy policy at https://www.anthropic.com/legal/privacy.
• We do not send your account ID, email, subscription state, or other personal identifiers to Anthropic — only the natural-language string you typed.
• The AI generates a structured preset suggestion. You can accept, edit, or reject the suggestion. No decision with legal or similarly significant effects on you is made by the AI; you remain in full control of whether to save the resulting preset.

We may update this Policy from time to time. When we do, we will:

• Update the version date at the top of this document
• Notify active users via an in-app screen on next launch (the "Legal Acceptance" modal) that prompts for fresh acceptance before continuing to use the Service
• Keep the version-acceptance log per user so we have a record of which policy version each user agreed to and when

Material changes (such as new categories of data, new sub-processors, or new sharing purposes) will be highlighted in the in-app notification.

Data Controller: IFSCORES

Contact email: privacy@ifscores.com

Support: support@ifscores.com

For users in Türkiye, this address also serves as the contact for KVKK requests.

For users in the EEA, please use the same address for GDPR requests.

We will respond to all rights requests within 30 days, except in cases where applicable law sets a different deadline.