Privacy policy

1. Data controller

The PubLeague app and companion website (including Help, Terms, Privacy and Invite pages) are operated by the project owner (“we”). For privacy questions use the email in the site footer or Help in the app.

2. Data we collect

• Account: Sign-in via Apple or Google (Supabase Auth)—typically account identifier, email if shared by the provider, name/display name.
• In-app profile: display name, avatar, contact or other optional info you enter.
• App content: predictions, league memberships, invites and related activity needed to run the game.
• Push notifications: device token for notifications you enable in settings.
• Usage analytics: anonymous app interaction events (screens visited, features used, predictions submitted) sent to Vexo Analytics to help us improve the app. No name, email or precise location is included. You can opt out at any time in Settings → Account.
• Technical data: basic logs (e.g. IP on the website, device type) for security and diagnostics.

3. Apple & Google sign-in

Apple Sign In and Google Sign In are used only for authentication. Apple and Google process data under their policies; we receive only what is needed to create your account in our system (via Supabase Auth). You can revoke access in Apple ID or Google account settings.

4. Purpose and legal basis

We use data to provide the service (contract / steps prior to contract), comply with legal obligations and, where allowed, improve the app. We only send marketing with your consent or as permitted by law.

5. Sharing and hosting

Data is stored and processed with chosen cloud providers (e.g. Supabase, push providers) acting as processors under our instructions. We do not sell your personal data. Disclosure to third parties occurs only when required by law or to protect our rights.

We use Vexo Analytics (vexo.co) to collect anonymous usage data. Vexo receives app interaction events and a pseudonymous device identifier. Vexo does not receive your name, email or precise location. You can disable this in Settings → Account.

6. Retention

We keep data while your account is active or as reasonably needed to provide the service, meet legal duties or resolve disputes. After account deletion we may retain anonymised data for statistics.

7. Your rights

Depending on applicable law (e.g. GDPR), you may request access, rectification, erasure, restriction, portability or objection. Contact support or use account settings where available.

8. Children

The service is not aimed at people under 16 (or a higher age limit under your country’s laws). We do not knowingly collect children’s data.

9. In-app purchases & payment processing

Creating a game requires a one-time in-app purchase. Payments are processed entirely by Apple (App Store) or Google (Google Play) — we never receive or store your payment card details.

We use RevenueCat as a purchase management middleware. RevenueCat receives anonymous purchase tokens from Apple or Google to confirm entitlements. RevenueCat processes this data under its own privacy policy. No financial data is stored on our servers.

Purchase history (which account bought which game and when) is retained to fulfil the service and resolve disputes, and is subject to the general retention policy in section 6.