Privacy Policy

This policy explains what personal data scorepredicts.com collects, why, who it is shared with, how long it is kept, and what rights you have over it. It applies to everyone who visits the site or holds an account.

1. Who we are

The data controller responsible for your personal data is:

We are a small operation and do not have a Data Protection Officer. Privacy questions go directly to the address above.

2. Summary

3. What we collect

Account data

When you register, we store:

• your email address;
• your username;
• a cryptographic hash of your password — we never store, and cannot recover, the password itself;
• whether your email address has been verified;
• your account role and the dates your account was created and last updated;
• your profile picture, if you upload one.

Session and security data

• Session tokens. We store hashed versions of your session refresh tokens, together with their expiry and whether they have been revoked. Email verification and password reset tokens are stored the same way — hashed, never in plain text.
• Security audit records. We keep an append-only log of security-relevant events on your account — for example a successful login, a failed login, a password change, or an account deletion. Each entry records the event type, the time, your IP address and your browser user-agent string. This log is how we detect account takeover attempts and abuse.
• Rate limiting. We temporarily hold your IP address in memory to limit how often sensitive actions such as login, registration and password reset can be attempted. These records expire automatically after a short window.

Approximate location

We determine the country your request comes from by looking your IP address up in a MaxMind GeoLite2 database held locally on our own server. This is used to present the site appropriately. The lookup happens in memory, the result is not stored against your account, and your IP address is not sent to MaxMind or any other third party in order to perform it.

Payment data

If you subscribe, your payment is processed by Paddle as merchant of record. Paddle collects your billing details and card information directly. We never receive, see or store your card number. We receive only the information needed to activate and manage your subscription, such as the plan purchased, its status and the billing email address.

What we deliberately do not collect

• No analytics, page-view tracking, session recording or heatmaps.
• No advertising or cross-site tracking identifiers.
• No behavioural profiling and no automated decision-making that produces legal or similarly significant effects.
• No special category data — we never ask for it and you should not send it to us.

4. Why we use it, and our legal basis

Where we rely on legitimate interests, we have considered the impact on you and concluded that these uses are necessary, limited in scope, and consistent with what you would reasonably expect from a service that holds an account for you. You may object at any time — see Your rights.

5. Cookies and local storage

We set a small number of cookies, all of which are strictly necessary to operate the site. We set no analytics or advertising cookies, which is why the site does not display a cookie consent banner.

We also use your browser's local storage to remember preferences such as favourited teams and pinned leagues. This data stays in your browser, is never transmitted to us, and is cleared when you clear your browser data.

Further detail is in our Cookie Policy.

6. Who we share it with

We do not sell personal data. We share it only with the service providers below, each of which processes it on our instructions under a data processing agreement.

On password screening. When you choose or change a password, we check whether it appears in known public breaches. We do this using a privacy-preserving method: only the first five characters of a hash of the password are sent, which matches thousands of possible passwords. Your password, and the full hash of it, never leave our server, and the service that answers the query cannot determine which password was being checked.

Match data shown on the site is obtained from third-party sports data providers, including API-Football. No personal data is sent to them.

We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

7. International transfers

Your account data is stored on servers located in Germany.

Some of our providers are established outside the European Economic Area, or have parent companies that are. In particular, Resend processes transactional email in the United States, and our hosting provider is headquartered in the United States even though your data is stored in Germany.

Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, incorporated into our data processing agreement with each provider. Resend is additionally certified under the EU–US Data Privacy Framework and its UK Extension, which provides a further recognised basis for that transfer.

You may request further detail about these safeguards at any time by emailing us.

8. How long we keep it

9. How we protect it

• Passwords are stored only as cryptographic hashes and are screened against known breach data when chosen.
• Session and reset tokens are stored hashed, never in plain text, and refresh tokens rotate.
• Authentication cookies are marked HttpOnly, Secure and SameSite=Strict, so they are inaccessible to JavaScript and are not sent on cross-site navigation.
• All state-changing requests are protected against cross-site request forgery.
• Login, registration and password reset are rate limited.
• The site is served over HTTPS with security headers applied.
• Deleting your account requires you to re-enter your password.

No system can be guaranteed completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

10. Your rights

Subject to the conditions in applicable data protection law, you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data — you can do this yourself at any time from your profile settings;
• restrict how we process your data in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• portability — receive the data you gave us in a structured, machine-readable format;
• withdraw consent at any time, where we rely on consent;
• complain to a supervisory authority.

To exercise any of these, email support@scorepredicts.com. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

11. Deleting your account

You can delete your account at any time from your profile settings. You will be asked to confirm your password. When you do:

• your account record is permanently deleted — email, username, password hash and profile details;
• all your session tokens are revoked immediately and all remaining verification and reset tokens are removed;
• your uploaded profile pictures are deleted from our CDN;
• the action cannot be undone.

One exception, stated plainly. Our security audit log is append-only, and records of past security events are not deleted with the account. Instead, the link between those records and your account identifier is severed: the user reference is set to null. The remaining entries record what happened and when, and we keep them for the retention period above so that we can investigate abuse that took place before an account was removed. We do not use them for any other purpose.

Records held by Paddle in connection with a purchase are retained by Paddle under its own policy and its legal obligations, and are not deleted by us.

12. Children

The service is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes to the service, to our providers, or to legal requirements. The date at the top of this page shows when it was last revised. Where a change materially affects how we handle your data, we will notify you by email or by a notice on the site before it takes effect.

14. Contact and complaints

For any privacy question or request, contact support@scorepredicts.com.

If you are not satisfied with our response, you may complain to a data protection supervisory authority. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection. If you are in the EEA or the UK, you may complain to the supervisory authority in the country where you live or work.

See also our Terms and Conditions and Cookie Policy.