Privacy policy

Who we are

UltraScore is a live football scores platform made up of the fan app and website, the field operator app, the organizations’ panel and a data API.

Controller of personal data: [to be completed: legal name, CNPJ and address of the controller].

Data protection officer (DPO), in charge of the processing of personal data: [to be completed: name and email address of the data protection officer].

What data we collect

We collect only what is necessary for each feature. Fans:

• Without an account: a random identifier created automatically in the app (anonymous account), your favorites and the alerts you choose. On the website, favorites and the theme are stored only in your browser.
• With an account: your email address and, if you sign in with Google or Apple, the identifier and email address provided by that service.
• Notifications: if you turn them on, the device’s notification token, the platform (Android or iOS), the app version and the language.

Field operators and panel users, registered by invitation from an organization:

• Name, email address, role and organization.
• Authorship of events and changes (who made them, when and why), kept for audit purposes.
• In the operator app: the device’s heartbeat during the match (battery level and events waiting to be sent).

Technical data from all users:

• Error logs (crash reports from the app, the website and the panel), with the device model, operating system, version and the screen where the error occurred, without name, email address or IP address.
• Only with your consent, in the fan app and website: anonymous usage statistics (screens opened, favorites, notification activation and shares), linked to a random identifier of the device or browser. We do not record your screen or your session.

We do not collect location, contacts, photos from the device or payment data. The operator app’s camera is used only to scan the match QR code, without storing any images.

Data on athletes, coaching staff and referees

Organizations (leagues and federations) register athletes, coaches and referees and are responsible for the origin of this data and for the right to use the images and trademarks they upload.

For athletes, we display only name, photo, age, nationality, position and number. The full date of birth is not displayed.

In youth competitions (under 18), the photo is shown only with the recorded consent of the parent or legal guardian; without it, we show a generic avatar.

What we use data for

• Providing the service: showing results, saving favorites and sending the notifications you chose (performance of a contract, Art. 7, V of the LGPD).
• Enabling operators and organizations to record and correct matches, with access control and an audit trail (performance of a contract and legitimate interest, Art. 7, V and IX of the LGPD).
• Ensuring security and fixing errors: error logs, usage limits and abuse prevention (legitimate interest, Art. 7, IX of the LGPD).
• Improving the product with anonymous usage statistics, only with your consent (Art. 7, I of the LGPD), which may be withdrawn at any time.
• Complying with legal obligations and responding to authorities (Art. 7, II of the LGPD).

We do not sell personal data and we do not use your data for personalized advertising.

Who we share data with

We use providers that process data on our behalf, under contract:

• Supabase: database, authentication and live channels.
• Cloudflare: content and image delivery.
• Vercel and Railway: hosting of the website, the panel and the API.
• Expo, Apple and Google: sending notifications and, if you choose, signing in with Google or Apple.
• Sentry: error logs.
• PostHog: usage statistics, only with your consent.

Some of these providers store data outside Brazil. International transfers follow Art. 33 of the LGPD, with contractual data protection clauses.

Data on matches, athletes and competitions is public and is also delivered to partners through the data API; this API does not contain any fan data.

How long we keep data

• Account, favorites and alerts: for as long as the account exists. When the account is deleted, personal data is erased within 30 days.
• Notification tokens: until the account is deleted or until the device stops accepting them.
• Organizations’ audit logs: kept after the account is deleted, with the identifier only, without name or email address.
• Error logs: up to 90 days.
• Usage statistics: up to 12 months, without any data that identifies you.

Your rights

Under the LGPD (Art. 18), you may request confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of unnecessary data, portability, information about whom we share it with, withdrawal of consent and review of automated decisions.

To exercise these rights, contact the data protection officer: [to be completed: name and email address of the data protection officer]. We respond within 15 days.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

How to delete your account

In the fan app, go to Profile > Privacy > Delete account and data; on the website, go to the Account page. Deletion erases the account, favorites, alerts and registered devices, and the app keeps working without an account.

Operators and panel users request deletion from the organization that invited them or from the data protection officer.

Usage statistics and local storage

The app and the website ask whether you accept usage statistics before sending them. You can change your choice at any time: in the app, under Profile > Privacy; on the website, on this page.

The website stores in your browser (local storage) the theme, your favorites, your sign-in session and your choice about statistics. We do not use advertising cookies.

Security

All traffic uses an encrypted connection (HTTPS). Access to data is controlled by organization and by role, with two-step verification for administrators, and no secret keys are stored in the apps or on the website.

Children and teenagers

UltraScore shows sports results to the general public and does not ask for any data beyond what is described above. The fan account is optional and must not be created by children under 13.

Changes to this policy

When this policy changes, we will update the date below the title and let you know in the app and on the website if the change is significant.