Privacy

Who is responsible?

KopEleven is a personal project published by Serge Castor in France under the name KopEleven. Privacy contact: contact.kopeleven@gmail.com.

This policy covers the mobile app. The website, app stores and external services opened from the app may have their own processing and policies.

Data on your phone and network requests

Your favourite club, followed clubs and players, saved comparisons, recently viewed profiles, language, theme and navigation preferences are stored locally. KopEleven does not provide an account or sync these settings between devices. Your operating system may include some app data in backups according to your settings.

Sports information requires Internet access. Requests to KopEleven specify the competition, match or profile to display. Contacted services receive connection information, including IP addresses and technical request details; requested paths may reveal the sporting content you view. Hosting providers may retain operational and security logs.

Optional audience measurement is described below. KopEleven does not send a custom notification-open history. Third-party content may receive data as described in this policy.

Optional match alerts

You can use other app features without alerts. Once you enable them and grant the phone permission, the alert service receives an installation notification token, platform, technical registration identifier, selected clubs and matches, event types, language and registration update time. It also keeps technical delivery records: event, date, attempts and provider delivery result.

iOS uses Apple Push Notification service; Android uses Google Firebase Cloud Messaging, which also uses a Firebase installation identifier and app technical information. Alert text may appear on your lock screen depending on your settings. KopEleven does not request your contacts, GPS location, personal photo library or messages.

Use More → Match alerts to change choices or disable all alerts. Successful deactivation deletes the registration and associated delivery records from KopEleven’s active database. On Android it also requests deletion of the messaging token and Firebase installation identifier. If offline, reopen the app online until deactivation is confirmed. You can also block notifications in system settings; this or uninstalling does not immediately guarantee deletion of the remote registration.

Providers and external content

Render hosts alerts; the service used is in Frankfurt, Germany. Apple and Google/Firebase deliver notifications and may process data outside the European Economic Area. Vercel hosts kopeleven.com and the sports APIs used by the mobile app, under project tribune-ucl-web. The configured function region is Washington, USA (iad1), as checked on 11 October 2026. Supabase stores shared API-Football sports responses. This cache contains neither notification tokens nor mobile users’ preferences. Its storage region has not been confirmed, so exclusive EEA processing should not be assumed.

Remote image hosts receive requests when player photos or other remote visuals load. The YouTube player and thumbnails remain blocked until you choose “Load YouTube video”. “Not now” keeps them blocked. Consent lasts for that video until you close the match; “Stop and withdraw consent” removes the player. Once allowed, Google receives your IP and technical information, and cookies may be used for playback. The player may show non-personalized ads served by YouTube. KopEleven does not select or sell these ads. The youtube-nocookie mode does not mean no processing. Withdrawal does not erase information already received by Google. Highlight searches still pass through KopEleven’s server. External video cards do not load remote thumbnails. Opening publisher links, including ESPN, takes you to their services. Your chosen app handles shared links.

KopEleven uses YouTube API Services to find some public highlights. Playback is subject to YouTube’s Terms of Service and Google’s Privacy Policy. KopEleven does not request access to your YouTube account.

See Apple privacy, Firebase privacy and Render privacy. Some providers and subprocessors operate outside the EEA, including in the USA. The processing agreements for Vercel Pro, Render and Supabase describe safeguards, including EU Standard Contractual Clauses where applicable. For Google, see the Firebase processing terms, measurement processing terms and Google’s transfer mechanisms. External services you open or load also apply their own policies. Contact the publisher for details or a copy of relevant safeguards, subject to confidential information. A primary alert server in Frankfurt does not place every processing operation in Europe.

Sports data and people featured

Profiles contain public sporting and biographical information and player photographs from data services and external sources, for football information purposes. Player profile data is separate from the preferences and identifiers of app users.

Public sports information is presented on the basis of legitimate interests in reporting on football and sporting careers. This concerns information related to sporting activity rather than unrelated private life. Correction, objection and removal requests are assessed in context and under applicable rights. Public availability does not remove the person’s rights or the photographer’s rights.

A player or their representative may request correction or exercise applicable rights at contact.kopeleven@gmail.com, identifying the relevant profile. Intellectual property and reuse are covered in the content notices.

Google Analytics, only with your permission

A prompt lets you accept or decline Google Analytics for Firebase audience measurement. Both choices are equally accessible. Measurement stays disabled without permission. Declining does not affect scores, app features or match alerts.

After acceptance, Google receives a pseudonymous identifier for this app installation, technical app and device information, session and usage events, and an approximate location derived from your connection. The app measures viewed sections and use of sharing without sending the name of the club, player or match displayed. This helps us understand usage and improve KopEleven.

KopEleven does not supply Analytics with your name, email, search text, favourites or an account identifier. Advertising identifier collection is disabled and advertising consents remain denied. Vendor identifier collection is also disabled on iOS. Technical measurement identifiers do not make this data anonymous.

This optional processing relies on your consent, separate from notification permission and the choice to load a YouTube video. Change it in More → Privacy → Change my Analytics choice. Your decision and its date stay on the phone until changed or erased. Withdrawal stops future collection and resets local Analytics data; it does not automatically delete statistics already sent to Google. Contact the publisher for a data rights request.

The app uses a separate Analytics property from the website. Google may process data outside the European Economic Area. See the provider and transfer information in this policy, Google’s privacy policy and its Analytics data description.

When you contact us

If you contact support or report a rights issue, we receive your email address, your name if supplied, your message and any attachments. The contact mailbox uses Google’s Gmail. This information helps us answer and verify requests and apply any correction or deletion; it does not subscribe you to a newsletter.

Processing relies on legitimate interests in handling support and reports, or a legal obligation for data rights requests. Only necessary evidence is requested. Support correspondence is deleted no later than 12 months after the request is closed, through regular manual mailbox reviews. If a dispute or legal obligation applies, only necessary records are kept separately until the procedure or applicable period ends. This process does not rely on automatic Gmail deletion.

Purposes and legal bases

Connection data delivers requested content and protects services. Alert identifiers and preferences deliver chosen alerts; local settings retain your choices.

Legal bases: legitimate interests in providing requested information and maintaining the service for strictly necessary connection data; consent for optional alerts; legitimate interests in preventing abuse and securing services for security logs. Local preferences support features you explicitly choose. Optional YouTube player loading uses your prior, withdrawable choice. Analytics audience measurement relies on the separate consent described above. System notification permission is not consent to every third-party operation.

KopEleven does not sell your data and this version does not offer targeted advertising. The app makes no automated decisions with legal or similarly significant effects on you.

Retention

• Google Analytics: settings checked on 11 October 2026: event data retained for 2 months; user data for 14 months, reset with each new activity. This retention setting does not cover most standard aggregated reports, which may remain longer. The local consent choice persists until changed or erased. Withdrawal is not a remote deletion request. Analytics retention.
• Local settings: until removal, app data clearing or uninstall, subject to operating-system backups and list size limits.
• KopEleven alert registration: until successful deactivation, definitive rejection of the token by its provider, or the next service cleanup after 90 days without a registration update.
• Delivery records: up to 7 days before the next cleanup, or deletion with the registration. Pending alerts expire after 3 minutes.
• Score snapshots: 2 days before the next cleanup; these describe matches, not user registrations.
• Firebase installation identifier: Android deactivation requests deletion of the messaging token and then the Firebase installation identifier, with retry on failure. Google states associated data is removed from live and backup systems within 180 days of the dedicated request. Re-enabling alerts creates a new registration. Firebase documentation.
• Hosting logs and backups: Documented retention is 7 days for Render Hobby service logs and 1 day for viewable Vercel Pro runtime logs, without the Observability Plus add-on. Daily Render disk snapshots are retained for at least 7 days. These are not guaranteed maximum periods for every internal provider copy. Other technical copies and provider logs follow provider service terms for operations, security and legal duties; we do not set their internal retention ourselves. Backups are not used for routine processing. Deletion from the active database does not immediately erase all backup copies. Render · Snapshots · Vercel.
• Support and reports: no later than 12 months after closure, through regular manual review. Only necessary records are kept separately for the applicable period if a dispute or legal duty applies.
• Supabase sports cache: sports responses, without alert registrations, may be reused for one to seven days depending on the resource, with more frequent refreshes during matches. This usage period does not guarantee simultaneous deletion from provider backups.

Your choices and rights

More → Privacy → Erase my data withdraws Analytics consent and resets its local data, disables alerts, requests Android technical deletion, then clears follows, comparisons, recent profiles and local settings after confirmation. If remote deletion fails, information needed for retry is retained before local erasure. This does not clear phone backups or cookies and data belonging to external services.

Remove follows or comparisons in More → My follows; clear recent profiles in the relevant tab. For remote alerts, disable all alerts and wait for confirmation online, preferably before uninstalling.

Contact contact.kopeleven@gmail.com to exercise applicable rights of access, correction, deletion, restriction, objection and portability, or withdraw consent. Withdrawal does not affect prior lawful processing. French law also allows instructions about personal data after death.

Without an account, your email alone cannot identify a technical registration. We will seek a proportionate verification method with you. Never email private keys or registration secrets. You may complain to the CNIL or your competent European data protection authority.

Changes

This policy will be updated when the app or providers change. Changes requiring renewed consent will offer an appropriate choice.