Legal and privacy
Privacy and Data Policy
- Last updated:
- 21 June 2026
- Effective:
- 21 June 2026
- Version:
- 2026-06-21
1. Who we are
ScoreSocial is operated by Dean Reid, UK-based ScoreSocial service operator. ScoreSocial provides football prediction leagues, social leaderboards, pools, events, organiser tools, and related support services.
Privacy requests can be sent to admin@scoresocial.app. Product support can be sent to support@scoresocial.app.
ScoreSocial acts as controller for account, security, billing, diagnostics, support, and platform operations. Organisers make separate decisions about their league membership, branding, invitations, events, and member management.
2. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Username, display name, account ID, role, status, organisation membership. | Create accounts, show leaderboards, manage access, and operate the service. |
| Recovery and authentication data | Optional recovery email, OTP records, PIN hash, session IDs, token version, IP address, user agent, CSRF token. | Account access, recovery, fraud prevention, rate limiting, and security. |
| League and gameplay data | Organisations, invite codes, access requests, prediction entries, scores, standings, pools, events, reminders. | Run prediction leagues, pools, events, rankings, and result workflows. |
| Admin and audit data | Admin actions, scoring actions, member-management events, timestamps, request IDs. | Accountability, troubleshooting, security, and dispute handling. |
| Billing metadata | Stripe customer and subscription IDs, plan, status, billing email where supplied, webhook event metadata. | Manage organiser software subscriptions and billing records. |
| Notification data | Web push subscriptions, mobile push tokens, preferences, notification records. | Send requested reminders, results, account messages, and service notifications. |
| Support and bug report data | Bug title, description, current page, platform/version, reference number, optional admin screenshot and signed screenshot link. | Investigate, track, and fix support issues. |
| Diagnostics and logs | Errors, performance traces, request logs, route metadata, Sentry events, technical identifiers. | Monitor reliability, secure the service, and debug faults. |
| Device and local storage data | Cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, mobile SecureStore, AsyncStorage. | Keep users signed in, preserve unsent prediction choices, support offline use, and store preferences. |
3. Lawful bases
| Purpose | Lawful basis | Notes |
|---|---|---|
| Account creation, login, predictions, leaderboards, events, and pools | Contract | Needed to provide the ScoreSocial service requested by the user or organiser. |
| Security, rate limiting, fraud prevention, audit logs, diagnostics, and service logs | Legitimate interests | Used to protect users, organisers, providers, and the platform. |
| Optional recovery email and OTP recovery | Contract and user request | Used when a user provides an email or asks for account recovery. |
| Optional push notifications | Consent | Users can opt in or out through browser, app, or account controls where available. |
| Organiser billing and subscription administration | Contract and legal obligation | Used for subscription management, accounting, tax, and dispute records. |
| Bug reports and optional screenshots | Legitimate interests and user-initiated support request | Used to respond to support requests and fix service issues. |
| Service messages about accounts, security, deadlines, and important operational changes | Contract or legitimate interests | Used where messages are necessary for service operation or user safety. |
4. Cookies, storage, and diagnostics
ScoreSocial uses essential cookies and similar technologies for login, security, CSRF protection, organisation routing, offline queues, unsent prediction choices, and preferences. The detailed inventory is in the Cookie and Local Storage Policy.
Sentry error and performance diagnostics may run when a DSN is configured. Sentry Session Replay is disabled by default and is not added unless a separate diagnostics consent or support capture flow is introduced.
5. Service providers and data recipients
ScoreSocial uses providers for hosting, database, authentication support, billing, email, diagnostics, push notifications, issue tracking, and sports data. The provider inventory is available on the Service Providers and Data Recipients page.
Some providers may process data outside the UK or EEA. Where international transfers apply, ScoreSocial relies on provider transfer mechanisms and account terms appropriate to the service being used.
6. Retention
| Data | Retention approach |
|---|---|
| Account, membership, prediction, score, pool, event, and leaderboard data | Kept while the account, organisation, league, season, pool, or event remains active, then deleted or anonymised where feasible. |
| Local unsent prediction choices and offline queues | Stored on the device until submitted, expired by app logic, cleared, or removed by browser/app storage controls. |
| Notification tokens and preferences | Kept while notifications are enabled or the account/device remains active, subject to cleanup. |
| Audit, scoring, security, and rate-limit records | Kept for security, accountability, fraud prevention, and dispute periods appropriate to the record. |
| Billing records | Kept for subscription management, accounting, tax, dispute, and legal obligations. |
| Bug reports, private issues, screenshots, Sentry events, and hosting logs | Kept according to provider settings and operational need. Signed screenshot links expire after 7 days. |
| Backups | May remain until the relevant backup cycle expires or is overwritten. |
7. Your rights
Depending on your location and the processing purpose, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data. You can also complain to the UK Information Commissioner's Office.
To make a privacy rights request, email admin@scoresocial.app. We may verify your identity and account before responding. Responses are handled within one month unless the law permits an extension for complex or multiple requests.
Account closure information is on the Data Deletion and Account Closure page. Export and subject access information is on the Data Export and Subject Access Requests page.
8. Age and automated decisions
ScoreSocial is intended for users aged 18 or over. By registering or requesting access, users confirm that they meet this age requirement. Organisers must not invite or approve users who do not meet it.
ScoreSocial calculates prediction scores, ranks, standings, and pool/event allocations. These gameplay calculations do not create legal, financial, regulated gaming, employment, credit, or similarly significant effects.
9. Security
PINs are stored as hashes rather than plaintext. Session cookies use security controls such as HTTP-only, Secure, and SameSite settings where applicable. Production traffic uses HTTPS. Access to production systems is limited to authorised team members and providers.
10. Contact and complaints
Privacy requests: admin@scoresocial.app. Support: support@scoresocial.app. ICO complaints: ico.org.uk/make-a-complaint.