Privacy Policy

HiScore is operated by [COMPANY NAME], [ADDRESS] (“we”, “us”). We are the data controller for the personal data described in this policy, including under the EU General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law No. 6698 (KVKK).

For any privacy question or request, contact us at [CONTACT EMAIL].

• We collect only what we need to run HiScore: your account, device and app settings, subscription status and, if you use it, your AI chat.
• We do not sell personal data and we do not use advertising identifiers.
• Payments are handled by Apple or Google. We never see your card details.
• AI chat messages are processed by our AI provider, Anthropic, to generate answers.
• You can delete your account at any time in the app.

• Account data: a random account ID (also for guest accounts). If you sign in with Apple or Google: the account identifier and e-mail address they share with us (this can be an Apple private relay address).
• Device data: an installation ID generated by the app (not an advertising ID), device model, operating system and app version, language and time zone.
• Push notification tokens: if you allow notifications, the token issued by Apple Push Notification service or Firebase Cloud Messaging, and your notification settings.
• Preferences: favourite teams and competitions, language and appearance settings.
• Purchase data: Apple or Google process your payment. Our subscription service provider RevenueCat receives the purchase receipt, product, transaction IDs and subscription status, linked to your account ID, so we can unlock Premium. We do not receive payment card details.
• AI chat: the messages you write in a match chat and the answers generated for you.
• Diagnostics: the app contains no analytics, advertising or crash-reporting SDK. Firebase Cloud Messaging, which delivers notifications, may process limited technical data needed for delivery.
• Support: the content of messages you send us and the contact details you use.
• Technical logs: IP address, request time and basic request data recorded by our servers for security and troubleshooting.

The website hiscoreai.com uses no cookies, no analytics and no third-party scripts; fonts are hosted on our own server. Our web server keeps standard access logs (IP address, browser user agent, requested page and time).

• To provide the app, your account, predictions, live scores and AI features: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To process subscriptions and restore purchases: performance of contract.
• To send push notifications: your consent, which you can withdraw in your device settings at any time.
• To fix errors and improve HiScore using our own server logs: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To keep HiScore secure and prevent abuse, including rate limiting: our legitimate interests.
• To meet legal obligations such as tax and accounting rules: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).

Predictions describe football matches, not you. We do not make automated decisions that have legal or similarly significant effects on you.

When you use a match chat, your messages and the match data needed to answer them are sent to Anthropic, PBC (United States), which processes them on our behalf to generate the reply. Under Anthropic’s commercial terms, data sent through its API is not used to train its models.

AI commentary is generated from match data only and contains no personal data.

Please do not share sensitive personal information in the chat. AI answers can be wrong and should not be relied on.

We share personal data only with service providers that process it for us under contract, and only as far as they need it:

• Hosting: [HOSTING PROVIDER], where our servers and database run.
• Anthropic: AI chat processing.
• RevenueCat: subscription management.
• Apple and Google: sign-in, push notifications and in-app purchases, under their own privacy policies.

We may also disclose data when the law requires it, to protect our rights or users’ safety, or as part of a merger or acquisition, in which case this policy continues to apply. We do not sell personal data or share it for advertising.

Some providers, including Anthropic, RevenueCat, Apple and Google, process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, for transfers from Türkiye, the mechanisms set out in Article 9 of KVKK [confirm the transfer mechanism for each provider].

• Account data, preferences and device data: for as long as your account exists. After you delete your account it is erased within [30 days] and from backups within [90 days].
• AI chat history: [90 days] after the last message, or earlier if you delete your account.
• Push tokens: until you disable notifications, the token expires or you delete your account.
• Technical and web server logs: up to [30 days], unless needed to investigate a security incident.
• Purchase and transaction records: for the period required by tax and accounting law [confirm period].

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with your data protection authority.

If you are in Türkiye, Article 11 of KVKK also gives you the right to learn whether your data is processed and for what purpose, to know the third parties it is transferred to, to ask that corrections or deletions are passed on to them, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing. You can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To exercise your rights, e-mail [CONTACT EMAIL] from the address linked to your account. We reply within 30 days and may ask you to confirm your identity.

You can delete your account and data in the app under Profile → Delete account and data, on the website, or by e-mail. The Delete your account page explains what is deleted and when.

After deletion your personal data is removed. We keep only a minimal, non-identifying record (account ID, dates, a one-way hash of the sign-in identity and subscription records) to prevent misuse and for legal and accounting obligations. The same Apple or Google sign-in cannot be used with HiScore again.

HiScore is not directed at children under [16]. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us at [CONTACT EMAIL] and we will delete it.

Data is encrypted in transit with TLS. Session refresh tokens are stored only as hashes, and access to production systems is limited to the people who need it. No system is completely secure.

We will update this page when our practices change and show the date of the latest version at the top. For significant changes we will also tell you in the app.

[COMPANY NAME], [ADDRESS]. E-mail: [CONTACT EMAIL].