Privacy Policy

1. Data controller

Alejandro Tejedo (Spain). Contact: alejandro.tejedo@icloud.com.

2. What data is collected

SuperStake has no sign-up or login. It collects what is strictly needed for the subscription and the alerts to work, plus usage data to improve the app:

• Anonymous session identifier from Firebase Authentication, created on first launch. It contains no name, email or any contact details: it only links the subscription to the installation.
• Purchase history: on iOS, the Apple transaction identifier (originalTransactionId); on Android, the Google Play purchase token and order ID. In both cases, the product purchased and the subscription status, verified with Apple or with Google (via the Google Play Developer API), and a random identifier the app attaches to the purchase to link it to the installation.
• App usage data, via Google Analytics for Firebase: screens viewed, in-app actions (for example, opening a match or the paywall), session time, device model, OS and app version, and approximate city-level location derived server-side from the IP address. This data is associated with the same anonymous identifier from the first point.
• Push notification token, only if you turn on the free pick alerts: on iOS, the token Apple assigns to the device and the Firebase Cloud Messaging token; on Android, only the Firebase Cloud Messaging token. The token is subscribed to a topic that only encodes your language and your time offset (for example, English and UTC+0), so the alert arrives at a sensible hour and in your language. The token is handled by Firebase Cloud Messaging; we do not store it in our database. Turning the alerts off unsubscribes the device from the topic.

Kick-off reminders for a match and the reminder before a trial’s first charge are local notifications: they are scheduled on the device itself and never go through any server.

Subscription and usage data are associated with that anonymous identifier, so they are treated as data linked to a specific user.

3. What is NOT collected

• In the app, no name, email, phone number or address. (The one exception is voluntary and lives on the website: the Android early-access list in section 9.)
• No precise location (GPS), no contacts, no photos, no health or financial data.
• No advertising and no ad tracking: neither the iOS IDFA and ATT framework nor the Android advertising ID are used, no data is combined with third parties for advertising purposes, and no data is ever sold to anyone.

4. Purpose and legal basis

The subscription data in section 2 is processed for a single purpose: granting and maintaining access to the subscription you purchased through Apple or Google Play. The legal basis is the performance of a contract (art. 6(1)(b) GDPR).

The notification token is processed only to send you the alerts you turned on. The legal basis is your consent (art. 6(1)(a) GDPR), which you give by turning them on and withdraw by turning them off, in the app or in iOS or Android notification settings.

Usage data is processed to understand how the app is used and improve it — which screens are viewed, where the purchase flow is abandoned, which features go unused. The legal basis is legitimate interest (art. 6(1)(f) GDPR) in improving the service; you can object to this processing by writing to the contact in section 1.

5. Processors and transfers

The service relies on three providers:

• Google Firebase (Authentication, Firestore, Cloud Functions, Google Analytics for Firebase and Firebase Cloud Messaging for push alerts), with subscription data hosted in the Europe region. See its privacy policy. International transfers, where they occur, are covered by the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Apple, on iOS, which processes the payment, verifies the subscription and delivers push notifications (APNs) under its privacy policy.
• Google, on Android, which processes the payment and verifies the subscription through Google Play under its privacy policy.

6. Retention

Subscription data is kept for as long as the anonymous session exists, and afterwards only for as long as needed to meet legal obligations or resolve billing disputes. Usage data associated with the identifier is kept in Google Analytics for a maximum of 14 months; aggregated reports contain no identifiable data.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to alejandro.tejedo@icloud.com. Since the app has no accounts, for deletion requests please tell us roughly when you installed the app and, if you have it, your Apple invoice or your Google Play order number (it starts with GPA.) so we can locate the transaction. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD) or with your local supervisory authority.

8. Minors

The service is not directed at people under 18 and no data of minors is knowingly collected.

9. Android early-access list (website)

If you sign up at superstake.app/en/android/ for early access to the Android app, we store the email address of your Google account, the language of the page and the date you signed up. Your IP address and any other data are not stored.

• Purpose: to add you as a tester to SuperStake’s closed test on Google Play and to email you the invitation and your code for 3 months of SuperStake Pro. It is not used for advertising or newsletters and is not shared with anyone else.
• Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form. You can withdraw it at any time by writing to the contact in section 1.
• Who processes it: it is stored in Google Firebase (Firestore, Europe region) and, to invite you, entered into Google Play Console, which processes it as part of the test under Google’s privacy policy.
• Retention: until the closed test ends and the app is published on Google Play, and for no more than 12 months from sign-up. It is then deleted.

10. Changes

If the app were to start collecting any new data, this policy will be updated first, along with the App Store listing and the iOS app’s privacy manifest, and the Google Play listing and its Data safety section. The “last updated” date always reflects the version in force.