Legal

Privacy Policy

Effective date: September 4, 2026

This Privacy Policy explains how ScoreStory (“ScoreStory,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our mobile application, website, and related services (together, the “Services”). If you do not agree with this policy, do not use the Services.

Privacy at a glance

ScoreStory does not use this data for third-party advertising or tracking across apps and websites. We do not collect payment information, contacts, health data, or continuous or precise device location through the Services.

1. Information we collect

Account and profile information

We collect the email address and authentication information needed to create and secure your account. We also collect profile information you choose to provide, such as your display name, avatar, and preferred sports. Passwords are handled by our authentication provider and are not available to us in readable form.

Match and social information

We process match records you and other participants create, including the sport, date and time, participants, teams, venue, score, outcome, notes, confirmation state, correction history, reactions, comments, and rematch relationships. A match is one shared record, so information submitted by one participant may also appear in the authorized histories of other participants.

Photos and venue information

If you choose to upload an avatar or match photo, we process that image. The app removes application metadata from supported match photos before upload. Venue records may include a venue name, city, region, and other coarse location information you enter. ScoreStory does not collect continuous or precise device location.

Device, notification, and operational information

We may process device push tokens and notification preferences to deliver match activity alerts. We also receive routine security and operational information from our infrastructure, such as request timestamps, network addresses, and error information. Error monitoring is disabled unless a separately approved staging configuration is enabled.

Limited product analytics

ScoreStory records a small allowlist of product milestone names and timestamps to understand whether core flows work. These events do not contain free-form properties, match contents, precise location, advertising identifiers, or cross-app tracking data.

Support communications

If you contact us, we collect the information in your message and any information needed to respond and resolve the request.

Website information

The current marketing website does not set advertising cookies or use third-party analytics. Our hosting provider may process standard request information, such as network address, browser type, requested page, and timestamp, to deliver and secure the website.

2. How we use information

We use information to:

• provide, secure, and maintain the Services;
• authenticate accounts and apply optional referral attribution;
• create one canonical match record for authorized participants;
• support confirmations, corrections, identity rejection, and guest claims;
• generate histories, rivalries, venue memories, summaries, and result cards;
• sync offline-created match drafts when your device reconnects;
• deliver activity notifications you permit;
• prevent abuse, investigate reports, and enforce blocks;
• respond to support requests and comply with legal obligations; and
• measure and improve the reliability of the Services.

3. How information is shared

With match participants

Authorized participants can see the shared match record and participant activity allowed by the product. Depending on the feature, this can include scores, revisions, confirmations, comments, reactions, and photos. People you block cannot create new match relationships with you through normal app flows.

When you create a share link

A share link may let someone with the link view a limited confirmed result card. It does not expose participant-only notes, photos, comments, corrections, or safety controls. You can revoke a share link. Anyone who received content before revocation may have retained a copy.

With service providers

We use vendors that process information on our behalf to provide hosting, authentication, database, storage, app distribution, and notifications. The current Service relies primarily on Supabase for authentication, database, and private storage, and Expo for app builds and push-notification delivery. Apple and Google may independently process app-store or device information under their own privacy policies. Our providers process information only for the services they supply to us and under their own contractual and security obligations.

For safety, legal compliance, or a business transfer

We may disclose information when reasonably necessary to comply with law, protect people or the Services, investigate fraud or abuse, or respond to a valid legal process. If the Services are involved in a merger, financing, acquisition, or sale of assets, information may transfer as part of that transaction subject to applicable law.

We do not sell personal information, serve behavioral advertising, or use personal information for cross-context behavioral advertising.

4. Retention and account deletion

We retain information while your account is active and as needed to provide the Services, resolve disputes, enforce agreements, maintain security, and meet legal obligations. Retention periods vary by the type of information and why we process it.

You can request account deletion from the app. Deletion removes or de-identifies your profile information and schedules private account media for cleanup. Because matches are shared records, deleting your account does not erase another participant’s legitimate match history. Your identity is anonymized in retained shared records. Some limited information may remain in backups or security logs until those systems cycle out.

See Delete your ScoreStory account for step-by-step instructions and a detailed list of what is deleted and what is retained in anonymized shared records.

5. Your choices and rights

The app provides controls to edit profile information, manage notifications, export your ScoreStory data, revoke share links, block or report another person, and delete your account. You may also contact us to request access, correction, deletion, restriction, or portability where applicable law provides those rights. We may need to verify your identity before responding.

You can deny photo-library, camera, and notification permissions through your device settings. Some related features will not work without the permission.

6. Security

We use technical and organizational measures designed to protect information, including authenticated access, row-level authorization, participant-scoped storage, and atomic server-side integrity transitions. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

7. International processing

Our providers may process information in countries other than where you live. Where required, we use appropriate safeguards for international data transfers and honor rights available under applicable law.

8. Children

ScoreStory is intended for adults. We do not knowingly collect personal information from children. If you believe a child has provided information through the Services, contact us so we can investigate and take appropriate action.

9. Changes to this policy

We may update this policy as the Services change. We will post the revised version and update the effective date. If a change materially affects how we handle personal information, we will provide additional notice when required.

10. Contact us

ScoreStory is responsible for the processing described in this policy. Questions, complaints, or privacy requests can be sent to support@wherk.com.