RE-NE-RE Zagreb d.o.o. (“Company”, “we”, “us”, or “our”) operates the Predictify mobile application (“App”). This Privacy Policy explains how we collect, use, and protect your personal data when you use our App.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR), the Croatian Personal Data Protection Act (ZZOP), and other applicable privacy laws.

By using Predictify, you agree to the collection and use of information as described in this policy.

RE-NE-RE Zagreb d.o.o.
Svetog Izidora 24, 10020 Zagreb, Croatia
Email: privacy@predictify.gg

3.1 Data You Provide Directly

• Email address — required for account creation and login, and used to send you service messages about your account. If you choose to opt in, it is also used to send occasional product updates (see Section 4)
• Username — your chosen display name
• Profile photo — optional, uploaded by you

3.2 Data We Collect Automatically

• IP address — used to determine your approximate country of origin for personalization purposes (showing your local football league)
• Device information — device type, operating system version, for app compatibility purposes
• Push notification token — to send you match reminders and league updates (only if you grant permission)
• Usage data — features used, screens visited, predictions made — to improve app performance
• Internal user identifier — a unique account ID (UUID) is created when you sign up. We use this internal identifier to link your account across the services described in Section 6 (e.g., crash reports, analytics, subscription management) so we can correlate issues to your account. This is separate from your public Username.

3.3 Moderation-Related Data

If another user reports your username, profile photo, or private-league name to us, or if our moderation team takes an action on your account (rename, avatar reset, account removal — see Terms of Service Section 5), we record:

• The category and free-text description of the report (if any)
• An evidence snapshot of the reported content at the time of the report
• The action taken, the reason recorded by the moderator (if any), and a timestamp
• An identity snapshot (username, email) so the record survives the deletion of your account, allowing us to defend the action if disputed

This data is used only for moderation, dispute defense, and to detect repeat patterns.

3.4 Data We Do NOT Collect

• Precise GPS location
• Contacts or address book
• Payment card details (payments processed entirely by Apple/Google)
• Biometric data

4.1 Email Communications

We send two distinct types of email, and they are controlled separately.

Service emails are part of the service itself and cannot be turned off while you hold an account. These are limited to:

• account verification codes and password resets
• notifications when your subscription is changed by our support team
• delivery of prizes or rewards you have won
• notices about material changes to this Policy or our Terms

Product updates are optional and are sent only if you have opted in. These cover new features and newly added leagues. They are switched off by default — we do not send them unless you actively turn them on.

You can turn product updates on or off at any time in the App under Settings → Notifications, or by using the unsubscribe link included in every such email. Unsubscribing takes effect within 48 hours and never affects the service emails listed above.

5.1 Google AdMob

Free users of Predictify see advertisements served by Google AdMob, a service provided by Google LLC. The Google Mobile Ads SDK automatically collects and processes the following types of data for ad targeting, ad performance measurement, and fraud prevention:

• IP address (used for coarse geolocation and fraud prevention)
• Device identifiers — Advertising ID (IDFA on iOS, AAID on Android) when you have allowed tracking
• Device information — model, operating system version, language
• General location (country/region derived from IP)
• Ad impression and click events — which ads you saw and which you tapped
• App usage signals — limited interaction data needed for ad rendering
• Crash logs and performance data from the Mobile Ads SDK itself (separate from our Sentry telemetry)

All data is transmitted over encrypted connections (TLS).

You can opt out of personalized advertising at any time through your device settings:

• iOS: Settings → Privacy & Security → Apple Advertising → turn off Personalized Ads (controls Apple’s ads). See also Section 5.3 below for Apple’s App Tracking Transparency setting that controls AdMob’s use of your Advertising ID.
• Android: Settings → Google → Ads → Opt out of Ads Personalization

For more information about how Google uses data, visit: google.com/policies/privacy/partners

5.2 We Do Not Sell Your Data

We do not sell, rent, or trade your personal data to third parties. AdMob operates independently within Google’s ecosystem — we provide the advertising space, but we do not directly share your personal information with advertisers.

5.3 App Tracking Transparency (iOS)

On iOS, we use Apple’s App Tracking Transparency (ATT) framework. The first time you launch Predictify on a new device, iOS will show a system prompt asking whether you allow Predictify to track your activity across other companies’ apps and websites.

“Tracking” in this context means linking data collected from this app (such as your device’s Advertising Identifier — IDFA) with data collected from other apps or websites for targeted advertising purposes. In Predictify’s case, this applies primarily to Google AdMob.

• If you allow tracking, AdMob may use your IDFA to show you personalized advertisements.
• If you decline, AdMob will only show non-personalized advertisements; the IDFA is not transmitted.

You can change this choice at any time in iOS Settings → Privacy & Security → Tracking → Predictify. This is a separate setting from “Apple Advertising → Personalized Ads” mentioned in Section 5.1, which controls Apple’s own advertising.

In compliance with Apple’s privacy manifest requirements, the following internet domains are declared as tracking domains used by Predictify (all operated by Google AdMob):

• googleads.g.doubleclick.net
• pagead2.googlesyndication.com
• googlesyndication.com
• googleadservices.com
• google-analytics.com

If you decline ATT, iOS automatically blocks data transmissions to these domains.

We do not sell your personal data. We may share data with:

• Supabase (database and authentication provider) — processes data on our behalf under a Data Processing Agreement. Hosted in the European Union (Ireland).
• Google AdMob — for advertising purposes as described in Section 5 (free users only)
• Expo / Expo Notifications — for delivering push notifications
• PostHog — product analytics. Collects: screen views, button taps (autocapture), custom interaction events, device info, OS version, app version, and an anonymous distinct ID that we associate with your internal user identifier (UUID) on login so we can correlate usage across sessions.
• Sentry — crash and error reporting. Collects: crash data, error stack traces, performance traces, navigation breadcrumbs, device info, OS version, and app version. After you sign in, we tag every event with your internal user identifier (UUID) so we can investigate issues you specifically encounter. We do not tag events with your email or username.
• RevenueCat — subscription management. Receives your internal user identifier (UUID) as the customer reference, the App Store / Play Store transaction receipts, and purchase status. Used to determine your Premium entitlement, handle restores, and process refunds.
• Resend (email delivery provider) — processes data on our behalf under a Data Processing Agreement. Receives your email address and the content of the message being sent, solely in order to deliver it. Used for service emails and, if you have opted in, product updates. Resend does not use your address for its own purposes.
• API-Football — we query this service for match data; we do not share your data with them
• Apple Sign-In and Google Sign-In — when you choose to log in with these providers, the provider returns a stable identifier (and email, if you allow it) which we use to create or look up your account. This is authentication only.
• Apple App Store / Google Play — for payment processing of subscription purchases. We do not receive your payment card details.
• Law enforcement — only when required by Croatian or EU law

All third parties listed above are bound by Data Processing Agreements (or equivalent contractual obligations) that require them to provide the same or equivalent protection of your personal data as described in this Privacy Policy.

No third-party AI services. Predictify does not share your personal data with any third-party generative AI providers or large language models. We do not use your data to train any AI models.

When you delete your account, all your personal data is permanently deleted within 30 days.

As an EU/EEA resident, you have the following rights:

• Right of Access — request a copy of your personal data
• Right to Rectification — correct inaccurate data
• Right to Erasure (“Right to be Forgotten”) — request deletion of your data
• Right to Restriction — request we limit how we use your data
• Right to Data Portability — receive your data in a machine-readable format
• Right to Object — object to processing based on legitimate interests
• Right to Withdraw Consent — withdraw consent for push notifications or product update emails at any time, without affecting the lawfulness of processing carried out before withdrawal
• Right not to be subject to Automated Decision-Making — Predictify does not use automated decision-making or profiling that produces legal or similarly significant effects on you. ELO ratings and leaderboard rankings are calculated automatically from your in-app performance but have no legal effect.

To exercise any of these rights, contact us at: privacy@predictify.gg

We will respond to requests within 30 days.

Reports filed against you. When you exercise your Right of Access for moderation-related data (Section 3.3), we will disclose the category, action taken, and date of any reports filed against you. We may redact the identity of users who reported you and any free-text descriptions that could identify them, under GDPR Article 15(4) (protection of the rights and freedoms of others, including from retaliation).

You also have the right to lodge a complaint with the Croatian Data Protection Authority (AZOP):
Website: azop.hr | Email: azop@azop.hr

We implement appropriate technical and organizational security measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure database with Row Level Security (RLS) — each user can only access their own data
• Regular security reviews
• Access controls limiting who can access your data

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Predictify is available to users aged 13 and older. We do not knowingly collect personal data from children under 13.

If we become aware that we have collected data from a child under 13 without parental consent, we will promptly delete that data. If you believe we have collected such data, please contact us at privacy@predictify.gg.

Your data is stored on servers within the European Union (Supabase EU region — Ireland).

If any data transfer outside the EU occurs (for example, Google AdMob and Resend process data in the US), it is covered by appropriate safeguards including Standard Contractual Clauses (SCCs) as required by GDPR.

The App may contain links to third-party websites or services. This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or by email at least 14 days before the changes take effect.

The “Last updated” date at the top of this page indicates when the policy was last revised.

For privacy-related questions, requests, or complaints:

RE-NE-RE Zagreb d.o.o.
Svetog Izidora 24, 10020 Zagreb, Croatia
Email: privacy@predictify.gg

For urgent matters related to data breaches or security concerns, please use the subject line: URGENT: Privacy