Privacy Policy

Controller: MindScale

Contact and requests: mindscaleai@gmail.com

Website: https://scorelab.live

This notice covers the ScoreLab app, the scorelab.live website and the related email and support channels.

Account data (if you create an account)

• Email address and whether it is verified; whether you use Apple's private email relay
• Display name (when provided by Apple or Google, or edited by you) and the profile photo link provided by Google
• Your username (created automatically for you; you can change it)
• The profile photo you upload (optional): our server re-encodes it as a square and removes photo metadata (EXIF), including location; the result of the automatic check, the upload date and any restriction on uploading photos
• Sign-in methods (email/password, Apple, Google), Firebase user ID, app language, account dates
• Devices linked to your account and when they were last seen
• Record of your acceptance of the Terms of Use (version, date, method) and your marketing preference
• We do not store your password; it is held by Firebase Authentication.

Device and technical data (everyone)

• Device identifier: on iOS the identifier for vendor (IDFV — it may stay the same even if you reinstall the app), on Android the ANDROID_ID
• Platform, operating system, app version, language, time zone
• IP address and the country derived from it; browser/app information (user agent); the page or endpoint requested
• We do not collect precise (GPS) location.

Notifications and preferences

• Notification tokens (Firebase Cloud Messaging, iOS Live Activities), notification permission, tracking permission (ATT) and ad consent (UMP) status, your app usage streak
• Teams, players and leagues you follow; match, team and transfer notification preferences and mutes
• Live Radar rules and alarms; notification and campaign delivery logs

Subscriptions, credits and ad rewards

• RevenueCat user ID (your device identifier or an ID linked to your account), subscription status, product, period, start and end dates, store, price, currency, country, billing-issue information
• Subscription event records that RevenueCat sends us, and records of moving a purchase to your account
• Weekly credit usage, signals you unlocked, rewarded-ad progress, paywall experiments (A/B tests)
• We do not receive card or payment details; payment is handled by the Apple App Store or Google Play.

Usage, error and performance data

• In-app usage events (e.g. screens and paywall steps, live match tracking, intro video views)
• Analytics user properties: premium status, theme, language, number of follows, where you got the app, accessibility settings, permission states
• Crash reports, app error messages, launch and performance measurements

Games

• Your game progress, score predictions, grid game moves, best scores and data-error reports you submit (linked to the device identifier)
• Leaderboard: whether you joined and your points (ScoreLab League Points)
• Profile reports: when you report a user's photo or username on the leaderboard, the reporting and reported accounts, what was reported, the reason and the date

Security records

• One-way hashes of codes and links sent for password reset, email verification and web deletion, plus the requesting IP address and language
• Request counters used to prevent abuse; event logs linked to your account and device (email masked; IP addresses, codes and passwords are not written)

Contact form (website)

• First name, last name, email, subject, message, IP address, browser information and your marketing choice

We do not ask for special categories of data (health, religion, biometric data, etc.); please do not include such information in forms.

• Directly from you: when you create an account, edit your profile or upload a profile photo, choose follows and notification settings, or fill in forms
• Automatically: when the app or website sends requests to our servers, and through the service-provider software (SDKs) built into the app
• From third parties: name, email and profile photo when you sign in with Apple or Google; subscription status from RevenueCat and the app stores; install source from AppsFlyer
• When you start cancelling a subscription in the App Store, Apple sends us the transaction ID, product and language to ask which information message to show; we use this only to produce that answer.

• Joining the games leaderboard is optional and requires an account. If you join, your username, points and rank are visible to other users. Your real name and email address are not shown.
• If you upload a profile photo and it passes the automatic check, it is shown next to your username on the leaderboard. A photo that comes from signing in with Apple or Google is visible only to you.
• You can leave the leaderboard and remove your photo at any time. You can change your username under the rules shown in the app (for example, a waiting period between changes).
• Other users can report a photo or username they find inappropriate. We review reports and remove content that breaks the rules; the reported user is not shown who reported them.

We process your data for the following purposes, on the legal bases shown (GDPR Art. 6 / KVKK Art. 5):

• Creating your account, sign-in and account security, account emails (verification, password reset, welcome, password changed, account deleted) — performance of a contract (GDPR 6(1)(b); KVKK 5/2-c)
• Providing app features: follows, notifications, Live Radar, Live Activities, games and the leaderboard, content by language and time zone — performance of a contract
• Storing and showing your profile photo — performance of a contract; checking uploaded photos automatically for objectionable content, reviewing profile reports and removing content that breaks the rules — our legitimate interest in protecting other users and the service (GDPR 6(1)(f); KVKK 5/2-f)
• Managing Premium, credits and rewarded-ad benefits, moving a purchase to your account, preventing a purchase from moving to another account unintentionally — performance of a contract; for audit records, legitimate interests and the establishment, exercise or defence of legal claims (GDPR 6(1)(f); KVKK 5/2-e, f)
• Security, fraud and abuse prevention, rate limiting, event logs — legitimate interests (GDPR 6(1)(f); KVKK 5/2-f)
• Error detection, crash analysis and performance monitoring — legitimate interests
• Improving the product: usage analytics, testing features and the paywall (A/B tests) — legitimate interests
• Marketing measurement: measuring which campaign an install came from and subscription revenue — legitimate interests
• Funding the free version with ads — legitimate interests for non-personalised ads; your consent for personalised ads (GDPR 6(1)(a); KVKK 5/1 explicit consent)
• Answering your contact-form request — legitimate interests; sending you marketing emails if you opted in — your consent
• Keeping records of terms acceptance and permissions, complying with legal obligations, responding to authorities and protecting our rights in disputes — legal obligation and legal claims (GDPR 6(1)(c), (f); KVKK 5/2-ç, e)

We rely on legitimate interests only where we consider that our interests are not overridden by your fundamental rights and freedoms. You can object to this processing at any time (see "Analytics, Measurement and Ads" and "Your Rights").

An email address or Apple/Google sign-in is required to create an account; without it you cannot create one, but you can still use the app as a guest. The device identifier and technical data are needed for the app to work.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Predictions are about matches, not about you. The profile photo you upload is checked automatically by artificial intelligence; a rejected photo is not stored, and you can upload another one or email mindscaleai@gmail.com to ask for the decision to be reviewed by a person.

• Analytics and crash reporting: Firebase Analytics, Firebase Crashlytics and New Relic link events and crash reports to your device identifier. Our server also sends subscription events (product, store, price, currency) to Google Analytics with your device identifier. This data is not anonymous; it is linked to your device identifier.
• Install measurement: AppsFlyer measures which campaign or source you installed the app from; your device identifier is passed to AppsFlyer as the customer ID.
• Subscriptions: RevenueCat manages your subscription and collects device identifiers.
• This processing does not depend on your consent; its legal basis is our legitimate interests (running the service, detecting errors, improving the product, measuring marketing). To object, email mindscaleai@gmail.com. We will review your objection and tell you the outcome and the steps we take.
• Tracking permission on iOS (ATT): Apple's permission prompt is shown for tracking across apps and websites. If you do not allow it, the advertising identifier (IDFA) is not shared and AppsFlyer anonymises your data. You can change this at any time in iOS Settings.
• Advertising ID on Android: ad and measurement software may use your device's advertising ID. You can reset or delete it in your Android settings.
• Ads: in the free version, Google AdMob and the networks it mediates (ironSource, Unity Ads, InMobi) show ads. When an ad is requested, these networks receive device information, your IP address and, where permitted, your advertising identifier. In regions where consent is legally required, such as the EU/EEA, Google's consent form (UMP) is shown and personalised ads depend on your consent; if you do not consent, ads are not personalised. You can change your choice in the app under Settings → Relevant Ads.
• Configuration and in-app messages: Firebase Remote Config and Firebase In-App Messaging process app-instance information to manage app settings and in-app announcements remotely.

• scorelab.live uses Google Analytics (two measurement properties) to measure visits. Google Analytics places cookies in your browser and sends page views and navigation information to Google together with the cookie identifier.
• The site has no cookie consent banner. The legal basis for this measurement is our legitimate interest in understanding and improving how the site is used.
• To refuse these cookies, block or delete them in your browser settings, or use Google's browser add-on to disable Google Analytics on all sites: https://tools.google.com/dlpage/gaoptout
• Account pages (password reset, account deletion) keep the one-time code from your email link in your browser's session storage until the step is finished; this is strictly necessary and not used for analytics.

We share your data only with the service providers below and only as far as needed to provide the service. Providers process the data on our behalf or under their own terms.

Infrastructure

• Hetzner — hosting of our servers (Germany)
• Bunny — image delivery (CDN), storing and serving the profile photos you upload, storage of database backups (backups in Germany)
• Cloudflare — traffic routing and security; IP address and header information of requests, country detection

Google

• Firebase Authentication — sign-in (email, password, Apple/Google identity, name, profile photo, user ID)
• Firebase Cloud Messaging — sending notifications (notification token and notification content)
• Firebase Analytics (including export of analytics data to Google BigQuery), Firebase Crashlytics, Remote Config, In-App Messaging — analytics, crash analysis, configuration
• Google Analytics — website measurement and subscription events sent from our server
• Sign in with Google, Google Play (purchases and app distribution), Google AdMob and its consent form (UMP)
• Gmail — forwarding contact-form messages to us and sending you an automatic reply

Apple

• Sign in with Apple (including revoking the Apple sign-in authorisation when you delete your account), App Store purchases and messages on the subscription cancellation screen
• Apple Push Notification service — Live Activity updates (match status; no user identifier is sent)

Others

• RevenueCat — subscription management (app user ID, purchase information, AppsFlyer ID, device identifiers)
• AppsFlyer — install attribution and marketing measurement (device identifier, install and app-open events)
• New Relic (EU region) — app stability and server performance monitoring (crash and error events, device identifier; on the server side also IP address, version, platform, operating system, language, time zone)
• ironSource, Unity Ads, InMobi — showing ads via AdMob mediation
• Resend — sending account emails (recipient address, link and code; no tracking pixel is used)
• Anthropic — automatic check of the profile photo you upload for objectionable content (only the photo is sent; not your name, email or user ID)
• Slack — public replies to ScoreLab's X account (username and text) may be forwarded to our content team's internal notification channel; no app user data is sent

No personal data is sent to our match data providers. Where required by law, we may share data with competent public authorities.

• Our servers and database backups are located in Germany (Hetzner, Bunny Storage). If you use ScoreLab from Türkiye, your data is therefore transferred abroad.
• Some service providers — such as Google/Firebase, Apple, AppsFlyer, RevenueCat, Resend, Anthropic, Cloudflare and the ad networks — also process data in other countries, including the United States. The profile photo you upload is sent to Anthropic (United States) to be checked and is served from Bunny's delivery servers around the world. New Relic keeps our data in its EU region.
• These providers apply the technical and organisational safeguards they commit to in their data processing terms (for example, encryption in transit and access restrictions). For details on these transfers and the safeguards that apply, email mindscaleai@gmail.com.

We keep data only as long as the purpose of processing requires.

Records with a defined deletion period

• Password reset, verification and web deletion codes: 48 hours
• Abuse-prevention counters: 2 days
• Account event logs (security): 180 days — kept for this period even if the account is deleted
• Match notification subscriptions: 2 days after the match; Live Activity tokens: closed 4 hours after kick-off, deleted 1 day later
• Live Radar delivery logs: 14–90 days; daily signal unlock counters: 14 days; notification campaign logs: 90 days
• App error logs: 30 days; server access logs (IP address, device identifier, request): 7 days; live match tracking events: 90 days
• Paywall impression events: 30 days
• Intro video view records (pseudonymised): 14 days; non-identifying daily counters: 400 days
• Games: game runs 30 days; score predictions and grid games 120 days; game activity days 400 days
• Database backups: taken twice a day, kept for 7 days
• Server logs: deleted on a rolling basis according to a size limit

Records without a defined deletion period yet

• Account data: as long as your account is open (on deletion, see "Account Deletion")
• Profile photo: until you remove it or delete your account; when you upload a new photo the old one is deleted, and a rejected photo is never stored. A deleted photo may remain in the delivery network's cache for a short time.
• Profile reports: until the reporting or the reported account is deleted
• Device, notification token, follow, notification preference, credit and other guest records: while the device or account is active, and for a reasonable period afterwards
• Game progress, best scores and data-error reports: while the device is active, and for a reasonable period afterwards
• Product analytics and A/B test records: for the life of the service, and for a reasonable period afterwards
• Subscription and payment audit records (RevenueCat event records, purchase transfer records): for the duration of the subscription relationship, and afterwards for a reasonable period for possible disputes and legal obligations
• Contact-form messages: to answer your request and keep the correspondence history; we delete them if you ask
• Terms acceptance and marketing permission records: as long as we need to be able to prove the acceptance or permission

Copies held by third-party services are deleted according to those providers' retention settings.

You can delete your account in two ways:

• In the app: Profile → Account settings → Delete account. For your security, you may be asked to sign in again.
• On the web: at https://scorelab.live/en/delete-account enter your account's email address and complete the deletion with the confirmation link we send (valid for 30 minutes).

What is deleted

• Your sign-in account at Firebase; if you signed in with Apple, deleting in the app also attempts to revoke the Apple sign-in authorisation
• Your email address, name, username and profile photo (including the photo files you uploaded)
• Profile reports you made and reports made about your account
• Your follows, notification and subscription preferences, and Live Radar rules
• Our copies of your account's subscription records
• Game data of the devices linked to your account (if a device is linked to another account at that moment, that account's data is kept)
• The link between your devices and the account; the account's notifications are no longer sent

When the deletion is complete, we send a confirmation to your email address.

What is kept

• An account record with email, name and photo removed (Firebase user ID, language, sign-in methods, terms acceptance record, marketing preference, dates) — for security, abuse prevention and proof of acceptance records
• Security event logs: 180 days
• Payment and subscription audit records (RevenueCat event records, purchase transfer records)
• Database backups: up to 7 days
• Copies held by third parties (RevenueCat, Google Analytics/BigQuery, Crashlytics, New Relic, AppsFlyer): according to each provider's retention period
• Data created on the same device as a guest before you created the account or after you signed out (e.g. notification token, access logs) — see "Using ScoreLab as a Guest"

Important

• Deleting your account does not cancel your store subscription. To stop being charged, cancel the subscription in the App Store or Google Play.
• Deletion is usually completed immediately. If the sign-in provider has a temporary problem, it is completed automatically shortly afterwards; the account cannot be used in the meantime.

You can use the app without an account. In that case your follows, notification preferences, Live Radar rules, credit and subscription status, and game progress are kept on our servers, linked to your device identifier.

• If you create an account, your guest data can be moved to it; if the account already has data, you are asked first.
• There is currently no automated way to delete guest data. To request deletion, email mindscaleai@gmail.com; we process the request manually. To match the data to the right device, we may ask for your device identifier or other information that helps verify the device.
• Deleting the app does not delete guest data on our servers. On iOS, the device identifier may stay the same even if you reinstall the app.
• On Android, app data may be included in your Google account backup, depending on your device settings.

• In the contact form we receive your first name, last name, email address, subject and message, and for security your IP address and browser information. Your message is forwarded to us via Gmail and you receive an automatic reply.
• This data is kept to answer your request and keep the correspondence history; we delete it if you ask.
• The form has a separate, optional marketing permission box. If you leave it unticked, we use your details only to answer your request. If you tick it, your email address and name are added to our announcement list; you can withdraw this permission at any time by emailing mindscaleai@gmail.com.

Under the GDPR (if you are in the EU/EEA) and Art. 11 KVKK (if you are in Türkiye), you have the right to:

• Learn whether we process your data and, if so, obtain information and a copy (access)
• Learn the purposes of processing and whether the data is used in line with them
• Know the third parties, in Türkiye or abroad, to whom your data is transferred
• Have incomplete or incorrect data corrected (you can also change your display name in the app yourself)
• Have your data erased or destroyed
• Ask us to inform the third parties to whom data was transferred about a correction or erasure
• Object to a result against you arising solely from automated analysis
• Object to processing based on legitimate interests
• Ask us to restrict processing (GDPR)
• Receive your data in a structured, commonly used format (portability, GDPR) — there is no self-service export tool yet; we fulfil such requests by email
• Withdraw your consent at any time (this does not affect processing carried out before the withdrawal)
• Claim compensation if you suffer damage from unlawful processing
• Lodge a complaint with a data protection authority

• Email your request to mindscaleai@gmail.com. If possible, write from the email address registered to your ScoreLab account; for guest data, include your device details.
• State your name, your request and how we can reach you. We may ask for additional information to verify your identity.
• We respond within 30 days at the latest, free of charge as a rule.
• If you are not satisfied with our answer, you can lodge a complaint with the data protection authority of your EU/EEA country or, in Türkiye, with the Personal Data Protection Board (KVKK Kurulu).

ScoreLab is for users aged 18 and over. We do not verify age and do not knowingly process data of anyone under 18. If you believe someone under 18 is using ScoreLab, email mindscaleai@gmail.com and we will delete the related data.

• Traffic between the app, the website and our servers is encrypted (HTTPS).
• Your password is held by Firebase Authentication, not by us.
• Codes and links sent by email are stored by us only as one-way hashes, are single-use and expire quickly.
• Email addresses are masked in account event logs; sign-in tokens, codes and passwords are not written to these logs.
• Access to admin tools is restricted to authorised persons.
• No method guarantees complete security. If a data breach occurs, we will inform you and the competent authority as required by law.

• The version and last-updated date of this notice are shown at the top of the page.
• We announce significant changes in the app.
• For account holders, the version of the texts confirmed at sign-up or sign-in is recorded on the account.

MindScale

mindscaleai@gmail.com

Contact form: https://scorelab.live/en/contact

https://scorelab.live