Privacy policy
Last updated: 18 October 2026
Chance is an app for private football prediction leagues. This policy explains what information we keep, why, where, and for how long. We keep only what the game needs: no ads, no tracking across apps, and we never sell information to anyone.
Data controller: the operator of Chance, Gilad Shavit, Israel. Contact: [email protected].
What we keep
Your account
- Username, display name and email address.
- Your password, if you signed up with one. It is stored only as a hash (bcrypt); we cannot read it.
- If you sign in with Google or Apple: your account identifier there and the email address they give us. If you chose Apple's "Hide My Email", we keep only Apple's relay address.
- When the account was created and when you last signed in.
- A password reset code, if you asked for one: stored as a hash, valid for a short time.
The game
- The leagues you belong to and manage: the league's name, the picture chosen from our list, its invite code, its settings and the matches you chose.
- Your guesses, your live changes (when, at what minute and for what penalty), and your points.
Technical information
- Error reports: when something fails, in the app or on the server, a report goes to Sentry: what went wrong, the device model and operating system, the app version, and your user number only. No name, no email and no request contents.
- Server logs: the server logs requests (IP address, path and time) for security and for fixing problems.
- On your device: your sign-in token is kept in the device's secure storage (Keychain or Keystore), and preferences such as the language stay on the device.
What we do not collect
Location, contacts, photos, the microphone, advertising identifiers, or your use of other apps. When you share an invite link, the app opens your device's share sheet and does not read your contacts.
Why
- To provide the service: your account, leagues, guesses, scoring and tables (performing our agreement with you).
- To send emails you asked for, such as a password reset code.
- To keep the service working and safe: error reports, server logs and rate limiting (legitimate interest).
We do not use your information for advertising, profiling or sale.
Who sees what
- Members of your leagues see your username and name, your points and your place in the table. They see your guesses only after the match has started.
- Your email address is never shown to other users.
Where your information is
| Provider | Role | Location |
|---|---|---|
| Railway | The server and the database | European Union (Netherlands) |
| Sentry | Error reports | European Union (Germany) |
| Resend | Sending email (the address and the email's content only) | A US company, sending from Ireland (eu-west-1) |
| Cloudflare | This website and the domain's DNS; the nightly database backups (R2, up to 30 days) | The website: global network; the backups: European Union (Eastern Europe) |
| Google, Apple | Sign-in with their account, only if you choose it | Under their own policies |
Match data comes from football-data.org; they receive no information about you from us. Transfers outside the European Union rely on recognised safeguards such as the European Commission's Standard Contractual Clauses.
How long
- Your account, leagues and guesses: for as long as the account exists.
- When you delete your account, it is removed from the database at once, together with your guesses and league memberships. A league you managed passes to another member, and a league where you were the only member is deleted.
- Backups: up to 30 days. Error reports and server logs: up to 30 days.
- Password reset codes expire within a short time.
How to delete: see Delete your account.
Your rights
You can view and correct your information in the app (Profile, Edit details) and delete your account at any time. You can also ask us for a copy of your information, or for correction, deletion, restriction or objection to processing, by emailing [email protected]. We will answer within 30 days. If you think we did not handle your request properly, you can complain to the Israeli Privacy Protection Authority or to the data protection authority of your EU country.
Security
Connections to the server are encrypted (HTTPS), passwords and reset codes are stored only as hashes, and access to the database is restricted. No method is perfect, but we make reasonable efforts to protect your information.
Children
Chance is not meant for children under 13, and we do not knowingly collect information about them. If we learn of such an account, we will delete it.
Changes
If we change this policy, we will update the date at the top. We will announce a material change in the app or by email.