FOOTBALL APPTITUDE LTD ("we", "us", "our"), a company registered in England and Wales (company number 17185338, registered office 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX), operates the Football Apptitude mobile application (the "App") on Android (Google Play) and iOS (Apple App Store). This Privacy Policy explains what information is collected, how it is used, and your choices regarding that information.
Information We Collect
Access codes: To use the App you must enter an access code. How you receive that code depends on how you obtain access. For free, ad-supported access, and for subscriptions purchased through Apple In-App Purchase or Google Play Billing, the code is issued to you directly within the App. For subscriptions purchased through our website, where payment is processed by Stripe, the code is sent to you by email. Your email address is used to deliver your access code but is not retained by us. We do not collect or store your name, telephone number, or physical address on any of these paths.
Access credentials: Your access code is stored securely on your device using Android EncryptedSharedPreferences or the iOS Keychain, depending on your platform. It is used solely to authenticate your data requests and to verify your subscription status, and is sent to our servers over HTTPS with each request. We do not issue you a password, and we do not store your access code anywhere other than in our database, as described below.
Free, ad-supported access: If you use the App without a paid subscription, the App generates a random install identifier for your device and sends it to our server, which issues a free access code so that access can be managed. The install identifier and the access code are pseudonymous; they are not linked to your real-world identity.
Device verification: When you obtain free, ad-supported access, the App verifies that the request comes from a genuine device running an unmodified copy of the App, in order to prevent automated abuse of the free tier (for example, scripts mass-generating free access codes). On Android this uses the Google Play Integrity API; on iOS it uses Apple's DeviceCheck. A short-lived attestation token generated on your device is transmitted to our server and validated with Google or Apple respectively. The token attests only to the integrity of your device and the App. It is not linked to your identity and is not retained after validation. No device verification is performed for paid subscribers.
Advertising: The App is available on a free, ad-supported basis as well as through a paid, ad-free subscription. If you use the free version, advertisements are supplied by Google AdMob (part of Google LLC). To display them, the Google Mobile Ads SDK accesses your device's advertising identifier (on iOS, the Identifier for Advertisers, or "IDFA"; on Android, the Advertising ID) together with limited technical and interaction data, such as advertisements shown, taps, approximate (coarse) location, and diagnostic information. This data is collected and processed by Google in accordance with Google's own privacy policy, and may be used to serve personalised advertising, including across other companies' apps and websites. Paid subscribers are not shown advertisements, and this data is not collected from them. Before any personalised advertising identifier is used, we present a consent request through Google's User Messaging Platform; in the United Kingdom and the European Economic Area you are asked to consent to, or decline, personalised advertising, and on iOS Apple's App Tracking Transparency prompt is shown in addition. If you decline, advertisements are still shown but are non-personalised. You may change or withdraw your choice at any time using the "Ad privacy options" control on the Sync screen.
Subscription and payment information: The App offers a free, ad-supported tier and a paid, ad-free subscription. The current price of a subscription is shown to you at the point of purchase and may vary depending on the platform through which you subscribe.
On iOS, payment is processed by Apple via In-App Purchase. On Android, payment is processed by Google Play Billing. Apple or Google collects your payment details during checkout, subject to their own privacy policies; we do not collect or store your payment card details. Our database (Google Cloud Firestore) stores your access code, subscription status, account type, and platform, together with the store identifiers needed to verify and manage your subscription: for Apple subscribers, the product identifier and the Apple transaction identifier (the originalTransactionId).
For Google Play subscribers, the product identifier, the order identifier, the purchase token, and the application package name.
Alternatively, you may subscribe through our website, where payment is processed by Stripe. In that case Stripe collects your email address and payment details during checkout, subject to Stripe's privacy policy. Your email address is used to send you an access code, via our transactional email provider, Resend. You may then use this code to sign in to either the iOS or the Android app. We do not collect or store your email address, payment card, or billing details. For website subscriptions, our database stores only your access code, subscription status, account type, and your Stripe customer and subscription identifiers.
Subscription status: We monitor whether your subscription is active in order to grant or revoke access to premium, ad-free features. Your subscription status (active, expired, etc.) is checked when you log in. This check is performed against our servers and does not involve sharing your information with any additional third parties.
How We Use Your Information
We use the information described above for the following purposes:
To authenticate you and maintain your session.
To retrieve football statistical data on your behalf.
To generate comparison, form, and simulation results within the App.
To display advertisements to users of the free, ad-supported version.
We do not sell or rent your personal information, and we do not send marketing emails. The only email you will receive from us is your access code, sent when you subscribe through our website. For users of the free, ad-supported version, your device's advertising identifier and related advertising data are shared with Google AdMob for the purpose of displaying advertisements, as described in the "Advertising" section above and subject to your consent choices. This is the only circumstance in which information is shared with a third party for advertising purposes, and it does not apply to paid subscribers.
Football Data and the Match Simulator
The App displays football statistics (player and team comparisons, form, and match results) that are retrieved from our data service (Google Cloud Run) over HTTPS. No personal data is transmitted in these requests beyond your access code, which is sent solely to authenticate the request.
The App also includes a Match Simulator. When you run a simulation, the following data is transmitted from the App to our simulation service (Google Cloud Run) over HTTPS:
Fixture details: the home team, the away team, the league, and the season.
Your selected line-ups for each team: player names and positions (for example, "Salah", "Forward"), together with any adjustments you make to a player, such as an influence setting or an estimated number of minutes.
Your access code, which is sent solely to authenticate the request.
The service returns statistical parameters (per-player scoring rates and related figures). The simulation itself is then run locally on your device, and the results are stored only on your device so that you can review them later. Simulation results are not transmitted back to us or to any third party, and no record of your simulations is retained on our servers. When a simulation finishes, the App shows a notification generated locally on your device.
Notifications
The App may show you notifications generated locally on your device, for example when a simulation is complete. The App also integrates Firebase Cloud Messaging, which registers a notification token with Firebase (Google); this token is stored securely on your device (Android: EncryptedSharedPreferences; iOS: the system Keychain). You can grant or revoke notification permission at any time in your device settings without affecting any other App functionality.
Third-Party Services
The App uses the following third-party services, each of which may collect limited technical data in accordance with its own privacy policy:
Apple App Store and StoreKit: Apple processes in-app purchase payments on iOS and collects your Apple ID and payment details during checkout. We do not receive your Apple ID or your payment details; we obtain only the product identifier and a transaction identifier (the originalTransactionId), with which we verify and manage your iOS subscription status. Apple's privacy policy is available at https://www.apple.com/legal/privacy/.
Google Play Billing: Google processes subscription payments on Android and collects your payment details during checkout. We receive only the product identifier, the order identifier, the purchase token, and the application package name, with which we verify and manage your subscription status. Google's privacy policy is available at https://policies.google.com/privacy.
Google AdMob (the Google Mobile Ads SDK and the User Messaging Platform): AdMob displays advertisements to users of the free, ad-supported version and manages advertising consent. It may collect your device's advertising identifier (the IDFA on iOS, or the Advertising ID on Android), your approximate (coarse) location, advertising and product interaction data, and crash and performance diagnostics, in order to serve and measure advertisements, including personalised advertising across other applications and websites where you have consented. AdMob is not used for paid subscribers. Google's advertising privacy information is available at https://policies.google.com/technologies/ads.
Google Firebase (Cloud Messaging): Firebase enables the App's notifications and may collect device identifiers automatically. Firebase's privacy information is available at https://firebase.google.com/support/privacy.
Google Cloud (Cloud Run and Firestore): Google Cloud hosts the services that retrieve football data, run simulations, and store access codes and subscription status. No personally identifiable information is stored, and no personal data is included in data or simulation requests beyond your access code. Google Cloud's privacy notice is available at https://cloud.google.com/terms/cloud-privacy-notice.
Stripe: Stripe processes subscription payments made through our website and collects your email address, payment card details, and billing information during checkout. This information is held by Stripe and is subject to Stripe's privacy policy. We do not store your email address, your payment card details, or your billing information; our database retains only Stripe customer and subscription identifiers, for the purpose of subscription management. Stripe's privacy policy is available at https://stripe.com/privacy.
Resend: Resend sends our transactional emails, such as the message containing your access code after you subscribe through our website. Your email address is passed to Resend solely for the delivery of that email and is not retained in our systems. Resend's privacy policy is available at https://resend.com/legal/privacy-policy.
Squarespace: Squarespace hosts our website and may collect limited analytics data about website visitors. Squarespace's privacy policy is available at https://www.squarespace.com/privacy.
Google Play Integrity (Android): When you obtain free, ad-supported access on Android, the App sends a short-lived integrity token to the Google Play Integrity API so that we can confirm the request comes from a genuine device running an unmodified copy of the App, as described in the "Device verification" section above. The token attests only to the integrity of your device and the App; it is not linked to your identity and is not retained after validation. Google's privacy policy is available at https://policies.google.com/privacy.
Apple DeviceCheck (iOS): When you obtain free, ad-supported access on iOS, the App generates a short-lived DeviceCheck token that we validate with Apple in order to confirm the request comes from a genuine Apple device, as described in the "Device verification" section above. The token attests only to the integrity of your device; it is not linked to your identity and is not retained after validation. Apple's privacy policy is available at https://www.apple.com/legal/privacy/.
Permissions
The App requests only those permissions that are necessary for it to function, and it does not access any sensitive device features.
On Android, the App declares the following permissions:
Internet, in order to sign you in, to fetch football data, and to run simulations.
Network State, in order to check device connectivity before making network requests.
Notifications (POST_NOTIFICATIONS), in order to show you notifications on Android 13 and later, for example when a simulation is complete. You may grant or decline this permission without affecting any other functionality of the App.
Advertising ID (AD_ID). For users of the free, ad-supported version, this allows Google AdMob to access your device's advertising identifier in order to serve advertisements, subject to your consent choices. Paid subscribers are not shown advertisements.
On iOS, the App requires network access in order to sign you in, to fetch football data, and to run simulations. For users of the free, ad-supported version, the App additionally requests permission, through Apple's App Tracking Transparency framework, to use your device's advertising identifier for personalised advertising; should you decline, advertisements continue to be shown but are not personalised.
On neither platform does the App request access to your camera, microphone, contacts, photographs, precise location, or any other sensitive device feature.
Data Security
All network communication between the App and our services is transmitted over HTTPS. Your access code is stored in encrypted form on your device, using Android EncryptedSharedPreferences or the iOS Keychain.
On Android, this encrypted credential store is explicitly excluded from both cloud backup and device-to-device transfer, so your access code is never copied off your device; after you restore or set up a new device you simply sign in again. Other data stored locally by the App, such as saved simulation results, may be included in your device's standard backup to your own Apple or Google account, where you have enabled device backup, and restored to the App on a new device. Any such data remains under your control, is accessible only to you and the App, and is not transmitted to us or to any third party.
Subscription Management
If you subscribed on iOS: Your subscription is managed through Apple. To cancel it, open your Apple Account settings and select Subscriptions. Cancellation takes effect at the end of the current billing period, and for refunds you should contact Apple Support directly.
If you subscribed on Android: Your subscription is managed through Google Play. To cancel it, open the Google Play Store and select Subscriptions.
If you subscribed through our website: Your subscription is managed through Stripe. You may cancel it through the Stripe customer portal, or by contacting us at cancel@footballapptitude.com. Please include your access code, together with the email address that you used to sign up, so that we can locate your subscription.
On every platform, if your subscription lapses your access to premium, ad-free features will be revoked, but any data stored locally on your device will remain until you uninstall the App or clear its data.
Data Retention and Deletion
Your access code is removed from your device when you log out. Data stored locally on your device, such as saved simulation results, is deleted when you clear the App's data in your device settings or uninstall the App. Your access code and the associated subscription data held in our database may be deleted upon request. To request the deletion of your account, please contact us using the details below, with "Data Deletion" in the subject line. Payment and billing records held by Apple, Google, or Stripe are subject to their own retention policies.
Beta Testing Mailing List
We may collect your email address through our Squarespace website if you voluntarily sign up to take part in beta testing of the App. Your email address will be used solely to contact you about the beta test programme, for example to provide access instructions, to report known issues, or to request feedback. It will not be used for marketing, for newsletters, or for any other purpose, and it will be permanently deleted once the beta testing period concludes. You may request removal from the mailing list at any time by contacting us at the address given below.
Children's Privacy
The App is not directed at anyone under the age of eighteen, or under the applicable age of digital consent in your jurisdiction. We do not knowingly collect information from children, and the advertising shown in the free version is not directed at children. If you believe that a child has provided information through the App, please contact us, and we will take steps to delete it.
Tracking and App Tracking Transparency (iOS)
The free, ad-supported version of the App uses advertising provided by Google AdMob, which may use your device's advertising identifier (the IDFA) to serve personalised advertisements, including across other companies' applications and websites. Under Apple's definition, this constitutes tracking.
On iOS, we therefore present Apple's App Tracking Transparency prompt, and you may grant or deny permission. If you grant permission, advertisements may be personalised using your advertising identifier. If you deny permission, advertisements are still shown to you but are not personalised, and your advertising identifier is not used for tracking.
In the United Kingdom and the European Economic Area, we additionally present a consent request through Google's User Messaging Platform, in accordance with the UK and EU GDPR and the ePrivacy Directive. You may change or withdraw your advertising choices at any time using the "Ad privacy options" control on the Sync screen.
Paid subscribers are not shown advertisements, and no advertising identifier or tracking is used in respect of them.
Apple App Store and Google Play Disclosures
We make the following disclosures in accordance with Apple's App Privacy requirements and Google Play's Data Safety section:
From all users, the App collects only an access code and an install identifier, and these are used solely for authentication and access management. From users of the free, ad-supported version, Google AdMob may additionally collect the device advertising identifier (the IDFA or Advertising ID), advertising interaction data, product interaction data, coarse location, and crash and performance diagnostics.
The App does not collect your name, email address, telephone number, physical address, payment information, precise location, browsing history, contacts, photographs, or health data. None of the data collected is linked to your real-world identity, as your access code, your install identifier, and your advertising identifier are all pseudonymous.
For users of the free, ad-supported version, the device advertising identifier is used for tracking, in the form of personalised advertising served through Google AdMob, subject to your consent and to your App Tracking Transparency choices. No data is used for tracking in respect of paid subscribers.
Certain third-party providers may also collect data in their own right. Google AdMob may collect the advertising identifier and related advertising data from users of the ad-supported version; Firebase may collect device identifiers automatically; Stripe collects your email address and payment information during website checkout; and Resend processes your email address for the delivery of transactional email.
Gambling and Betting Disclaimer
The App provides football statistical analysis, comparison, and simulation tools only. It does not facilitate, process, or handle any betting transactions or payments, and it is not a gambling service.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page, with an updated effective date. Your continued use of the App after such changes constitutes your acceptance of the revised Policy.
UK GDPR and Data Protection Rights
FOOTBALL APPTITUDE LTD is the data controller for any personal data that we process in connection with the App. We are subject to the UK General Data Protection Regulation (the UK GDPR) and to the Data Protection Act 2018. Where users are located in the European Economic Area, the EU GDPR also applies.
Lawful basis for processing
Performance of a contract: We process your access code and subscription status in order to fulfil our contractual obligation to provide you with access to the App.
Legitimate interests: We retain store and Stripe subscription identifiers in order to manage the subscription lifecycle, for example cancellations, renewals, and the revocation of access, where to do so does not override your privacy rights.
Consent: Where you use the free, ad-supported version, we rely on your consent, which is obtained through Google's User Messaging Platform and, on iOS, through Apple's App Tracking Transparency framework, to use your device's advertising identifier for personalised advertising. You may withdraw this consent at any time using the "Ad privacy options" control on the Sync screen, and doing so does not affect the lawfulness of any processing carried out before its withdrawal.
Third-party processors: Apple, Google, and Stripe process payment information as payment providers under their own terms. Stripe and Resend process your email address, where you subscribe through our website, as data processors under contracts that incorporate GDPR-compliant standard contractual clauses.
Data we hold directly: Our database (Google Cloud Firestore) stores only your access code, your install identifier, your subscription status, your account type, your platform, the relevant store or Stripe subscription and order identifiers, your Apple transaction identifier (the originalTransactionId, for iOS subscribers), and short-lived per-user rate-limit counters. We do not hold your name, email address, postal address, or payment details.
Your rights under the UK GDPR and the EU GDPR
To the extent that they are applicable, you have the following rights in respect of your personal data:
Right of access: You may request a copy of the personal data that we hold about you.
Right to rectification: You may request that inaccurate personal data be corrected.
Right to erasure: You may request the deletion of your personal data where there is no lawful reason for us to continue to hold it.
Right to restriction: You may request that we restrict the processing of your data in certain circumstances.
Right to data portability: You may request your data in a machine-readable format where the processing is based upon the performance of a contract.
Right to object: You may object to processing that is based upon our legitimate interests.
Right to withdraw consent: Where processing is based upon consent, you may withdraw that consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at admin@footballapptitude.com, and we will respond within one month.
For data held by Apple, Google, Stripe, or Resend, you will need to contact those providers directly.
You also have the right to lodge a complaint with the Information Commissioner's Office (the ICO) in the United Kingdom, at www.ico.org.uk, or with your local supervisory authority if you are in the European Economic Area.
International Data Transfers
The App's backend services are hosted on Google Cloud infrastructure in Europe, in the europe-west2 (London) region. Some of the third-party providers described in this Policy, including Google, Apple, Stripe, and Resend, may however store or process data on servers located outside the United Kingdom and the European Economic Area, including in the United States.
Where personal data is transferred outside the United Kingdom or the European Economic Area, we and our providers rely on transfer mechanisms that are recognised as providing an adequate level of protection under the UK GDPR and the EU GDPR. These include the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum, the standalone International Data Transfer Agreement, or, where applicable, an adequacy decision. This ensures that your data continues to receive an equivalent level of protection wherever it is processed.
Contact Us
If you have any questions about this Privacy Policy, or if you wish to request the deletion of your account, please contact us at admin@footballapptitude.com.
