Privacy Policy

This Privacy Policy explains how Face Off (“we”, “our”, “us”) handles personal information when you use the Face Off mobile app and website (the “Service”). It is written to comply with the South African Protection of Personal Information Act 4 of 2013 (POPIA), and where applicable, the EU General Data Protection Regulation (GDPR) and similar legislation in your country. By using the Service you agree to the practices described here.

1. Information we collect

We collect the minimum information needed to run a predictions contest:

• Account data: handle, display name, email address, date of birth (used to confirm you meet the minimum age), password hash (we never store passwords in plain text), and your assigned role.
• Sign-in identity: if you sign in with Google or Apple, we store the identifier returned by that provider and the email address it shares with us. We do not receive your social-graph or contacts.
• Predictions and group activity: the picks you submit, the groups you join, messages you post inside a group, invites you create, and the leaderboard positions that result.
• Device data: app version, device model, OS version, and (if you opt in) a push-notification device token so we can send group reminders and lock-in alerts.
• Server logs: request timestamps, IP address, and HTTP path. Used to operate and secure the Service, then deleted on a rolling basis.
• Analytics & usage data: we use Google Firebase Analytics (Google Analytics for Firebase / GA4) to understand how the Service is used. This records app opens, sign-up and sign-in events, and key in-app actions — such as submitting a fixture prediction, a Quick Pick swipe, or a season / tournament pick, and creating, joining or sharing a group — together with your account identifier, the platform you are on (iOS, Android or web), and a coarse region inferred from your IP address. It does not capture the content of your messages.

We do not collect precise location, contacts, microphone, camera, photo library, calendar, or health data. Sport fixtures and results are sourced from a third-party data provider and are not personal data.

2. How we use information

• To create and authenticate your account, including via Google / Apple sign-in.
• To run group leaderboards and score predictions fairly.
• To send transactional notifications you opt in to (group reminders, lock-in alerts, invite notifications).
• To measure feature usage and overall product performance through aggregated analytics, so we can improve the Service.
• To diagnose errors, prevent abuse, and improve the product.

We do not sell your personal information, we do not use your data to train machine-learning models, and we do not run targeted advertising inside the Service. Our analytics are used only to understand and improve how the Service works.

3. Legal basis

We process your data on the basis of (a) your consent (when you create an account, accept this Policy, and opt in to push notifications), and (b) our legitimate interest in operating a fair, functional predictions service.

4. Sharing

We do not sell your personal information. We share data only with operators (third-party service providers) we need to run the Service, under data-processing agreements:

• Cloud hosting (servers, database, storage).
• Email delivery for transactional messages.
• Push-notification delivery via Google Firebase Cloud Messaging (FCM), which routes messages to Apple devices (through Apple’s APNs) and Android devices — if you have opted in.
• Product analytics via Google Firebase Analytics (GA4), to measure feature usage and improve the Service.
• Google and Apple, when you choose to sign in with them.
• The official app stores (Apple App Store, Google Play) for downloads and crash reports they collect on our behalf.

Inside a private group, your handle, display name, predictions, and leaderboard standing are visible to other members of that group only. They are not public outside the group.

5. Data retention

We keep personal information only as long as we need it:

• Account data — for as long as your account is active.
• After you delete your account — we erase your personal data from our live systems within 30 days. Encrypted backups that may still contain it are rotated out within a further 35 days.
• Server logs (including IP addresses) — retained for up to 90 days for security and abuse-prevention, then deleted.
• Records we are legally required to keep (for legal, audit, or fraud-prevention purposes) — retained only for as long as the relevant law requires.
• Anonymised, aggregated statistics that can no longer identify you — may be kept indefinitely.

6. Your rights

You may at any time:

• Access the personal data we hold about you.
• Correct inaccurate information from inside the app.
• Export your predictions and group activity by emailing support@faceoff.co.za.
• Delete your account at any time directly in the app (Me → Edit profile → Delete account), or by emailing support@faceoff.co.za — full instructions on our Account Deletion page.
• Withdraw consent to push notifications from your device settings at any time.
• Object to direct marketing at any time (POPIA Section 11(3)). Marketing emails are opt-in only and never sent without your consent; you can opt out from Email preferences in the app, the unsubscribe link in any marketing email, or by emailing us.
• Lodge a complaint with the South African Information Regulator (inforegulator.org.za) or, if you are in the EU, your local data-protection authority.

7. Children

Face Off is not intended for children under 13. Users in the European Union must be at least 16 unless their country’s local law sets a lower age of digital consent and a parent or guardian has authorised the account. We do not knowingly collect data from children below these thresholds; if you believe a child has registered, contact us and we will delete the account.

8. Security

Passwords are hashed with industry-standard algorithms (bcrypt). Connections to our servers use HTTPS / TLS. Backups are encrypted at rest. We restrict employee access to production systems on a need-to-know basis and review it regularly.

Data breaches. If a security compromise affects your personal information, we will notify you and the South African Information Regulator as soon as reasonably possible after we become aware of it, as required by POPIA Section 22. Our notice will explain what happened, what data was involved, and the steps you can take to protect yourself.

9. International transfers

Our servers are operated by reputable cloud providers and may be located outside South Africa or the European Union. Where we transfer personal data internationally, we use appropriate safeguards (such as the EU Standard Contractual Clauses and the protections of POPIA Section 72) to keep your information protected.

10. Changes to this policy

We may update this Policy from time to time. Material changes will be highlighted in the app before they take effect. The “Last updated” date at the top of this page always reflects the current version.

11. Contact & Information Officer

Face Off’s Information Officer is responsible for how we handle personal information under POPIA. To exercise any of your rights — access, correction, deletion, or objecting to direct marketing — or for any privacy question, email our Information Officer at support@faceoff.co.za.