Privacy policy
Last updated: 24 October 2026 · Current web service · Revision 12
1. Who is responsible
SCORESIST SPORT COMMUNITY LLC, 2001 L ST NW, Washington, DC 20036, USA, operates SCORESIST and is responsible for the personal data described here. For privacy questions or requests, contact support@scoresist.com. This notice covers the current public SCORESIST website, including www.scoresist.com.
2. What is available now
You can browse sports information as a guest and save favorites and display preferences on your device. You can also create a free, optional SCORESIST account by signing in with Google; Sign in with Apple may be added later. Signed-in members can also read and write in match and league chats, leave reactions on matches and give matches a fan rating. Pages of finished football, basketball and volleyball matches can show match videos from official YouTube channels, chosen, where we can tell it, for the country your connection appears to be in (section 3); a video loads from YouTube only when you press play (section 10). SCORESIST's own advertising, paid memberships, purchases and marketing notifications are not active in this web release; a YouTube video you start can contain YouTube's own ads (section 10). Sports notifications exist only in the mobile apps and only if you turn them on (section 7). We will update this notice before introducing processing associated with new features.
3. Browsing and technical data
Your browser sends network information needed to deliver the service, including your IP address, requested resource or API route, request time, and browser/protocol information. Requests can reveal the sport, competition, team, player, race or search you are viewing. We use this information to return results, prevent abuse and investigate faults. The API temporarily keeps IP-based request counters in memory. When the API sends the videos of a finished match, it also looks up from the IP address of that request the country you are probably in, using a geolocation database kept on our own server, and uses that country only to list the videos that YouTube allows in that country. The country is looked up again for each such request and used only to answer it: it is not saved with your account or device, not written to our logs or database, not used for anything else such as advertising, and not passed to anyone, YouTube included; we keep only hourly totals without any IP address, such as how many lookups succeeded and the share of the most common countries. The one exception is in the Android and iPhone apps: when the app registers your phone for notifications, the country found for that request is kept with the phone's registration, never the IP address (section 7). The lookup is approximate and can be wrong, for example behind a VPN, a company network or some mobile networks; where we cannot tell the country, the videos are listed as for everyone else, and YouTube's player still decides whether a video plays. IP address data is powered by IPinfo (https://ipinfo.io). Server errors can produce diagnostic logs containing request paths and error details. Do not put passwords or other sensitive information in searches or URLs.
4. Favorites and preferences
Language, selected sport, appearance, fan-mode settings and guest favorites are stored in your browser when used. Without an account they stay on your device. When you sign in, your guest favorites and saved matches move into your account and are removed from this browser's guest storage; appearance choices you made as a guest are applied to your account. To refresh your saved matches, their identifiers are sent to our API; requesting favorite entities or a fan palette also reveals those selections to the server. Local storage therefore does not mean that every related request stays on your device. We do not use these selections to build advertising profiles.
5. Your account
An account is optional. When you sign in with Google, Google gives our authentication provider, Supabase, your Google account ID, your email address, your name and a link to your profile picture. Supabase Auth keeps them, and a copy is part of the sign-in session saved on your device; they are used only to sign you in, and SCORESIST does not show your Google name or picture. Your nickname is one you choose; it is not taken from Google. Other signed-in members see it next to your chat messages. Your account also holds your synchronized favorites, saved matches and appearance settings, and Supabase Auth records sign-in times and security logs. Our use of information received from Google follows the Google API Services User Data Policy: it is used only to sign you in, and it is never used for advertising or sold.
6. Community chat, reactions and fan ratings
If you use the chat, we process your account ID, the nickname shown with your messages, the messages you write and when you wrote them, the match reactions you leave, when you accepted the community rules, the reports you make (reason, optional note and a copy of the reported message with its author's nickname), the members you block, and measures taken against your messages or account (hidden or removed messages, and chat bans with their reason, note and end). Other signed-in members see your nickname, your messages and how many members left each reaction; they do not see your account ID, your email address, or who reported or blocked whom. Messages pass an automatic filter before they are published, and a message reported by three different members is hidden automatically until a moderator reviews it. SCORESIST moderates the chat itself through its own moderation account, which sees reported messages, the reasons and notes given, and the reported member's recent messages. If you give a match a fan rating, we process the grades you give (match, atmosphere, quality of play, refereeing), the side you choose, your player of the match and when you voted, linked to your account ID; others see only the totals and averages of all votes, not who voted what. Messages are deleted within 24 hours, and a match's reactions and fan ratings within 24 hours after the match. Reports are kept for 30 days after a decision (reports about messages that no longer exist for at most 90 days), ended chat bans for 30 days and the record of moderation actions for 90 days; your block list and rules acceptance stay until you change them or delete your account.
7. Push notifications (mobile app)
In the SCORESIST apps for Android and iPhone, signed-in members can turn on notifications about their favorite teams and saved matches, such as a kick-off, a goal, a red card, a final result or highlights added for a finished match. If you turn on the optional SHOCK alert, you are also told about a surprising result developing in any football match, followed or not. If you allow them, the app registers a push token issued by Google Firebase Cloud Messaging for your phone, and we store that token with your account ID, the phone's platform and language, the app version, the time of registration and the time it was last confirmed. When the app registers your phone, and again when you open the app (at most every three hours), our API also looks up from the IP address of that request the country your phone is probably in, as described in section 3, and stores that country, a two-letter code such as DE, with the token; the IP address itself is not stored, and the app itself keeps no country, only the time it last registered or tried to. The country is used only to decide when to send a highlights notification: it comes once the match has highlights that can be watched in that country, and, where we cannot tell the country, when the first highlights arrive. Each registration replaces the country (if our lookup is briefly unavailable, the previous one stays); it is no longer used 7 days after it was found and is deleted in the next daily clean-up, or at once with the token. We keep your notification choices with your account and, for 7 days, a record of each notification sent to your phone (the event and the delivery result). Notifications are delivered by Google Firebase Cloud Messaging and, on iPhone, by the Apple Push Notification service; the text of a notification contains only the sports event. We remove the token when you sign out, delete the account, when the token becomes invalid or when the phone has not been seen for 90 days; blocking notifications in the phone settings stops them at once. The web version shows the same notification settings but never sends notifications itself. These are not marketing messages; you choose each kind of alert.
8. Support correspondence
If you email us, we process your address, message and any information you choose to send so that we can respond, handle a privacy request or resolve an issue. Share only what is needed. Never send a password, sign-in code or full payment details. We may request proportionate information to verify a privacy request, without asking for your password.
9. Purposes and legal grounds
Where GDPR applies, we rely on our legitimate interests in delivering and securing a functioning sports-information service and answering general enquiries (Article 6(1)(f)). We balance those interests against your rights. If you create an account, we process your account data to provide the account you asked for (Article 6(1)(b)); account security logs rely on our legitimate interest in protecting accounts and the service (Article 6(1)(f)). Processing needed to fulfil a request connected with a contract may rely on Article 6(1)(b); compliance with a binding legal duty relies on Article 6(1)(c). For the chat we process the data described in section 6 to provide the chat you use (Article 6(1)(b)), to filter content, handle reports and prevent abuse (Article 6(1)(f)), and to meet legal duties such as notices and statements of reasons under the EU Digital Services Act (Article 6(1)(c)). We process fan ratings to provide the vote you take part in (Article 6(1)(b)). We process your push token with the data stored with it, the phone's country included (section 7), and the record that you saved a match (section 12) to send the notifications you turned on (Article 6(1)(b)). Showing the match video card, and looking up your approximate country from your IP address so that the card leaves out videos YouTube is known to block there (section 3), rely on our legitimate interest in offering official match videos that you can actually play (Article 6(1)(f)); we use only the country, only for that request, and keep nothing about you. Where Turkish law applies, this lookup rests on the same legitimate interest under Article 5(2)(f) of the Personal Data Protection Law No. 6698 (KVKK). Pressing play is your consent, for that video only, to load it from YouTube with the data transfer and device storage described in section 10 (Article 6(1)(a) GDPR, section 25(1) TDDDG); if you do not press play, nothing is loaded from YouTube. Consent-dependent features will require a separate choice before activation. Merely visiting the site or reading this notice is not consent to advertising or optional tracking.
10. Service providers and other recipients
Google Firebase Hosting delivers the website and Google-hosted Flutter resources may be requested to render it. Railway hosts our API, and Supabase provides the service database, currently in Ireland, and the authentication service for accounts. These infrastructure providers process technical information needed to operate their services. In the chat, your nickname, messages and reaction counts are shown to other signed-in members; SCORESIST moderates the chat without an outside moderation service. If you sign in with Google, Google acts as identity provider under its own privacy policy and learns that you signed in to SCORESIST. SCORESIST uses YouTube API Services: our server reads public information about videos on official channels from YouTube and, for each video matched to a match, stores its ID, title, channel, publication time, duration and the list of countries in which YouTube allows or blocks it; it sends YouTube no information about you, and it refreshes this information or deletes it within 30 days. The video feature does not use your Google or YouTube account. Nothing is requested from YouTube before you press play, on the website or in the apps. When you do, the video loads from YouTube in its privacy-enhanced mode (www.youtube-nocookie.com): on the website in the page, and in the Android and iPhone apps in a web view inside the app (a built-in browser area that shows only this player). YouTube (Google) receives your IP address and normal browser information and learns that the video is played on SCORESIST; it may place or read cookies or similar storage on your device, in the apps in that web view's storage, and may show its own non-personalized ads in the video. The "Watch on YouTube" link opens YouTube directly; in the apps, it and any other link in the player open outside the app, in the YouTube app or your browser. YouTube processes this data under the Google Privacy Policy (https://policies.google.com/privacy). Sports images, such as club logos and player photos, can load directly from API-SPORTS or the image host specified in the sports data; that host receives your IP address and normal request metadata. Email service providers process support correspondence. Authorized people maintaining SCORESIST may access information needed for support or security. We may disclose information when legally required or necessary to establish or defend legal claims. We do not sell personal data or share it for cross-context behavioral advertising in this release. Google Firebase Cloud Messaging (Google LLC) delivers mobile notifications, and Apple Inc. delivers them on iPhone.
11. International processing
SCORESIST is a US company managed from Germany. Hosting, content delivery, support and provider operations can involve the United States and other countries outside your country or the EEA, even when the database is in Ireland. Applicable transfer safeguards depend on the recipient and service, and may include an adequacy decision or contractual safeguards such as the European Commission's standard contractual clauses. Contact support@scoresist.com for information about the arrangements applicable to your data or to request a copy of relevant safeguards. When you play a video, YouTube (Google) can process the playback data in the United States and other countries under Google's own transfer safeguards. Database location alone does not mean all processing stays in the EU.
12. How long information is kept
Device preferences and guest favorites have no fixed calendar expiry and remain until changed, removed or cleared through your browser. Account data is kept until you delete the account; deletion removes it from our active systems at once, backups are overwritten as they rotate, and Supabase Auth's security logs follow Supabase's own retention. Chat data follows the periods in section 6; deleting your account deletes your chat messages, reactions, fan ratings and block list at once, while copies in reports and the moderation record stay for those periods. Finished-match favorites stop appearing after their expiry is known, normally one hour after completion; an old local cache can remain until the next successful refresh or until you clear it. For a signed-in member, a record that you saved a match is kept while the match is in your favorites and for 7 days after the match's kick-off, even after the match stops appearing in your favorites, so that a late highlights notification can still reach you, and is then deleted in the next daily clean-up; removing the saved match deletes this record at once. Temporary API rate-limit counters are reused or cleaned up after their request window and are lost on process restart. The country looked up from your IP address (section 3) is not kept once the request has been answered, except the country kept with a phone's push registration (section 7): each registration replaces it, it is no longer used 7 days after it was found and is deleted in the next daily clean-up, and it is deleted at once with the registration; the country lists stored with each video follow the 30-day refresh or deletion described in section 10. Infrastructure logs and backups follow the relevant service configuration and retention cycles. Support and incident information is retained for the time needed to resolve the matter and meet applicable legal or dispute-handling requirements. A deletion request does not imply instant erasure from every rotating backup. Ask us about a specific record or retention period. Push tokens are removed as described in section 7; notification delivery records are kept for 7 days.
13. Your choices and requests
You can change preferences, remove favorites and clear this site's cookies and site data in your browser. Clearing site data removes local choices; it does not delete your account or a support email already sent. You can delete your account in the app under Account → Delete account, or by emailing support@scoresist.com. Depending on the law that applies, you may request access, correction, deletion, restriction or portability of personal data, and object to processing based on legitimate interests. You may withdraw any consent you have given for future processing without affecting prior lawful processing. Email support@scoresist.com; we will handle requests within the applicable statutory time limit. You can complain to a competent data-protection authority, including the authority where you live or work. For Mainz, the regional authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (datenschutz.rlp.de). These rights can have legal exceptions.
14. Young people and sensitive information
SCORESIST is intended for people aged 13 and over and is not directed at children under 13. The chat is for members aged 13 and over and has no private messages. This is an audience rule, not a claim that every country allows independent consent at 13. SCORESIST does not ask for a date of birth or perform age verification, including when you create an account. If you believe we have received personal data from a child under 13, contact us so we can assess and remove it where appropriate. We do not request precise location, contacts, camera or microphone access for the current sports-browsing service; only your approximate country is looked up from your IP address, as described in sections 3 and 7, and the apps ask for no location permission.
15. Security and changes
We use encrypted connections and access controls, but no service can guarantee absolute security. In this release SCORESIST does not use behavioral analytics, advertising identifiers or automated decisions with legal or similarly significant effects on visitors; once you start a YouTube video, YouTube's own processing follows Google's policies (section 10). Material changes to processing will be reflected here, with additional information or choices before activation where required. The date above identifies this version.