Privacy Policy
Last updated: September 28, 2026
This Privacy Policy describes how DURBAY OTOMOTİV MİMARLIK İNŞAAT TİCARET LİMİTED ŞİRKETİ ("we", "us") handles your information in the Rotascore mobile application and on rotascore.com.
Information We Collect
- Account information. If you choose to sign in (with Apple or Google), we receive your name, email address and a unique user ID through Firebase Authentication. Creating an account is optional.
- Favorites and preferences. Teams, leagues, players and matches you follow, and your notification preferences, so we can sync them across your devices when you are signed in.
- Device push token. A token issued by Apple/Google so we can deliver the notifications you request (for example goal alerts).
- Approximate location (country). We derive your country from your IP address to show you a relevant default feed (for example local leagues). We never collect your precise location.
- Usage and diagnostics data. Anonymous interaction events, crash logs and performance data (via Google Firebase Analytics and Crashlytics) that help us fix bugs and improve the app. When website analytics is active on rotascore.com, Google Analytics also processes page paths, referring pages, browser/device information, approximate location (country or region) derived from your IP address and interaction data. This data is not linked to your Rotascore account. App analytics is controlled in Settings → Privacy; website analytics and advertising are controlled through “” on the website (see Cookies & Similar Technologies).
- Website advertising data. When website advertising is active on rotascore.com, the Meta Pixel (Meta) and the TikTok Pixel (TikTok) may process your IP address, browser/device information, the addresses of the pages you view and the page that referred you, clicks on our App Store and Google Play buttons, and cookie or pixel identifiers. We use this to measure our advertising campaigns and to show more relevant ads, including on Meta and TikTok services. Meta and TikTok may combine this data with other information they hold about you and use it for their own purposes as independent controllers under their own privacy policies. This data is not linked to your Rotascore account.
- App-install attribution. When app analytics is enabled, Kochava processes app-install and session data, device and app information, approximate location derived from IP address, and campaign/referrer information to help us measure which ads lead to installs. We do not send your Rotascore account ID to Kochava. You can turn app analytics off in Settings → About. On iOS, permission for cross-app tracking is managed separately by Apple's ATT prompt.
- Advertising and device data. Google Mobile Ads and its mediation partners Pangle (the TikTok for Business ad network), Liftoff Monetize, Unity Ads and InMobi may process your IP address and country-level location, user/device or advertising identifiers, advertising data, product interactions, ad impressions/clicks, crash data, and diagnostic or performance data to deliver, measure and protect ads. Depending on your region and choices, ads may be personalized or limited/non-personalized. On iOS, access to the advertising identifier for cross-app tracking is requested separately through Apple's App Tracking Transparency (ATT) prompt.
- Support requests. If you submit the in-app Support form, we receive the contact email, category and message you enter, your account ID, app and operating-system version, platform and language, and up to five screenshots you optionally select. Opening the form does not send this data. We do not ask for passwords, verification codes, payment-card details or identity documents.
- Match chat. If you use match chat in the app, we process your nickname, account ID, the messages you send and when you send them, the reports and blocks you make, and moderation records (removed messages, mutes and bans). Message text is checked by automated moderation, including the OpenAI moderation service, and may be reviewed by moderators. Translation of chat messages happens on your device. Messages are deleted when the room closes, 24 hours after the match ends; see the Chat Rules for how moderation works and how long moderation records are kept.
What We Do NOT Do
- We do not sell your personal data.
- We do not require you to allow cross-app tracking to use Rotascore; if you decline, the app continues to work and Google serves ads without access to the IDFA.
- We do not collect your precise location or contacts, access your photo library beyond the single image you explicitly select for a support request, or read messages outside the text you submit in that form.
How We Use Information
- To provide live scores, statistics and the features you use;
- To deliver the notifications you opt in to;
- To sync your favorites across devices (signed-in users);
- To personalize your default content by country;
- To diagnose crashes and improve performance and quality;
- To investigate and respond to support requests you submit;
- To fund the free service by delivering, measuring and preventing fraud in advertising, subject to your consent and privacy choices.
Legal Bases for Processing (GDPR)
Where the EU/UK GDPR applies, we process your personal data on the following bases: your consent (for personalized advertising, advertising cookies/identifiers, analytics and diagnostics where consent is required, and for optional push notifications); performance of a contract (to provide account sign-in, cross-device sync, support you request and the features you request); and our legitimate interests in operating, securing, debugging and improving Rotascore and in delivering limited/contextual advertising and preventing ad fraud where permitted, balanced against your rights and freedoms. You may withdraw consent or object at any time as described under "Your Rights".
Service Providers
We use a small number of providers to operate and fund the app and website: Google Firebase (authentication, push notifications, app analytics, crash reporting — Firebase privacy), Google Tag Manager and Google Analytics (website measurement, governed by Google Consent Mode as described under Cookies & Similar Technologies — Google privacy), Meta Pixel (website advertising measurement — Meta privacy policy), TikTok Pixel (website advertising measurement — TikTok privacy policy (EEA/UK/CH), other regions), Google AdMob / Google Mobile Ads and User Messaging Platform (advertising, consent collection, measurement and fraud prevention — how Google uses information from partner apps), Pangle / TikTok for Business (privacy policy), Liftoff Monetize (privacy policy), Unity Ads (privacy policy) and InMobi (privacy policy) as AdMob mediation advertising partners for ad delivery, measurement and fraud prevention, other advertising partners disclosed in our consent message, Apple Push Notification service (iOS notifications and Live Activities), Resend (delivery of support notification emails, including the contact email, request text, technical details and selected screenshots), and our own hosting providers for application data. Advertising providers may act as independent controllers for their own advertising purposes as described in their policies and in the partner list shown in the in-app privacy message. If Rotascore is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction; we will notify you of any change in ownership or use of your data.
International Data Transfers
Our providers (including Google, Meta, TikTok, Pangle/TikTok, Liftoff, Unity, InMobi, Apple, OpenAI, Cloudflare and Resend) may process data on servers outside your country, including in the United States and the European Union. From the EEA or the UK to a country without an adequacy decision, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses and the equivalent measures under the UK GDPR. From Turkey, transfers follow Article 9 of the KVKK as amended by Law No. 7499 (in force since 1 June 2024) and the Regulation on transfers of personal data abroad: a processing condition under Article 5 or 6 must apply and (i) the Personal Data Protection Board must have issued an adequacy decision for the country or sector, or, failing that, (ii) one of the appropriate safeguards in Article 9(4) must be in place — such as the standard contract published by the Board, which is notified to the Personal Data Protection Authority within five business days of signature, binding corporate rules, or a written undertaking approved by the Board — and you must be able to exercise your rights and seek effective remedies in the destination country. Only where neither is available, and only occasionally, may data be transferred in one of the cases listed in Article 9(6), for example with your explicit consent after being informed of the possible risks. See the KVKK Privacy Notice and the Explicit Consent Text.
Cookies & Similar Technologies
rotascore.com uses essential browser storage (cookies and local storage) for sign-in, security, and your language, theme, favourites and privacy choices. It is always on because the website cannot work without it. Our Cookie Policy lists each cookie and similar technology by name, provider, purpose and duration.
Optional categories. Under “” on the website you control two optional categories separately: Analytics — Google Analytics, loaded through Google Tag Manager (for example the _ga cookies); and Advertising — the Meta Pixel (for example the _fbp cookie), the TikTok Pixel (for example the _ttp cookie) and Google advertising storage.
EEA, United Kingdom and Switzerland. If you visit from the European Economic Area, the United Kingdom or Switzerland — or if we cannot determine your region — analytics and advertising stay off until you allow them. We show a consent panel where you can accept all, reject all or choose each category. Until you choose, Google Consent Mode keeps analytics and advertising storage set to “denied” (no analytics or advertising cookies are written and no measurement is sent), and the Meta Pixel is not loaded. Google Tag Manager itself loads on every page to apply these settings. We determine your region from the country that our network provider (Cloudflare) derives from your IP address; we only keep a yes/no flag for the current browser session.
Browser privacy signals. If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we treat analytics and advertising as refused, whatever your region or earlier choices.
Changing your choice. You can change or withdraw your choices at any time under “”. Withdrawing stops further measurement and advertising from that point; cookies already set can be deleted in your browser settings. Withdrawal does not affect processing carried out before it.
Data Retention & Deletion
Account data is kept while your account is active. In our primary support system, screenshots are deleted no later than 180 days after submission and no later than 30 days after the request is resolved. Resolved support messages and their operational history are deleted after 12 months; spam records are deleted after 30 days. Notification copies in our restricted support mailbox and at Resend are retained only as needed to handle the request and meet legal obligations, subject to provider backup and secure-deletion cycles. Deleting your account also deletes its linked support requests and attachments from our primary support system. You can request deletion of related email copies by emailing us at [email protected]. Anonymous diagnostics data is retained for a limited period by our providers and then deleted automatically.
Your Rights
Depending on where you live (including under the EU/UK GDPR, US state privacy laws and the Turkish KVKK), you have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data; restrict or object to certain processing; receive your data in a portable, machine-readable format (data portability); withdraw consent; and opt out of the sale/sharing or use of personal data for targeted advertising where applicable. We do not sell personal data for money. Use the in-app advertising privacy choices entry point when shown, the applicable consent/privacy message, or email us at [email protected]. On iOS, you can also deny or revoke tracking permission in iOS Settings. Withdrawing consent does not affect processing carried out before withdrawal. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. We respond to rights requests within the legally required period and free of charge. You may also lodge a complaint with your supervisory authority — in the EU/EEA your national Data Protection Authority, in the UK the Information Commissioner's Office (ICO), and in Turkey the Personal Data Protection Authority (KVKK).
Children
Rotascore is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us so we can delete it.
Changes
We may update this policy from time to time. We will post the updated version on this page and update the date above. Material changes will be communicated in the app.