Privacy Policy
BallPicker is a skill-based sports guessing game. This policy explains what personal information we process, why, how long we keep it, and what rights you have. We do not sell your data, we do not run advertisements, and we do not use advertising or analytics trackers.
Who is responsible for your data: BallPicker is created by Van Malder Studio and operated by Xander Van Malder, Belgium. For any privacy question or to exercise your rights, contact info@vanmalderstudio.be.
What we collect
- Account information: your name, username, email address, password (stored only as a secure hash), and whether your email has been verified. We also record when you accepted these terms.
- Profile information: your profile picture (if you upload one), your chosen sport, and your chosen app theme.
- Gameplay data: your guesses and their coordinates, scores, XP, rank, badges, streaks, tournaments and challenge packs you play, and your daily challenge history.
- Friends data: your friend code, friend requests you send or receive (including declined ones), and your friend connections.
- Notification data: if you enable notifications, a push notification token for each device, the device platform (iOS/Android), when it was last seen, your notification preferences and your timezone.
- Security data: when you log in or verify your email we store a hashed one-time code together with the IP address and browser/app user agent used, to detect abuse. These records are short-lived.
How we use it, and our legal basis
- Running your account and the game (accounts, gameplay, scores, leaderboards, tournaments, friends) — necessary to provide the service you asked for (contract).
- Security and abuse prevention (login codes, IP/user-agent records, rate limiting) — our legitimate interest in keeping accounts and the game fair and secure.
- Push notifications (daily and tournament reminders, friend and game updates, occasional announcements from us) — based on your consent, given through your device permission and the in-app notification settings. You can withdraw it at any time.
- Email verification and password resets — necessary to operate and secure your account.
What other players can see
BallPicker is a social game, so some of your information is visible to other signed-in players:
- Your username, profile picture, rank, XP, badge count and aggregate game statistics (such as tournaments played, number of guesses, total and average score, and daily challenge history) appear on leaderboards and on your player profile, which any signed-in player can view. The name you entered and your email address are not shown to other players.
- Players you share your friend code or QR code with can send you a friend request.
- Your email address is never shown to other players, and neither is your friend code, your push notification token, or any of your security data.
Push notifications
If you allow notifications, we store a push notification token linked to your account for each device, along with the platform and when it was last used. We use it to send daily and tournament reminders, friend and gameplay updates, and occasional service announcements from us.
- You can turn notifications off at any time in the app's notification settings or in your device settings.
- If you opt out of announcements, we do not send you optional announcements.
- Push tokens are never shown to other users, never included in your data export, and never sold or shared for marketing.
- Delivering a notification necessarily discloses it to the push infrastructure operated by Expo and by Apple (APNs) or Google (FCM).
Camera, photos and clipboard
- The camera is used only when you choose to scan a friend's QR code. Nothing is recorded, stored or uploaded, and the camera is never used in the background. You can always type a friend code by hand instead.
- Photo library access is used only when you choose to upload a profile picture.
- The clipboard is used only to copy your own friend code when you tap "Copy". The app never reads your clipboard.
Who we share data with
We do not sell your personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf:
- Hetzner Online GmbH, Germany — hosting of the application and database.
- Expo — push notification delivery, together with Apple Push Notification service and Google Firebase Cloud Messaging.
- Brevo (Sendinblue SAS), France — delivery of verification, login and password-reset emails. For each email Brevo receives your email address and the message, including any one-time code or reset link. It records delivery events such as delivered or bounced and, where enabled, opened or clicked. We use these only to check that account emails arrive, never for marketing.
- Zxcs B.V., Netherlands — hosting of our mailbox, including any email you send to our support address, and backup delivery of account emails if Brevo is unavailable.
- Apple App Store / Google Play — app distribution and, where applicable, TestFlight beta testing.
Where a provider processes data outside the European Economic Area, that transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Account and gameplay data: until you delete your account (see below).
- Push notification tokens: removed when you log out (where your device can reach our servers), when you remove the device, on account deletion, and automatically after about 90 days of inactivity.
- Login and email verification codes: they expire within minutes and the records, including the IP address and user agent, are purged automatically.
- Account emails at Brevo: the delivery record and a copy of the message are kept for up to 30 days, then deleted.
- Friend requests: kept until your account is deleted, including requests you have declined.
- Backups: retained for a limited period and then overwritten.
Deleting your account
You can delete your account at any time from the Profile screen in the app, using the Delete account option at the bottom.
Please read this carefully, because it is not a complete erasure. When you delete your account we immediately:
- revoke all your login sessions and remove your push notification registrations and notification settings;
- delete your profile picture, your friend code, your friend connections and all your friend requests;
- replace your name, username and email address with anonymous placeholders and scramble your password, so the account can never be logged into again.
What remains: your gameplay history — guesses, scores, XP, badges, tournament results and tournaments you created — is kept in anonymised form, no longer linked to any identifying information, so that other players' leaderboards, tournaments and results stay intact. It appears as "Deleted User". If you need this residual data erased as well, contact us at info@vanmalderstudio.be and we will handle it manually.
Your rights
Under the GDPR you have the right to access, correct, delete, restrict, object to and port your personal data, and to withdraw consent at any time. In the app you can:
- Access / port: download a machine-readable export of your data from the app. The export excludes security material such as password hashes and raw push tokens.
- Correct: update your profile details.
- Withdraw consent: turn off notifications at any time.
- Delete: delete your account as described above.
For anything else, email info@vanmalderstudio.be. You also have the right to lodge a complaint with your national data protection authority.
Children
BallPicker is not intended for children. You must be at least 16 years old to create an account, and you confirm this when you register. If you believe a child below that age has created an account, contact us at info@vanmalderstudio.be and we will remove it.
Challenge images
All challenge images used in BallPicker are managed and uploaded by the BallPicker team via the admin panel. If you believe any image infringes your rights, please contact us at the address below.
Changes to this policy
If we make significant changes we will update the date at the top of this page and, where appropriate, notify you in the app.
Contact
Questions about this policy or your data? Email us at info@vanmalderstudio.be.