Version 1.0 — Last updated: 2026-07-26
1. Who we are
Ballon ("Ballon", "we", "us", "our") is a premium, social sports-prediction platform where users predict football (and, over time, other sports) results and build an earned reputation among friends and leagues. The service is provided as a website and progressive web app at ballonleague.com (the "Service").
The Service is operated by Ballon League sp. z o.o. (in formation), a limited liability company being registered in Kraków, Poland ("the Company"). Registered address, NIP and KRS details will be updated upon registration.
For the purposes of the EU General Data Protection Regulation (GDPR) and the Polish Personal Data Protection Act, Ballon is the data controller of the personal data described in this policy — meaning we decide why and how your personal data is processed.
Contact for privacy matters: privacy@ballonleague.com
2. Who can use Ballon (age)
Ballon is intended only for users aged 18 and over. We do not knowingly create accounts for, or collect personal data from, anyone under 18. If we learn that we hold data about a person under 18, we will delete it.
3. What data we collect, why, and our legal basis
We minimise what we collect. The categories below reflect the data the Service actually processes.
- Account and identity — your email address and authentication identifiers. If you sign in with Google, we receive your Google email and basic profile per your Google consent. Passwords (for email sign-in) are stored hashed by our authentication provider — we never see or store your plaintext password. Processed to create and secure your account and let you log in. Legal basis: contract (Art. 6(1)(b)).
- Profile — display name, country, and any avatar or banner image you upload, powering your public profile, leagues, and reputation. Legal basis: contract; images are optional.
- Gameplay and reputation — your predictions, league memberships, leaderboard standings, reputation tier and achievements, follows, rivalries, and activity-feed entries, used to operate the core prediction, scoring, leaderboard, and social features. Legal basis: contract.
- Push notifications — a device push token (via Firebase Cloud Messaging) if you enable notifications, used to send match reminders and result/standing alerts you opt into. Legal basis: consent (Art. 6(1)(a)).
- Service emails — your email address, used to send account/service emails (e.g. verification, password reset) and — if enabled — a weekly recap. Legal basis: contract for service email; consent or legitimate interest for the recap.
- Technical and security — IP address (processed transiently for rate-limiting and abuse prevention), plus diagnostic/error data (via Sentry) which may include IP, device/browser type, and technical context, used to keep the Service secure, prevent abuse, and diagnose errors. Legal basis: legitimate interests (Art. 6(1)(f)) — securing and maintaining the Service.
- Usage analytics — aggregated, cookieless usage metrics (via Vercel Analytics). No cookies and no personal identifiers are used; visitors are counted via a non-reversible hash. Legal basis: legitimate interests (Art. 6(1)(f)).
We do not sell your personal data, and we do not currently run advertising or behavioural tracking. If we introduce advertising or paid subscriptions in future, we will update this policy first and, where required, ask for your consent — see §11.
4. Where your data comes from
Most data comes directly from you (when you register, build a profile, make predictions, or upload an image) or is generated by your use of the Service (standings, reputation, activity). Sign-in identity may come from Google if you choose Google sign-in. Sports data (fixtures, teams, scores) comes from a third-party sports-data provider (API-Football / API-Sports) and is not your personal data.
5. Who we share data with (processors)
We do not sell data. We share it only with vetted service providers ("processors") who process it on our behalf and under contract to run the Service. Our processors are:
- Supabase — database, authentication, and image storage.
- Vercel — application hosting, serverless functions, scheduled jobs, and cookieless analytics.
- Google Firebase Cloud Messaging — delivery of push notifications you opt into.
- Google (Sign-in) — authentication if you choose Google sign-in.
- Sentry — error and performance monitoring.
- Twilio SendGrid — sending service emails.
- Upstash — rate-limiting infrastructure (abuse prevention).
We may also disclose data where legally required (e.g. a valid legal request from an authority), or to establish, exercise, or defend legal claims, or to protect the rights and safety of users and the public.
6. International transfers
Several of our processors are based in, or store data in, the United States or other countries outside the European Economic Area (EEA). Where your personal data is transferred outside the EEA, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework — together with a signed Data Processing Agreement (DPA) with each processor.
7. How long we keep data
We keep personal data only as long as needed:
- Account, profile, gameplay, and reputation data: for as long as your account is active. Reputation and prediction history are core to the product and are retained while your account exists.
- After account deletion: your account is anonymised immediately — your identity becomes "Deleted user" and your predictions are retained in anonymised form so league history and standings stay intact for other members. Your personal data (email, profile details, images, push tokens) is deleted, and copies held in backups are purged within 7 days.
- Support correspondence: kept for up to 12 months after your request is resolved, then deleted.
- Technical/error logs: retained for up to 90 days, then deleted.
- Push tokens: removed when you disable notifications or the token becomes invalid.
8. Your rights
Under the GDPR you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time (e.g. turn off push notifications) without affecting prior processing.
To exercise any right, contact privacy@ballonleague.com. You can also delete your account in-app (Settings → Account) at any time. We respond within one month (extendable by two months for complex requests), and we do not charge a fee unless a request is manifestly unfounded or excessive.
You have the right to complain to your local data protection authority. In Poland, this is:
Urząd Ochrony Danych Osobowych (UODO) ul. Moniuszki 1A, 00-014 Warszawa, Poland — uodo.gov.pl
9. How we protect your data
We apply appropriate technical and organisational measures, including: Row-Level Security (RLS) in our database so users can only access their own and permitted data; owner-only access to email (email is never exposed publicly, only display-name/avatar/country via a restricted public-profile view); encryption in transit (HTTPS); passwords hashed by our authentication provider; isolation of privileged ("service-role") operations behind server-side authorisation checks; and rate-limiting to deter abuse. No online service can be 100% secure, but we work to protect your data and will notify you and the UODO of a personal-data breach where legally required.
10. Cookies and similar technologies
Ballon uses only essential cookies required to keep you logged in and secure your session (set by our authentication provider). Our analytics are cookieless. Because we set no non-essential cookies and run no advertising or cross-site tracking, we do not currently display a cookie consent banner. Full detail is in our separate Cookie Policy. If we add non-essential cookies or advertising in future, we will implement a consent banner first.
11. Changes to this policy
We may update this policy as the Service evolves (for example, if we add subscriptions or advertising). We will post the new version here with an updated date and, for material changes, notify you by email or in-app. Introducing advertising, behavioural tracking, or new data uses will be reflected here before those features go live.
12. Contact
Questions or requests: privacy@ballonleague.com — general support: support@ballonleague.com
Ballon League sp. z o.o. (in formation), Kraków, Poland. Registered address, NIP and KRS details will be updated upon registration.