Privacy Policy

Last Updated: October 4, 2026

1. Introduction

xGolazo (“we,” “our,” or “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application.

2. Information We Collect

2.1 Personal Information You Provide:

• Name (for account creation)
• Phone number (for account creation and verification)
• Profile information (position, country, city)
• Team and match data you create
• Messages and communications
• Photos and profile pictures you upload

2.2 Automatically Collected Information:

• Device information (model, operating system)
• App usage data and analytics
• IP address and location data (with permission)
• Performance and error logs
• Push notification tokens

2.3 Information from Third Parties:

• Firebase authentication data
• Cloud storage synchronization data
• If you sign in with Google or Apple: your name and email address from that account (with Sign in with Apple you can choose to hide your email)

2.4 Live Streaming (Go Live):

• When you film a match with Go Live, the phone that films uses its camera and microphone to send video and sound of the match to your YouTube channel. The live score is added on the phone.
• xGolazo does not record or keep the video or sound. It goes straight to YouTube and is handled under your YouTube channel settings and Google’s Privacy Policy.
• Camera and microphone are used only while the filming screen is open, and only after you allow them.

2.5 People Added by a Team (Guest Players):

• A team admin can add someone who does not use xGolazo yet as a guest player, so their matches can be recorded. The admin gives a name and, if they choose, a phone number, and may do this only with that person’s permission.
• We store the guest’s name and an irreversible fingerprint of the phone number (a keyed hash), plus its last two digits so the team admin can recognise it. We do not store the number itself.
• We never call, text or message a guest’s number. We use the fingerprint only to ask the owner of that number, after they sign up and verify it, whether the guest is them. Nothing moves to their account unless they say yes.
• On public match and tournament pages a guest is shown by first name and last initial, or as “Guest” if the team chooses.
• A guest, or their parent or guardian, can ask us to delete or anonymise the guest by writing to the address in section 13. When a guest is removed from a team, its number fingerprint is deleted.

3. How We Use Your Information

We use your information to:

• Provide and improve our app services
• Create and manage your account
• Enable team creation and match tracking
• Facilitate connections with other players
• Send important notifications and updates
• Analyze app usage and performance
• Prevent fraud and ensure security
• Comply with legal obligations

4. Information Sharing

We DO NOT sell your personal information. We may share information:

4.1 With Other Users:

• Your profile information in team contexts
• Match statistics and performance data
• Public leaderboards and rankings

4.2 With Service Providers:

• Cloud hosting (Railway, Firebase)
• Crash reporting and analytics (Firebase Crashlytics, Firebase Analytics)
• Image storage (Cloudinary)
• Push notifications (Firebase Messaging)

4.3 For Legal Reasons:

• To comply with laws and regulations
• To respond to legal requests
• To protect our rights and safety

5. Data Storage and Security

5.1 Data Storage:

• Data is stored on secure cloud servers (Railway, Firebase)
• Data is backed up regularly for reliability

5.2 Security Measures:

• Secure HTTPS connections for all data transmission
• Regular security audits and updates
• Access controls and authentication
• Data encryption at rest and in transit

6. Your Privacy Rights

6.1 Access and Control:

• View and update your profile information
• Delete your account and associated data
• Control notification preferences

6.2 Data Export:

• Request a copy of your personal data by contacting us at [email protected]
• We will provide your data within 30 days of your request

6.3 Data Deletion:

• Delete your account at any time via Settings → Delete Account
• Request specific data deletion
• Data is permanently removed within 7 days of account deletion

7. Children's Privacy

xGolazo is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

Players under 18 may appear in matches that an organiser films with Go Live. Organisers are responsible for having the permission of each player (or a parent or guardian for minors) before filming. YouTube sets its own minimum age for live streaming.

Team admins must not add a child as a guest player without the permission of a parent or guardian.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable privacy laws.

9. Data Retention

We retain your information only as long as necessary to:

• Provide our services
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Account data is deleted within 7 days of account deletion unless required by law.

10. Local Storage and Tracking

We use secure on-device storage and similar technologies to:

• Maintain your login session via authentication tokens
• Remember your preferences
• Monitor app stability via Firebase Crashlytics
• Analyze app usage via Firebase Analytics
• Improve user experience

When you open a public match or tournament page in a web browser, we set one cookie, xg_vid. It holds only a random ID, so a browser that reloads the page is counted once, and it expires after one year. It is not used for advertising. If cookies are blocked, we count the visit with a shortened one-way hash of your network address and browser type, and store only that hash.

You can manage stored data by clearing the app's data in your device settings or by deleting your account.

11. YouTube and Google Data (YouTube API Services)

xGolazo uses YouTube API Services to stream matches to your YouTube channel. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and Google’s use of your data is covered by the Google Privacy Policy.

• What we store when you connect YouTube: your YouTube channel ID and channel name, and a sign-in token from Google, which we keep encrypted (AES-256).
• How we use it: only to create, start and end the live streams you start from xGolazo, and to check whether live streaming is turned on for your channel. We do not read your videos, comments, subscribers or other YouTube data.
• Sharing: we do not sell this data, use it for advertising, or share it with anyone other than Google/YouTube.
• Revoking access: you can revoke xGolazo’s access at any time in your Google Account at security.google.com/settings/security/permissions. Streaming from xGolazo then stops until you connect again.
• Deletion: when you delete your xGolazo account we revoke the Google token and delete your stored channel details and token.

11a. Third-Party Services

Our app integrates with third-party services:

• Firebase (Google) — Authentication, crash reporting, analytics, push notifications
• Cloudinary — Image storage and processing
• Railway — Database and hosting
• RevenueCat — Subscription and payment processing
• Groq — AI-powered match analysis and insights
• Google Places — Location search and city selection
• Apple — Sign in with Apple
• Sentry — Server error monitoring
• YouTube (Google) — Live streaming of matches to your YouTube channel (YouTube API Services)

These services have their own privacy policies, which we encourage you to review.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted in the app with an updated effective date. Significant changes will be communicated via in-app notification.

13. Contact Us

For privacy-related questions or requests:

• Email: [email protected]

14. Legal Basis for Processing (GDPR)

We process your data based on:

• Consent: When you agree to data processing
• Contract: To provide app services
• Legitimate Interest: To improve and secure our services
• Legal Obligation: To comply with applicable laws

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.