Privacy Policy

This policy explains what data Syndikick collects, why we collect it, how long we keep it, and the choices you have. It applies to the Syndikick game (web, Android, and iOS) and to this website.

Who we are

Syndikick is operated by Velvoshopping d.o.o. (OIB 22385949140). For privacy questions, contact privacy@syndikick.app. We are the controller of the personal data described in this policy.

Data we collect

We collect only what the game needs to run your club, keep your progress, process purchases, and keep the service secure.

• Account and authentication — A user ID created by our authentication provider (Supabase), the sign-in method you use (Apple, Google, or Facebook), and the account identifier, email address, and basic profile information that the provider shares with us according to your settings and the provider's policies.
• Game profile and progress — Your club name, division, season, creds, chits, entitlements, cosmetics, squad, player cards, tactics, match orders, results, league standings, Elo rating, achievements, daily streak, facility levels, and season history.
• Purchases — Purchase and entitlement data from RevenueCat and the app store, such as the product purchased, transaction status, entitlement, and the app user ID used to deliver chits or bundles. We do not receive or store your full payment card details.
• Push notifications — If you grant notification permission, we store a Firebase Cloud Messaging (FCM) token and your platform (Android or iOS) so we can send matchday and season notifications. You can revoke permission in your device settings at any time.
• Technical and security data — IP address, device and operating system information, app version, request timestamps, and error or security logs generated when your device connects to our servers.
• Communications — If you email support, we receive your email address and the contents of your message so we can respond.

What we do not collect

We do not collect your contacts, photos, precise location, health data, or advertising identifiers. The game does not include advertising SDKs or third-party behavioral tracking. We do not sell personal data.

How we use your data

• Create and secure your account and keep your progress across devices.
• Run the game: matchmaking, league tables, match simulation, the Black Market, leaderboards, and season rewards.
• Deliver purchases, chits, and entitlements and prevent purchase fraud.
• Send matchday and season notifications when you have enabled them.
• Provide support and respond to requests.
• Monitor reliability, debug errors, prevent cheating, and protect the service.
• Comply with legal, tax, and accounting obligations.

Legal bases

Where the GDPR applies, we rely on: performance of a contract (running the game and your account); legitimate interests (security, fraud prevention, service improvement, and responding to support requests); consent (push notifications); and legal obligation (tax and accounting records). You can withdraw consent for notifications at any time without affecting the rest of the service.

Who we share data with

We use service providers that process data on our behalf and under contract. They only receive what is needed for their function.

• Supabase — Authentication, database, and backend infrastructure.
• Cloudflare — Hosting and delivery for the game API and this website.
• RevenueCat — Purchase management and entitlement verification.
• Apple, Google, and Meta — Sign-in providers for Apple, Google, and Facebook authentication, and app distribution and payment processing for in-app purchases.
• Google Firebase — Delivery of push notifications when you have enabled them.

The sign-in providers also process authentication data under their own privacy policies. We may disclose data if required by law, to respond to valid legal process, to protect the rights and safety of users or the public, or as part of a merger or acquisition. We do not sell personal data.

International transfers

Some providers process data outside the European Economic Area, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the provider's data processing terms.

How long we keep data

• Account and game data: until you delete your account or ask us to delete it.
• Purchase and tax records: for as long as required by applicable law, typically up to seven years.
• Server and security logs: typically up to 90 days, unless needed to investigate an incident.
• Support correspondence: up to 12 months after the request is closed.
• Push tokens: until you disable notifications, uninstall the app, or delete your account.
• Backups: deleted or overwritten on a rolling basis, typically within 30 days.

When an account is deleted, we retire the club and remove it from public leaderboards, delete the push tokens, and mark the profile as deleted. Some game state, league records, and transaction records may be retained for a limited period for security, dispute resolution, or legal obligations before being deleted or anonymised. Email privacy@syndikick.app if you want us to review or erase specific records.

Security

We use encrypted connections, access controls, and reputable infrastructure providers. No online service is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the competent authority where required by law.

Your rights

If the GDPR applies to you, you have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. You also have the right to lodge a complaint with a supervisory authority.

• To exercise a right, email privacy@syndikick.app. We may need to verify your identity before acting.
• You can request account deletion by email; see the deletion page for the process.
• The Croatian supervisory authority is the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, www.azop.hr.

Children

Syndikick is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact privacy@syndikick.app and we will delete it.

Cookies and the website

This website is a static site. It does not set advertising or analytics cookies and does not use third-party tracking scripts. The hosting provider may process standard request logs for security and delivery. The game does not use cookies for advertising.

Changes to this policy

We may update this policy as the game changes. We will post the new version here and update the date at the top. If a change materially affects your rights, we will provide additional notice where appropriate.

Contact

Velvoshopping d.o.o. Privacy: privacy@syndikick.app. Support: support@syndikick.app.

Company information

Syndikick is operated by Velvoshopping d.o.o.

← Back to legal overview