Privacy Policy

Effective from: 10 May 2026

1. Controller

The controller of the TipLeague mobile app (the “App”) and the tipleague.fun website (the “Website”) is:

Name / Company: okto.digital s.r.o.
Address: Bulharská 139, 821 04 Bratislava — Ružinov district, Slovak Republic
Email: maros@oktodigital.com

This Policy describes what personal data we process, for what purposes, on what legal basis, and what rights you have as a user.

2. What data we process

2.1 Data you provide at registration and while using the App

Data	Purpose	Legal basis
Email	Registration, sign-in, support, important notices	Performance of a contract (Art. 6(1)(b) GDPR)
Username	Display in groups and leaderboards	Performance of a contract
Password (stored as a bcrypt hash)	Authentication	Performance of a contract
PIN (bcrypt hash, optional)	Quick sign-in	Performance of a contract
Avatar (optional)	Profile	Consent
Predictions, scores, statistics, group memberships	App functionality	Performance of a contract

2.2 Data generated by use

Session tokens (stored in MariaDB and in expo-secure-store on the device) — authentication
Achievements, trophies, XP, level — calculated from your activity
Notification logs — a record of sent push notifications
IP address and request headers — kept in server logs (rotated max. 30 days), used for security and debugging

2.3 Data for push notifications

Device push token (OneSignal Player ID) — so we can send you a notification about an upcoming prediction deadline or an entered result.

2.4 Biometric data (Face ID / Touch ID)

We do NOT process or store biometrics anywhere outside your device.
Face ID/Touch ID is verified only by the device’s operating system. The App receives only a “success / failure” response and unlocks the stored session token based on it.

3. Purposes of processing

Providing the service — registration, sign-in, saving predictions, calculating points and leaderboards.
Push notifications — deadline reminders, match results, unlocked achievements. You can turn notifications off any time in the OS settings or in the App.
Security and abuse prevention — rate limiting, error logging, protection against attacks.
Communicating with you — replying to your question, important service notices.

The App is not for placing money bets and is not a game of chance. We do not share any data with betting companies.

We do not sell or share your data with third parties for marketing purposes. Processors are exclusively the infrastructure providers we need to run the service:

Recipient	Purpose	Location	Link
DigitalOcean, LLC	Server and database hosting	EU (Frankfurt)	digitalocean.com/legal/privacy-policy
OneSignal, Inc.	Delivering push notifications (device token)	USA (Standard Contractual Clauses)	onesignal.com/privacy_policy
Apple Inc.	App distribution via the App Store	USA	apple.com/legal/privacy
Google LLC	App distribution via Google Play	USA	policies.google.com/privacy

In the future we may add further processors (e.g. RevenueCat for payments, Sentry for error tracking). In that case we will update this Policy.

5. Transfers outside the EU

Some processors (OneSignal, Apple, Google) have servers in the USA. The transfer is secured by Standard Contractual Clauses approved by the European Commission.

6. How long we keep data

Active account — for as long as you use it.
After account deletion — we delete all personal data within 30 days. An anonymised record (shown as “Deleted user”) may remain in the leaderboards of groups you were a member of, to preserve the competition history for others.
Server logs — max. 30 days.
Notification log — 90 days.

As a data subject you have the following rights:

Right of access — you can request a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — the “right to be forgotten”
Right to restriction of processing
Right to data portability — data in JSON format
Right to object to processing
Right to withdraw consent — any time, without affecting processing before the withdrawal
Right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk)

Send requests to maros@oktodigital.com. We will handle them within 30 days.

8. How to delete your account

In the App: Profile → Delete account
Or write to us at maros@oktodigital.com from the email you registered with.

9. Security

All communication goes over HTTPS / TLS 1.3
Passwords and PINs are stored as a bcrypt hash (not plain text)
Session tokens are in expo-secure-store (Keychain on iOS, Keystore on Android)
The database is on a private network, access protected by SSH keys

10. Children

The App is intended for people over 16 years of age. We do not knowingly collect data of children under 16. If you find that this has happened, write to us and we will delete the data.

11. Cookies (web)

The tipleague.fun website uses no tracking cookies. It may use technical cookies necessary to display content (e.g. theme preference). The App itself uses no cookies.

12. Changes to this Policy

We may update this Policy. For a material change we will notify you by push notification or email. The current version is always at https://tipleague.fun/privacy.

13. Contact

For any question regarding personal data protection, contact us:

Email: maros@oktodigital.com
Phone: +421 917 241 365
Address: Bulharská 139, 821 04 Bratislava — Ružinov district, Slovak Republic