Reference translation.

Privacy Policy — Rival Score

Version 1.0 — effective from October 28, 2026
Address of this policy: https://rivalscore.net/privacidade/en

1. Who we are

Rival Score is a free football scores app (the "app"), offered by:

Martech Consultoria Empresarial LTDA
CNPJ 12.815.687/0001-00

Martech is the controller of the personal data processed in the app, that is, the party that decides how and for what purposes that data is used.

Data Protection Officer (encarregado, DPO): privacidade@rivalscore.net

This policy explains what data the app collects, for what purpose, with whom we share it, how long we keep it and how you exercise your rights. It applies to the app on iOS and Android and to our support channels. There is no web version of the app.

2. Summary

• You can use the whole app without creating an account. We create an anonymous identifier on first use to keep your favorites and preferences.
• An account (Apple, Google or email) is optional and is used to sync your favorites across devices. When you create an account, you provide your first name, last name and email (prefilled by Apple or Google; with email sign-in, only the email is prefilled) and, if you wish, your mobile number.
• News by email and WhatsApp only with your permission, separate from the account and off until you turn it on, and only for users aged 18 or older. You can unsubscribe at any time, in the app or in each message.
• Location, notifications and campaign measurement (on iPhone, the tracking permission) only work with your permission, which you can withdraw at any time.
• The app does not show ads. Only if you declare you are 18 or older and give the campaign measurement permission (on iPhone, also the tracking permission), the app sends Meta (Facebook and Instagram) and TikTok the device advertising identifier and some usage events, and Google starts using the advertising identifier and usage data in its advertising products, to measure and improve the campaigns we use to promote Rival Score. We never send them your name, email or mobile number (section 3.5).
• We do not sell your data.
• The data is stored mainly on Google Cloud servers in São Paulo; some Google services and, if you allow campaign measurement, Meta and TikTok process data outside Brazil (section 7).
• To erase your data: More › Clear app data, More › Delete account or by email at privacidade@rivalscore.net (section 9).

3. Data we collect and how we use it

3.1 Data you give us or that the app creates in order to work

We ask that you do not write personal data in feedback beyond what is necessary.

3.2 Device data, with your permission

Location is processed on the device itself: the system converts the approximate position into a country and region, which are used only on screen. Neither the coordinates nor the country or region are sent to our servers.

3.3 Data collected automatically

3.4 What we do not collect

• Precise location or background location.
• Contacts, photos, camera, microphone, files or calendar.
• The SIM or device phone number on our own: your mobile number only reaches us if you type or pick it (section 3.6).
• Date of birth or ID documents (CPF, DNI, RUT, CURP, etc.).
• Payment data: the app is free and has no purchases.
• Sensitive personal data (health, religion, political opinion, racial or ethnic origin, biometrics, etc.).
• Browsing history outside the app.
• Terms typed in search: they stay only on the device (recent searches) and are not sent to Analytics or to our servers.

3.5 Campaign measurement: Meta, TikTok and advertising identifiers

We promote Rival Score with ads on Facebook, Instagram, TikTok and other apps and websites. To learn which campaigns bring in users and improve those campaigns, the app includes the Meta SDK (Facebook) and the TikTok Business SDK. They are only turned on, and only receive data, if you declare you are 18 or older and accept campaign measurement and, on iPhone, if you also tap "Allow" on the iOS tracking prompt. Otherwise, these SDKs stay off, collect nothing, and nothing is sent to Meta or TikTok.

• Only for users aged 18 or older: before the measurement step, the app asks "Are you 18 or older?", with the answers Yes and No. We do not ask for a date of birth or an ID: your age is a declaration. If you answer "No", campaign measurement stays off: the Meta and TikTok SDKs stay off, Google's advertising signals stay denied and, on iPhone, the tracking prompt is never shown. The answer is stored only on the device and erased in More › Clear app data; in More › Privacy, turning measurement on asks the same question first.

• What we never send to Meta or TikTok: your name, last name, email, mobile number, account identifier, favorites or location. We do not use "advanced matching" (sending email addresses or phone numbers, even hashed) and do not build audiences from profile data.
• Role of Meta and TikTok: the data is processed under the Meta Business Tools Terms and the TikTok Business Products (Data) Terms. When measuring our campaigns, these companies process the data for us; for their own purposes (for example, delivering and measuring ads, improving their own advertising systems and keeping their services secure), they act as independent controllers or, in part, as joint controllers with us, as set out in each company's terms, and they are responsible for that use under their own policies: Meta Privacy Policy and TikTok Privacy Policy.
• Google: with the same permission (and, on iPhone, the tracking permission), Google Analytics for Firebase starts using advertising signals and the device advertising identifier (IDFA on iPhone, AAID on Android) in Google's advertising products, such as Google Ads, to measure and improve Rival Score's campaigns (section 3.3). Without it, Analytics is limited to usage statistics, and those signals stay denied.
• iPhone: without the tracking permission, iOS does not give the IDFA to the app, the Meta and TikTok SDKs stay off and we do not track you across other companies' apps and websites. Apple may still tell ad platforms, in aggregate and without identifying you, that a campaign led to installs (SKAdNetwork/AdAttributionKit). The IDFV is also only read with your permission and we do not send it to third parties.
• Android: you can delete or reset the advertising ID in Settings › Google › Ads or Settings › Privacy › Ads (the path varies by manufacturer). With the ID deleted, the app receives a zeroed-out value and does not send it. In addition, the app asks for your consent on first use, as on iPhone, and only reads the AAID and the Android ID, and only turns on the Meta and TikTok SDKs, if you accept.
• How to withdraw your permission: turn it off in More › Privacy › Campaign measurement: the app stops sending events to Meta and TikTok right away, and the SDKs stop completely the next time you open the app. On iPhone, you can also deny tracking in Settings › Privacy & Security › Tracking; on Android, delete or reset the advertising ID. Withdrawing applies to future sending and does not change anything else in the app.
• Data already sent: Meta and TikTok keep what they received for the periods set in their own policies (section 6). You can use these companies' privacy tools (for example, "Your activity off Meta technologies" in your Meta account settings) and, if you ask us to delete your data, we will pass the request on to them (section 9).
• We do not sell this data and the app does not show ads.

3.6 Account profile and news by email and WhatsApp

• The account is optional. Without an account, the whole app works and we do not ask for your name, email or mobile number. The account is for users aged 14 or older (section 11).
• Email sign-in (sign-in link): you enter your email in the app and we send it, through Firebase Authentication / Google Identity Platform (sender noreply@rivalscore.net), a single-use sign-in link that is valid for a short time. When you tap the link on your phone, the app opens and signs you in, with no password. The email is stored on the device only until sign-in is complete, to finish the link.
• First name, last name and email are required to create an account and are prefilled with what Apple or Google provide; with email sign-in, only the email (the same one that received the link) is prefilled, and you type your first and last name. If you chose to hide your email with Apple, we use the relay address, and Apple forwards the messages to your real email; you can turn off that forwarding in your Apple Account settings.
• Mobile number is optional. On Android, when you tap the field, Google may show the device's numbers for you to pick one (Phone Number Hint); on iPhone, the keyboard may suggest your number. The app only receives the number you pick or type and does not read the SIM on its own. We do not send verification SMS: check the number before saving.
• The profile is stored in the app's database (Firestore), on Google Cloud in São Paulo (southamerica-east1), linked to your account identifier. Only you, through the app, and authorized staff have access.
• News and communications from Rival Score (for example, new features, competitions and app campaigns) are only sent with your permission, given separately for each channel: email and WhatsApp. Both options are off by default, are not a condition for creating an account, and WhatsApp requires a mobile number. News is only for users aged 18 or older: each option says "I am 18 or older and want to receive news by email" (or "by WhatsApp"), and by turning it on you declare that age. We keep the date and time of each choice.
• Unsubscribing is as easy as subscribing: turn them off in More › Edit profile or write to privacidade@rivalscore.net. Every news email and every news WhatsApp message includes a way to unsubscribe. Unsubscribing applies to future messages and does not affect your account. If we need to contact you about the account itself (for example, to handle a request from you), that does not depend on this permission.
• WhatsApp: when messages are sent, they go through Meta's WhatsApp Business platform, which receives your number and the message content as a processor (section 5).
• We do not sell the profile, do not share it with advertisers and do not use it for third-party advertising or to combine it with other companies' data.

4. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects or significantly affect you. The ordering of leagues and favorites on screen is a simple personalization, based on your choices and your approximate region.

5. Who we share data with

We do not sell, rent or trade your personal data. It is only shared with:

Sports data (scores, lineups, statistics) comes from specialized providers, such as Sportmonks. These providers do not receive users' personal data: the app only queries our servers.

6. How long we keep data

After these periods, the data is erased or anonymized (with no reasonable possibility of identifying you).

7. International transfer

Our main servers are in the Google Cloud region in São Paulo (southamerica-east1). Some Google services used by the app — sign-in, notifications, usage statistics and App Check — are global and may process data in the United States and other countries where Google maintains infrastructure. If you use the app outside Brazil, your data is transferred to Brazil, where Martech is located. The account profile is stored in São Paulo; if you allow news by WhatsApp, when messages are sent, Meta processes the number and the message in the United States and other countries where it maintains infrastructure. If you allow campaign measurement, Meta, TikTok and Google's advertising products process the data described in section 3.5 in the United States and other countries where these companies maintain infrastructure.

These transfers follow art. 33 of the LGPD (Lei 13.709/2018, Brazil's General Data Protection Law) and Resolução CD/ANPD nº 19/2024, on the basis of standard contractual clauses incorporated into the contracts with our processors, and the transfer rules of the other countries in section 10. The clauses are in the Google Cloud and Firebase Data Processing Addendum, accepted by Martech, and in Meta's and TikTok's data terms, accepted when using these companies' measurement tools.

8. Security

• All communication between the app and the servers is encrypted in transit (TLS).
• The data is encrypted at rest on Google Cloud infrastructure.
• Each user can only read and change their own favorites, preferences and account profile (database access rules, tested).
• App Check blocks calls that do not come from the original app.
• Internal access is restricted to those who need it, with individual accounts and access logging; keys and passwords are kept in a vault (Secret Manager), never in the code.

No system is completely immune to failures. If there is a security incident that may cause you relevant risk or harm, we will notify the ANPD and the affected data subjects within the deadlines of the LGPD (art. 48) and Resolução CD/ANPD nº 15/2024.

9. Your rights and how to exercise them

Under the LGPD (art. 18), you can request at any time:

1. confirmation that we process your data;
2. access to the data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
5. portability of the data to another provider;
6. deletion of data processed on the basis of your consent;
7. information about whom we share the data with;
8. information about the possibility of not giving consent and the consequences;
9. withdrawal of consent;
10. objection to processing based on legitimate interest, in case of non-compliance with the law;
11. review of automated decisions (the app does not make decisions of this kind).

How to exercise them

In the app

• More › Clear app data: erases the favorites, preferences and notifications stored on the device as well as the anonymous identifier's data on the server, and cancels the notification token and alert subscriptions. If you signed in with Apple, Google or email, this option only signs the account out of this device; to delete it, use More › Delete account.
• More › Delete account (for those who signed in with Apple, Google or email): erases the account, the profile, the synced favorites, the data linked to it on the server and the alert subscriptions.
• More › Edit profile: corrects your first name, last name, email and mobile number, and turns news by email and by WhatsApp on or off. Turning them off withdraws consent right away.
• More › Privacy: turns location and campaign measurement on and off. Turning measurement off stops sending to Meta and TikTok (completely from the next time you open the app) and turns off Google's advertising signals (section 3.5).
• More › Notifications: chooses which alerts to receive; the notification permission is in the system settings.
• System settings: location, notifications, tracking (iOS) and advertising ID (Android).

By email or on the web

• Write to privacidade@rivalscore.net with your request. If you used the app without an account, include the code shown at the bottom of the More screen ("Your ID"), so we can locate your data.
• Account deletion request on the web: https://rivalscore.net/excluir-conta/en.
• Data that Meta and TikTok have already received: you can exercise your rights directly with these companies, through the channels in their privacy policies (section 5). If you ask us to delete your data, we will pass the request on to them so that they do the same (art. 18, §6º, of the LGPD).
• To stop receiving news, you can also use the unsubscribe link or option included in each message.
• We may ask you to confirm your identity before handling the request, to protect you.
• We reply within 15 days (art. 19, II, of the LGPD) or within the shorter period required by the law of your country.
• Handling requests is free of charge.

If you are not satisfied, you can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) (Brazil's National Data Protection Authority) — www.gov.br/anpd — or with the authority of your country (section 10).

10. Users outside Brazil

We process the data of all users with the same level of protection described in this policy. In addition to the LGPD, we observe the data protection laws of the countries where the app is offered:

• Argentina — Ley 25.326 de Protección de los Datos Personales and the rules of the Agencia de Acceso a la Información Pública (AAIP). You can exercise the rights of access, rectification, updating and deletion; access is free of charge at intervals of no less than six months, unless there is a legitimate interest. "La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales." The account profile is based on the contractual relationship with you (art. 5, 2, d); news by email and WhatsApp and campaign measurement with Meta and TikTok (section 3.5), on your prior, express and informed consent (art. 5), and you can ask at any time for your data to be removed or blocked from the mailing lists (art. 27, 3).
• Chile — Ley 19.628 sobre Protección de la Vida Privada and, once it takes effect, Ley 21.719, which creates the Agencia de Protección de Datos Personales. You can exercise the rights of access, rectification, deletion, objection and, where applicable, portability and blocking. The account profile is based on the performance of the contract with you; news by email and WhatsApp and campaign measurement with Meta and TikTok (section 3.5), on your consent, which you can withdraw at any time. Every news email identifies the sender and includes an address to request that the messages stop (Ley 19.496, art. 28 B).
• Peru — Ley 29.733 de Protección de Datos Personales and its Reglamento (Decreto Supremo 016-2024-JUS). You can exercise the rights of information, access, rectification, cancellation and objection with us and file a complaint with the Autoridad Nacional de Protección de Datos Personales. The account profile is based on the contractual relationship with you (art. 14, 5); news by email and WhatsApp and campaign measurement with Meta and TikTok (section 3.5), on your prior, informed, express and unequivocal consent (art. 13, 5), which you can withdraw at any time.
• Mexico — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). You can exercise your ARCO rights (access, rectification, cancellation and objection) and withdraw your consent by email at privacidade@rivalscore.net. You can also file a complaint with the Mexican personal data protection authority that is competent under the 2025 law. Primary purposes, necessary for the account: identifying you, helping you recover access and syncing favorites. Secondary purposes, not necessary for the account or for using the app: sending you news by email and WhatsApp, only if you turn it on; and measuring and optimizing Rival Score's campaigns, only if you accept campaign measurement. For the latter, with your consent and your declaration that you are 18 or older, we transfer the data described in section 3.5 to Meta, TikTok and Google. You can refuse or withdraw them at any time in More › Edit profile (news), in More › Privacy (campaign measurement) or by email at privacidade@rivalscore.net, without losing the account or access to the app.

In case of conflict, the rule that is most protective of the data subject and mandatory in your country of residence prevails.

11. Children and adolescents

Rival Score is not directed to children under 13 and we do not knowingly collect data from children. If you are a parent or guardian and believe that a child has used the app and provided us with data, write to privacidade@rivalscore.net and we will erase the data.

When adolescents use the app, we process their data in their best interest (art. 14 of the LGPD). In line with the Estatuto Digital da Criança e do Adolescente (Brazil's Digital Statute of Children and Adolescents, Lei 15.211/2025): the app does not show ads, we do not create profiles for advertising, campaign measurement (Meta, TikTok and Google's advertising signals) is only for users who declare they are 18 or older, and device identifiers are only read, and only sent to Meta, TikTok and Google, with that declaration and consent (section 3.5); the content is rated for all ages (4+) and the app is intended for users over 13.

The account and the profile are for users aged 14 or older, and news by email and WhatsApp and campaign measurement are only for users aged 18 or older. We do not ask for a date of birth: when you create an account, you declare that you are 14 or older (Terms of Use, section 1); when you turn on news or answer "Yes" to the campaign measurement age question, you declare that you are 18 or older. If we learn that an account belongs to someone under 14, we delete the account and the profile; if we learn that news was turned on by someone under 18, we turn it off. The news is only about Rival Score: we do not send third-party advertising.

12. Third-party links and services

"Where to watch" may mention TV channels and streaming services. If you open a link to a third-party website or app, their privacy policy applies.

13. Changes to this policy

We may update this policy to reflect changes in the app or in the law. We will let you know in the app and, if the change is significant or requires new consent, we will ask for your confirmation. The effective date at the top indicates the current version; previous versions are sent on request by email to privacidade@rivalscore.net.

14. Contact

• Privacy and Data Protection Officer: privacidade@rivalscore.net
• Support: suporte@rivalscore.net