ZUKII Football — Privacy Policy
This Privacy Policy explains what information ZUKII Football (“the App”, “we”, “us”) collects, how we use it, and the rights you have over it. ZUKII Football is operated by Mikaël Tokotuu (“Operator”, contact: mikael.tokotuu@gmail.com).
By using the App you agree to this Policy.
1. Information we collect
We collect only what's needed to operate the App.
1.1 Information you provide
| Data | When | Purpose |
|---|---|---|
| Email address | Sign-up (email, Sign in with Apple, or Sign in with Google) | Account identification, password recovery, transactional emails (verification codes) |
| Username | Sign-up | Public display on leaderboards and pool member lists |
| First name, last name | Profile setup or auto-filled from Apple / Google on first sign-in | Display name |
| Country of nationality | Optional, profile setup | Country flag display next to your name |
| Date of birth | Optional, profile setup | Validating you meet the minimum age (13+); never displayed publicly |
| Profile picture | Optional, you upload | Display as avatar |
| Match predictions | When you predict | Core function — scoring against actual results, ranking on leaderboards |
| Pool memberships | When you join a pool | Showing you in pool leaderboards and member lists |
| Notification preferences | When you toggle settings | Honouring your preferences |
1.2 Information collected automatically
| Data | Purpose |
|---|---|
| Device push token (Firebase Cloud Messaging) | Sending push notifications you have opted into (match reminders, results, pool activity) |
Device platform (ios or android) | Routing the push token to the correct push service |
| Server logs (request times, HTTP status, error stack traces) | Detecting bugs and abuse; stored in AWS CloudWatch for 30 days, then auto-deleted |
| Client IP address (in server logs only) | Abuse prevention — e.g. detecting brute-force attempts on the sign-in endpoint |
The App does not collect: precise location (GPS), coarse location, app version, OS version, contacts, photos beyond what you explicitly upload as your avatar, microphone, health data, financial data, advertising identifiers (IDFA), or browsing history. We have no analytics SDK and no advertising SDK.
2. Third parties
The App uses these third-party services. Each has its own privacy policy linked below.
| Service | Purpose | Data shared with them |
|---|---|---|
| Apple — Sign in with Apple | Authentication | Your Apple ID identifier, full name (sent only on first sign-in, per Apple's design), and email (real or private relay — your choice in the Apple sheet). If you choose Hide My Email, we only see a @privaterelay.appleid.com address that forwards to your real email; we never see the real address. |
| Google — Sign in with Google | Authentication | Your Google account identifier, name, and email |
| Firebase Cloud Messaging (Google) | Push notifications | Device token, message payload (e.g. “Match XYZ has finished — see your score”) |
| Amazon Web Services (AWS) | Backend hosting — servers, database, image storage | All data above is hosted here, in the Sydney region |
| Amazon SES (within AWS) | Sending transactional emails (verification codes, password resets) | Your email address, subject, and email body |
| api-sports.io | Football data provider (fixtures, results, odds) | Nothing about you. They send data to us; we send them nothing except our API key. |
Native device sharing
The App offers a Share button that uses your device's built-in share sheet (Messages, Mail, third-party apps you have installed). When you tap Share, the data you choose to share is handed to the operating system (iOS / Android), not to us or our third parties. Apple's and Google's privacy policies apply to that operation.
Privacy policies of the services above
- Apple: https://www.apple.com/legal/privacy/
- Google (incl. Firebase): https://policies.google.com/privacy
- AWS: https://aws.amazon.com/privacy/
- api-sports.io: https://api-sports.io/legal
3. How we use your information
- Operate the App — show you the right matches, score your predictions, place you on leaderboards, send you notifications you have opted into, deliver verification emails when you sign up with email
- Maintain account security — authenticate sign-ins, prevent brute-force and abuse, recover lost passwords
- Diagnose issues — review server logs to fix bugs and improve reliability
- Comply with law — respond to lawful requests (court orders, subpoenas)
We do not sell your data, share it with advertisers, or use it for behavioural advertising.
4. Where your data lives
All your data is stored on AWS infrastructure in the Asia Pacific (Sydney) region (ap-southeast-2):
- The database (Postgres on Amazon RDS) — your profile, predictions, leaderboards, notifications
- Image storage (Amazon S3, private bucket) — your avatar
- Server compute (Amazon ECS Fargate) — runs the API
Images are delivered to the App through Amazon CloudFront — a global content-delivery network that caches images at edge locations close to you for speed. The original files always live in Sydney.
5. Data retention
| Data | Retention |
|---|---|
| Profile, predictions, pool memberships, leaderboard history | Until you delete your account |
| Notifications history (in-app) | 30 days, then auto-deleted |
| Device push tokens | 90 days from last registration (which is refreshed every time you open the App), then auto-deleted |
| Server logs (CloudWatch) | 30 days |
| Account deletion: residual backups | Up to 7 days (AWS RDS automated daily backups roll off naturally; we cannot delete from individual snapshots) |
6. Account deletion
You can delete your account at any time from inside the App:
Profile → Edit Profile → Delete Account → slide to confirm
This permanently deletes:
- Your profile, username, avatar, and personal information (first name, last name, country, date of birth)
- All your match predictions and accuracy statistics
- All your pool memberships and your rows in pool leaderboards
- Your historical leaderboard snapshots
- Your notification preferences and registered device push tokens
- Your authentication records (Apple, Google, and/or email-password)
If you signed up with Sign in with Apple, we call Apple's revocation API so Apple removes the link between your Apple ID and Zukii Football. We do not call Google's equivalent revocation API; if you signed up with Google, you can manually disconnect Zukii Football at any time from your Google account at https://myaccount.google.com/permissions.
Your avatar is removed from S3 storage as part of deletion.
Account deletion is irreversible. There is no recovery period. Residual copies may exist in encrypted daily backups for up to 7 days before they roll off; these are never restored except in a database disaster-recovery scenario.
If you cannot access the App but wish to delete your account, email mikael.tokotuu@gmail.com with your username and we will action it within 14 days.
7. Your rights
Depending on your jurisdiction (GDPR in EU/UK, CCPA in California, the Privacy Act in Australia, etc.) you may have rights to:
- Access the data we hold about you
- Correct inaccurate data (you can do this in-app via Edit Profile)
- Delete your data (you can do this in-app via Delete Account, or email us)
- Object to processing
- Export your data in a portable format — email us with subject line “Data Export Request” and we will provide a JSON file containing your profile, predictions, pool memberships, and notification preferences within 30 days
- Lodge a complaint with your local data protection authority
To exercise any right, email mikael.tokotuu@gmail.com. We respond within 30 days.
8. Children
The App is intended for users 13 and older. We do not knowingly collect data from children under 13. If you believe a child has signed up, email us and we will delete the account.
9. Security
- All traffic between the App and our servers uses HTTPS with TLS 1.2 or higher (TLS 1.3 is preferred and used by default).
- Passwords (if you sign up with email) are hashed by our authentication library using an industry-standard algorithm before being stored. We never see or store your password in plain text. Sign-in via Apple or Google does not involve a password.
- Avatar uploads go straight from your device to our private S3 bucket using a presigned URL we generate just for that upload — the bytes never pass through our application servers, and the bucket itself blocks all public access except via our CDN's restricted access.
- We use the principle of least privilege for all AWS access — each component (server, deployer, CDN) holds only the permissions it strictly needs.
No system is perfectly secure. In the event of a breach affecting your personal data, we will notify you and your local authority as required by law.
10. Changes to this policy
We may update this Policy. Material changes will be announced in the App and via push notification (where you have opted in). The “Last updated” date at the top reflects the most recent change.
11. Contact
Operator: Mikaël Tokotuu
Email: mikael.tokotuu@gmail.com
App: ZUKII Football
For data-protection-specific requests, use the same email with subject line “Privacy Request”.