Privacy Policy

GolVix: Football Quiz (“GolVix”) is a football quiz app. This policy explains what personal data the GolVix app, our servers and this website process, why, who receives it, how long it is kept and how you can use your rights. It does not cover third-party apps, websites or ads you open from GolVix.

1. Who is responsible

The controller of your personal data is Olaasoft MMC (“OlaaSoft”, “we”, “us”), 28,73 Rizvan Teymurov str., Baku AZ1002, Azerbaijan. For every privacy question or request, write to [email protected].

We process personal data in line with the Law of the Republic of Azerbaijan “On Personal Data” and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA) and similar laws.

2. Summary

• You can start as a guest without giving us your name or email. To keep playing, add friends or play rooms, you register with email and password, Google or Apple.
• We store your progress, profile and match history on our server so the app works across sessions and devices.
• Other players see your @username or nickname, a preset avatar, your level and your results in matches. A photo you upload as your avatar is visible only to you.
• Free players see ads from Google AdMob and its partners. Personalised ads and tracking depend on your choices in the consent form and, on iPhone, in Apple’s tracking prompt. Premium removes ads.
• Product analytics (Mixpanel and Google Analytics for Firebase) can be switched off in Settings; in the EEA, UK and Switzerland it stays off unless you turn it on.
• You can delete your account in the app at any time. A few hashed records are kept afterwards (section 10).
• We do not sell your personal data for money. Personalised advertising may count as “sharing” under California law; section 12 explains how to opt out.

3. What we collect

3.1 Account and sign-in

GolVix uses Firebase Authentication (Google). When you first open the app it creates an anonymous guest account with a random user ID. When you register, the guest account is linked to your sign-in method and keeps its history. Depending on the method, Firebase processes your email address, whether it is verified, a name and profile photo supplied by Google or Apple, and sign-in times. Passwords are handled by Firebase; our server never sees or stores them. Verification and password-reset emails are sent from our address through Resend, with the link created by Firebase. With Sign in with Apple you can use Apple’s “Hide My Email” address.

3.2 Profile

Registered players can choose a unique @username (3–20 letters, digits or underscores) and a nickname, and pick one of the preset football avatars or upload a photo. Your @username, nickname, preset avatar and player level are visible to other players where the app shows you: in rooms, friend lists, search results, invites and the ranking. An uploaded photo is stored on our server and is shown only to you; other players see a preset avatar at most. You can change or remove these at any time.

3.3 Gameplay and progress

Our server identifies you by your Firebase user ID and stores the questions shown to you, your answers and results, points, XP and level, streaks, achievements, statistics by topic and mode, your difficulty and language, daily challenge and Football IQ test results, hint credits and the counters needed for daily limits and to stop duplicate requests. If you share your Football IQ result, the app creates an image on your device and you choose where to send it.

3.4 Ranking

Registered players who answer ranked questions appear in the global ranking with their points, answer totals and rank. You appear with your nickname if you have one; otherwise with a masked label that shows at most three characters before the “@” of your email, and with your full email only if you switch that on yourself.

3.5 Rooms, friends and invites

• Matches. When you play a room, the other players see your public profile, your answers or bids and the names you type in Auction mode, and the result. We keep the room, its moves and the result so the match can run and results, head-to-head records and statistics can be shown.
• Public rooms. A public room you create is listed for other players of the same quiz language until it starts or closes.
• Friends. Other players can find you by your @username, or by your exact email address. An email search never tells the searcher whether an account exists; if it does, you receive a request that shows only the sender’s @username and avatar, and your email is never shown to them. Friends see your level, when you were last active, your overall statistics and your head-to-head record with them. You can decline, remove or block anyone; a declined request is never shown to the sender.
• Invites and suggestions. We keep invites, friend requests and players you have recently played, invited or hidden so the app can suggest people to invite. Invites expire after 15 minutes.
• Bots. Some public rooms are joined by computer-controlled players; this is explained in the app and the Terms of Use.

3.6 Plans, purchases and region

Every request from the app includes the country of your device’s region setting (for example “AZ”), if your device has one. Our server uses it only to apply the free-plan limits and offers that differ by country and does not store it. Purchases are handled by the App Store (and Google Play once GolVix is on Android); see section 8.

3.7 Free period and abuse prevention

When we offer new players a free period, it is granted once per device and once per email address. To check this we keep a keyed one-way hash (HMAC) of your normalised email address, not the address itself; on iPhone the app asks Apple’s DeviceCheck service for a one-time token so our server can read and set two bits that Apple stores for this device and our app; on Android the app sends the Android ID, which our server immediately turns into a keyed hash. These signals are used only to prevent repeated free periods and fraud, never for advertising, and are kept after you delete your account (section 10).

3.8 Question reports and support

If you report a question, we store the question, the reason you chose, your optional comment and your user ID, and use them to correct content. Please do not put personal information in the comment. If you email us, we receive your email address and what you write; our support mailbox is currently hosted by Google (Gmail).

3.9 Data kept only on your device

The app keeps your language, theme, sound and haptics settings, the daily quiz reminder choice, consent choices, a local copy of your profile and progress, and a cached plan status on your device. Account-specific data is cleared when you sign out or delete your account. Uninstalling the app removes local data but does not delete data held by us.

3.10 Technical data

Our providers receive technical data when the app connects to them: IP address (from which an approximate location such as country or city can be inferred), device model, operating system and app version, language and the identifiers described in this policy. Our hosting provider keeps standard network logs for security.

4. Advertising

If you do not have Premium or a day pass, GolVix shows ads: full-screen ads (for example at the end of a game), optional rewarded videos that give you a reward such as a hint, and possibly banners. Ads are served by Google AdMob, which may run an auction among its mediation partners Unity Ads and Pangle. Ad providers may process your device’s advertising identifier (IDFA on iOS, Advertising ID on Android), IP address and approximate location, device and app information and ad interactions to show and measure ads, limit how often you see them and prevent fraud. For rewarded ads, the app passes your GolVix user ID and a random code to Google so our server can check the reward was earned. Ad providers act under their own privacy policies and, for personalised ads, as independent controllers.

• Consent (EEA, UK, Switzerland): the app shows Google’s consent form before ads are requested.
• iPhone: Apple’s App Tracking Transparency prompt is shown. If you choose “Ask App Not to Track”, your IDFA is not shared.
• Change your choice: in the app’s Settings (ad privacy options, where offered in your region); on iPhone in Settings → Privacy & Security → Tracking; on Android in your device’s ads settings.

5. Analytics, diagnostics and app integrity

• Product analytics (Mixpanel and Google Analytics for Firebase): app events such as screens viewed, quizzes and matches played, paywall views and purchase steps, with device and app information, a one-way hash of your user ID, your plan and app language. No email, name, nickname or free text is sent. Nothing is collected until the app’s consent step has decided. In the EEA, UK and Switzerland analytics stays off unless you turn it on; elsewhere it is on and you can turn it off with the “Share usage analytics” switch in Settings. Google Analytics does not use advertising identifiers for GolVix and its ad features are off.
• Crash reporting (Firebase Crashlytics and Sentry): crash reports and errors with stack traces, device model, OS and app version and an installation identifier. Sentry stores data in its EU (Germany) region.
• Firebase App Check uses Apple App Attest / DeviceCheck (and Google Play Integrity on Android) to confirm that requests come from the genuine app. Firebase Remote Config delivers settings such as update notices.

6. Notifications

GolVix asks for notification permission only when you first open Friends or the invite screen, never when it starts. If you allow it, a Firebase Cloud Messaging token for your device is registered with your account so we can send room invites and friend requests. You can mute each category in Settings → Notifications, or turn notifications off in your phone’s settings; signing out removes the token from your account. The daily quiz reminder is scheduled locally on your phone and does not go through our server.

7. AI processing

In Auction mode, when a footballer name you type is not in our answer list, our server may send that name and the round’s prompt (for example “initials L. M.”) to OpenAI’s API to check whether it is a valid answer. We do not send your user ID, email, @username or any other information about you. AI content tools for writing questions are switched off at the time of this policy. Under OpenAI’s API data usage policy, API data is not used to train OpenAI’s models by default and may be kept for a limited time for abuse monitoring; that is OpenAI’s policy, not a promise by us.

8. Subscriptions and purchases

Premium subscriptions, the 1-day pass and hint credit packs are sold and billed by the Apple App Store (and Google Play once GolVix is on Android). We never receive your card or payment details. We use Adapty to read the store’s purchase records and tell our server what you bought; Adapty receives your Firebase user ID so purchases follow your account. Deleting your account or the app does not cancel a subscription; manage it in your store account.

9. This website

This website has no accounts, no advertising, no analytics and no cookies. It remembers your light or dark theme choice in your browser’s local storage only if you use the theme switch; that value never leaves your device. Cloudflare, which hosts and delivers the site, processes standard request data such as IP address and browser type for delivery and security.

10. How long we keep data

• Account data (profile, photo, progress, matches, friends, invites, reports, ranking, purchases status, push tokens): kept while your account exists. When you delete your account in the app, it is removed from our live database immediately, your Firebase sign-in identity is deleted (by the app at once and again by our server about 10 minutes later as a safeguard), and your Adapty profile is deleted. You are removed from friends’ lists and pending invites; other players keep their own results of past matches without your identity.
• Guest accounts: a guest’s progress is stored under a random user ID without contact details. Guests have no in-app delete button: register and then delete the account, or email us. Guest accounts without activity for 90 days are deleted automatically.
• Kept after deletion: the free-period hashes and DeviceCheck bits (while we offer a free period; they contain no raw email or device ID); a deletion marker that holds only a one-way hash of your former user ID, so delayed requests cannot recreate your data; hashed rewarded-ad transaction IDs so a reward cannot be credited twice; admin log entries with your user ID replaced by a pseudonym.
• Backups: if database backups exist they are encrypted, kept for a limited period and overwritten; deletions are re-applied before any restore.
• Providers: analytics, crash and advertising providers keep data for the periods in their policies and our account settings; Apple and Google keep store transaction records under their own policies.
• Support emails: as long as needed for your request and any follow-up.

11. Purposes, legal bases and recipients

“Contract” means the processing is needed to provide the app you asked for (GDPR Art. 6(1)(b)); “legitimate interests” means our interest in security, fraud prevention and a reliable service, balanced against your rights (Art. 6(1)(f)); “consent” can be withdrawn at any time (Art. 6(1)(a)).

Service providers

Most providers act as our processors under data-processing terms. Advertising networks, and Apple and Google as app stores and sign-in providers, also act as independent controllers under their own policies.

• Google Firebase — authentication, App Check, Crashlytics, Analytics, Remote Config, Cloud Messaging (USA)
• Google AdMob and User Messaging Platform — ads and consent (USA)
• Unity Ads — ad mediation partner (USA)
• Pangle (Bytedance Pte. Ltd.) — ad mediation partner (Singapore)
• Railway — app server and database hosting (USA / EU)
• Adapty — purchase and subscription status (USA)
• Mixpanel — product analytics (USA)
• Sentry (Functional Software, Inc.) — error reporting (EU (Germany))
• Resend — sign-in emails (verification, password reset) (USA)
• OpenAI — checking footballer names typed in Auction mode, and content tools when enabled (USA)
• Cloudflare — website hosting and delivery (global network)
• Apple — App Store, Sign in with Apple, DeviceCheck, App Attest, push delivery (USA)
• Google Sign-In and Google Play — sign-in, and the store once GolVix is on Android (USA)

International transfers

We are based in Azerbaijan, and our providers process data in the United States, the European Union, Singapore and other countries. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or, where the provider is certified, the EU–US Data Privacy Framework.

12. Your rights

Depending on where you live, you have the right to:

• access your personal data and receive a copy (portability);
• correct inaccurate data (you can edit your profile in the app);
• delete your data: Profile → Delete account in the app, or see how to delete your account;
• object to processing based on legitimate interests, and ask us to restrict processing;
• withdraw consent at any time (ads: ad privacy options in Settings; analytics: the analytics switch in Settings; notifications: Settings → Notifications or your phone’s settings), without affecting earlier processing;
• complain to a data-protection authority, for example in the EU country where you live or work, or the UK Information Commissioner’s Office.

To use them, email [email protected] from the address linked to your account (or tell us your sign-in method). We may ask for information to confirm the request is yours. We answer within one month (GDPR) or 45 days (CCPA), extendable where the law allows.

California and other US state residents

In the last 12 months we collected the categories in section 11: identifiers (user ID, email, @username, advertising ID), commercial information (purchases), internet or other electronic network activity (app and ad interactions) and approximate geolocation. We do not collect sensitive personal information as defined by the CCPA. We do not sell personal information for money. Letting Google AdMob and its mediation partners use your advertising identifier and ad interactions for personalised ads may be “sharing” or a “sale” under the CCPA and similar laws. To opt out: on iPhone choose “Ask App Not to Track” or turn off Settings → Privacy & Security → Tracking; use the ad privacy options in the app where offered; or email us with the subject “Do Not Sell or Share”. You will not be discriminated against for using your rights, and you may use an authorised agent. We do not knowingly sell or share personal information of consumers under 16.

13. Children

GolVix is made for adults and is not directed at children. You must be at least 13 years old, or older if your country sets a higher age for consenting to the processing of personal data (for example 16 in some EU countries); below that age you may use GolVix only with the consent of a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has used GolVix, contact us and we will delete the account.

14. Security

Data is encrypted in transit (HTTPS/TLS). Our server accepts requests only with a verified Firebase sign-in token and, in production, an App Check token from the genuine app. Administrative access is limited to a few verified staff accounts and is logged. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

15. Automated decisions

We do not make decisions with legal or similarly significant effects about you solely by automated means. Question selection, matchmaking, daily limits, the Auction answer check and free-period checks are automated features of the game; contact us if you think one was applied to you by mistake.

16. Changes to this policy

We may update this policy when the app or the law changes. The new version is published on this page with a new “Last updated” date. If a change materially affects how we use data you have already given us, we will tell you in the app or ask for your consent where required.

17. Contact

Olaasoft MMC, 28,73 Rizvan Teymurov str., Baku AZ1002, Azerbaijan. Email: [email protected]. See also the Support page.