1. Introduction
Welcome to Sports.game (hereinafter referred to as “This service" or "We”). We are an AI-driven multi-sport prediction and analysis platform headquartered in Tokyo, Japan. This Privacy Policy explains how we handle your (hereinafter referred to as “User" or "You") generated when using this service.
By continuing to use this service, you acknowledge that you have read and understood this policy. If you do not agree to any of the terms, please do not use this service.
2. The information we collect
We collect the following types of information:
2.1 Information You Provide Voluntarily
- Account Information:Email, nickname, username, password hash, profile picture (if uploaded)
- Profile:Profile, Country / Time Zone, Sports of Interest
- Interactive content:Prediction history, comments, feedback, and follow lists
- Contact and Communication:Feedback form content, emails received
2.2 Automatically Collected Data
- Device Information:IP address, browser type and version, operating system, screen resolution, device ID
- Usage history:Visit time, pages viewed, click behavior, session duration, referrer
- Cookie：Authentication cookies, preference cookies, and analytics cookies (see Section 6 for details)
2.3 Third-Party Sources
- Third-party login:If you sign in via Google or Apple, we will receive the email address and public profile information provided by that service
- Event Information:We partner with sports data providers such as Opta and WhoScored to obtain match statistics (which do not involve your personal data)
3. Use of Information
We use your personal information to:
- Services Offered:Account verification, prediction features, personalized content, push notifications
- Product Improvements:Analyze user behavior to optimize AI models and the user experience
- Communication Response:Respond to your questions, send product updates, and share important announcements
- Safety Precautions:Detect suspicious logins; prevent fraud and abuse
- Legal Compliance:Compliance with legal obligations such as tax regulations, anti-money laundering requirements, and court subpoenas
4. Legal Basis (GDPR Art. 6)
| Purpose of Processing | Legal Basis |
|---|---|
| Provide core services | Performance of the contract (Art. 6(1)(b)) |
| Account Security and Fraud Prevention | Legitimate interests (Art. 6(1)(f)) |
| Newsletters and Marketing | Consent (Art. 6(1)(a)) |
| Legal retention obligation | Legal Obligations (Art. 6(1)(c)) |
| Model Training (Anonymization) | Legitimate interests (Art. 6(1)(f)) |
5. Data Sharing
We will share your information in the following limited circumstances:
- Service Provider:Only to the extent necessary, such as AWS (cloud storage), Stripe (payment processing), and Sentry (error monitoring). All vendors have signed a Data Processing Agreement (DPA).
- Legal requirements:Court orders, lawful requests from government agencies, national security requirements
- Corporate Transactions:In the event of a merger, acquisition, or transfer of ownership, we will notify you in advance and provide you with options for data transfer.
- View Profile:The visibility of your prediction history, Tracking Master, leaderboards, and other features depends on your privacy settings.
6. Cookies and Tracking Technologies
We use the following cookies:
| Cookie Types | Purpose | Shelf life |
|---|---|---|
auth_token | User login status | 14 days or log out |
theme | Preferences for light and dark themes | 1 year |
locale | Language Preferences | 1 year |
_ga（Google Analytics） | Analysis of Anonymous Usage | 2 years |
_ph（PostHog） | Product Analysis (Optional) | 1 year |
You can Settings → Privacy Disable analytics cookies, or block third-party cookies in your browser settings.
7. Data Storage
Your data is stored in the AWS data centers in Tokyo (ap-northeast-1) and Frankfurt (eu-central-1):
- User data is stored by default in a data center located in the region where you registered
- All data is encrypted using AES-256 or TLS 1.3+ both at rest and in transit.
- Passwords are hashed using Argon2id (we cannot recover the plaintext)
- Backups are encrypted and stored daily, and retained for 30 days
Retention period:Data is retained for the duration of the account; it is completely deleted 30 days after the account is deleted (except where required by law).
8. Safety Measures
We use the following technical and organizational measures to protect your data:
- Modern security headers such as TLS 1.3 encrypted transmission, HSTS, and CSP
- Two-Factor Authentication (2FA) and Login Device Management
- Access to employee data follows the principle of least privilege, and all operations are logged.
- Annual Third-Party Penetration Testing
- ISO 27001 Information Security Management System (In Progress)
9. Your Rights
Under the GDPR, CCPA, and other applicable laws, you have the following rights:
- Right of access:Obtain a copy of the personal data we hold about you
- Right of rectification:Correct incorrect or incomplete information
- Right to erasure:Request to delete personal data (Right to be forgotten)
- Restriction of processing rights:Limitations on how we process your data
- Right to data portability:Export your data in a machine-readable format
- Right to object:Objection to processing based on legitimate interests
- Right to withdraw consent:Withdraw previously given consent at any time
- Right to Appeal:File a complaint with the local data protection authority
To exercise your rights, please visit Settings → Privacy or email [email protected]We will respond within 30 days.
10. Minors
This service is limited to 18 years of age or older This service is intended for adults. We do not knowingly collect personal information from minors under the age of 18. If you discover that a minor is using this service, please contact us immediately, and we will promptly delete the relevant information.
11. Cross-border Data Transfer
Our users are located all over the world, and your data may be processed outside your country. When transferring data across borders, we use:
- EU Standard Contractual Clauses (SCCs)
- Certification of Adequacy under Japan's APPI (Act on the Protection of Personal Information)
- Obligations Regarding International Data Transfers Under Taiwan’s Personal Data Protection Act
12. Policy Changes
We may update this policy from time to time. Significant changes will:
- Send an email notification to all active users (at least 30 days in advance)
- Display announcements on the homepage for 14 days
- Update the version number and "Last Updated" date
Your continued use of this service constitutes your acceptance of the updated policy. If you do not agree, please delete your account before the changes take effect.
13. Contact Us
If you have any questions about this Privacy Policy, please contact us using the following methods:
- Data Protection Officer (DPO):[email protected]
- General privacy questions:[email protected]
- Company Address:Sports.game Inc., 5-2-1 Jingumae, Shibuya-ku, Tokyo
- EU representative:In accordance with Article 27 of the GDPR, we have a representative in Ireland. For more information, please see Information on EU Representatives