Privacy Policy

1. Controller and contact

The YallaPredict site operator is the controller responsible for personal data processed through this service. Privacy questions and requests may be submitted through any operator contact channel published on the site or in account communications.

2. Data we process

Visits and technical delivery

When you access the site, the hosting and infrastructure providers may process technical request data such as your IP address, request time, requested page, referrer, browser, device information, and security events. This is necessary to deliver the site, prevent abuse, and diagnose failures.

Accounts and authentication

If you register, we process your email address, encrypted authentication credentials managed by Supabase Auth, display name, account identifier, registration time, role, account status, last-login information, and session data. Passwords are not stored in the YallaPredict application database in readable form.

Profile and interaction data

We process profile changes and, when you like a betting post, the account identifier, post identifier, and interaction time. The public sees only the total number of likes, not the identities of users who liked a post. Removing a like removes that association.

Football and betting content

Fixtures, results, team information, editorial predictions, betting posts, strategies, and live-stream links are normally not personal data. Administrator activity associated with publishing or managing that content may be linked to the administrator account for security and accountability.

Information you send us

If you contact the operator, the message, contact details, and any information you voluntarily provide are processed to answer and manage the request.

3. Purposes and legal bases

• Providing accounts and requested features: processing is necessary to provide registration, login, profile, and like functionality and to perform the user agreement.
• Operating and securing the service: processing is based on legitimate interests in reliable delivery, fraud prevention, abuse detection, troubleshooting, and protecting accounts and infrastructure.
• Responding to requests: processing is necessary to respond before or during a contractual relationship, or is based on the legitimate interest in handling correspondence.
• Legal compliance and claims: information may be processed where required by law or where necessary to establish, exercise, or defend legal claims.
• Consent: if an optional feature requiring consent is introduced, it will only be used after valid consent, which can be withdrawn for the future.

4. Cookies and local preferences

YallaPredict uses authentication cookies supplied through Supabase to keep signed-in users securely logged in and refresh their sessions. It also stores a yp_timezone cookie for up to one year so match dates and kickoff times can be displayed in the visitor's timezone. These cookies are used for account security and requested site functionality.

YallaPredict itself does not load advertising cookies, cross-site tracking pixels, or analytics cookies on its pages. A service opened after you click an external link may use its own cookies or advertising technologies under its own policy. If tracking technology is added directly to YallaPredict, this policy and any legally required consent controls will be updated before it is enabled.

5. Service providers and recipients

Personal data is shared only where necessary to operate the service, comply with law, or protect legal rights. Supabase provides database, authentication, and related backend infrastructure. The website hosting and network providers may process connection and diagnostic data. Authorized administrators can access account information where required for support, moderation, and security.

Football-data providers receive server-to-server requests for fixtures and results; YallaPredict does not intentionally send them visitor account data. A Watch Live click may first open a shortened link from the administrator-selected provider (exe.io or Cuty.io) before returning you to the selected YallaPredict match page. That short-link provider and any external live-stream, bookmaker, or data-provider site may receive technical request data and process the visit under its own privacy terms, including for advertising or fraud prevention.

6. International transfers

Depending on the configured infrastructure region and a provider's operations, personal data may be processed outside your country or the European Economic Area. Where required, transfers are protected by an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism.

7. Retention

• Account and profile data is retained while the account remains active and then deleted or anonymized when no longer needed, subject to legal obligations and security requirements.
• Like records remain until you remove the like, the associated post is deleted, or the account is deleted.
• Authentication, security, and server logs are retained only for the period reasonably required for security, troubleshooting, abuse prevention, and provider operations.
• Correspondence is retained for as long as necessary to answer the request and for applicable limitation or record-keeping periods.
• Data required for legal obligations or legal claims may be kept until the relevant obligation or limitation period expires.

8. Your data-protection rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, and data portability. You may object to processing based on legitimate interests and withdraw consent at any time where processing relies on consent. Withdrawal does not affect earlier lawful processing.

Requests can be sent through any operator contact channel published on the site or in account communications. Identity verification may be required to protect accounts and personal data. You also have the right to complain to the data-protection authority responsible for your place of residence, workplace, or the alleged infringement. The European Commission provides an overview of GDPR rights.

9. Security

YallaPredict uses access controls, row-level database security, encrypted HTTPS connections, restricted administrator functions, and authentication safeguards designed to protect personal data. No internet service can guarantee absolute security, so users should choose a strong unique password and protect access to their email account and devices.

10. Automated decisions, children, and policy changes

YallaPredict does not use personal data to make solely automated decisions that produce legal or similarly significant effects. The account and betting areas are intended for adults aged 18 or older and are not directed to children.

This policy may be updated when the service, providers, or legal requirements change. Material changes will be communicated through the site where appropriate. Continued use after a change does not replace consent where consent is legally required.