Privacy Policy for RIVAL
Last updated: 15 Sept 2026
Effective date: 15 Sept 2026
1. Introduction
This Privacy Policy explains how RIVAL ("RIVAL", "we", "us", or "our") collects, uses, discloses, and protects your personal information when you use the RIVAL mobile application (the "App") for iOS and Android, and any related websites and services we provide (together, the "Services").
RIVAL is a sports predictions and social competition app. You make picks on upcoming matches, earn points and streaks, follow other users, teams, leagues and players, and compare results on leaderboards.
Please read this policy carefully. By downloading, accessing, or using the App, you confirm that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the App.
This policy is incorporated into and subject to our Terms of Service, available in the App and at [TERMS URL].
Contact us
Support: hello@getrival.app
2. Summary of Key Points
This summary is provided for convenience. It does not replace the full policy below.
We collect the information you give us when you create an account: your username, email address, mobile number and country code, password, optional profile photo, and your favourite leagues, teams and players.
We collect information automatically when you use the App, including your device type, push notification token, device time zone, app activity, and crash diagnostics.
We use third-party services, namely Google Firebase for push notifications, crash reporting and analytics, AppsFlyer for install attribution and referral links, and Google and Apple Sign-In.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Some of your information is public inside the App. Your username, profile photo, picks, points, accuracy, and leaderboard position are visible to other users.
You can delete your account at any time from Profile, then Edit Profile, then Delete Account. This deletes your personal data as described in Section 11.
The App is not for children under 13. See Section 12.
You have rights over your data, including access, correction, deletion and portability. See Sections 9 and 10.
3. Information We Collect
3.1 Information You Provide Directly
Account registration and login
When you create an account we collect the following information:
Username, which is your public identity in the App and is shown on picks, leaderboards and profiles.
Email address, used for account identification, login, OTP verification, service communications, and account recovery.
Mobile number and country code, used for account identification, login, and OTP verification.
Password, used for authentication and account security. Passwords are transmitted securely and stored by us only in hashed form.
Profile photo, which is optional and is displayed on your public profile and alongside your picks.
Sign in with Google
If you choose to sign in with Google, we receive from Google your Google account identifier, email address, name, and profile photo URL. We do not receive your Google password.
Sign in with Apple
If you choose to sign in with Apple, we receive your Apple user identifier, your name if you choose to share it, and your email address, or Apple's private relay address if you choose to hide your email. We do not receive your Apple password.
One-time passcodes (OTP)
We send OTP codes by email or SMS to verify your identity when you register, log in, or change your email address or mobile number. Standard message and data rates from your mobile carrier may apply.
Sports preferences
During onboarding and afterwards, we collect the leagues, teams and players you select as favourites, and the accounts, teams, leagues and players you follow.
Content you create
We collect the picks and predictions you submit on matches, the likes you give to other users' picks, and your search queries within the App.
Photos and camera content
If you choose to set a profile photo or attach a file to a support ticket, we access your camera or photo library, only after you grant permission, and only for the image you select. We do not scan, index, or upload any other content from your device.
Support communications
If you contact support through the in-app chat or raise a support ticket, we collect the messages, attachments and contact details you provide, and retain the conversation history so we can assist you.
Reports and blocks
If you report another user or block them, we collect the report reason you select, which may be fake content, spam, harassment, inappropriate content, abuse, or other, along with the associated content identifiers, so we can review and act on the report.
3.2 Information Collected Automatically
Device type, meaning iOS or Android, which we use to deliver the correct build behaviour and push notifications.
Push notification token, which is your Firebase Cloud Messaging registration token, used to send you push notifications.
Device time zone, which is sent with each API request and used to display match times, deadlines and results correctly for your location.
IP address, processed by our servers when your device connects, and used for security, fraud prevention, abuse detection, and approximate country-level routing.
App activity and usage events, collected through the App and Firebase Analytics, and used to understand which features are used, diagnose problems, and improve the App.
Crash reports and diagnostics, collected through Firebase Crashlytics, including device model, operating system version, app version, stack traces, and the state of the App at the time of the crash.
Install attribution and referral data, collected through AppsFlyer, and used to understand how users find the App and to credit referrals when you share an invite link.
Installed messaging and social apps. The App checks whether Instagram, X (formerly Twitter) and your messaging app are installed so it can show you the right sharing options. This check happens on your device.
Referral links
When you share a pick or invite from the App, the generated link includes your user identifier as the referrer so that we can attribute the referral. When someone installs the App from your link, we receive that attribution data.
We do not collect your precise or approximate GPS location. The App contains no location tracking. We do not access your contacts, calendar, microphone, or health data.
3.3 Information We Do Not Collect
For clarity, RIVAL does not collect or process any of the following:
Precise or coarse geolocation data.
Your contacts or address book.
Financial or payment information. The App contains no purchases, subscriptions, wallet or billing features. Points and streaks in the App are non-monetary gamification scores with no cash value and are not redeemable.
Biometric data.
Health or fitness data.
Audio recordings or microphone input.
Advertising identifiers. We explicitly disable collection of the Android Advertising ID, and the App displays no third-party advertising.
4. How We Use Your Information
We use your personal information for the following purposes:
To provide the Services, including creating and maintaining your account, authenticating logins, submitting and scoring your picks, calculating points, streaks and accuracy, building leaderboards, and operating the follow graph and feed.
To personalise your experience, including showing matches, news and content relevant to the leagues, teams and players you follow, and displaying times in your device time zone.
To communicate with you, including sending OTP verification codes, transactional and service messages, responses to support enquiries, and push notifications about your picks, results, followers and app activity.
To keep the Services safe, including detecting, investigating and preventing fraud, abuse, spam, harassment, and violations of our Terms, reviewing user reports, enforcing blocks, and securing accounts.
To improve the Services, including analysing aggregate usage patterns, diagnosing crashes and errors, and testing and developing new features.
To measure marketing, including understanding how users discover and install the App and attributing referrals and shares.
To comply with law, including meeting our legal, regulatory, tax and accounting obligations, and responding to lawful requests from public authorities.
We do not use your personal information to make decisions producing legal or similarly significant effects about you through solely automated means.
5. Legal Bases for Processing (EEA, UK and Switzerland)
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:
Creating and operating your account and delivering core App features: performance of a contract, under Article 6(1)(b).
Sending OTP codes and transactional service messages: performance of a contract, under Article 6(1)(b).
Crash reporting, security, fraud and abuse prevention: legitimate interests, under Article 6(1)(f), in keeping the Services secure and reliable.
Analytics and product improvement: consent where required, and otherwise legitimate interests, under Article 6(1)(f).
Marketing attribution and referral tracking: consent, under Article 6(1)(a), where required by applicable law.
Push notifications: consent, under Article 6(1)(a), given through your device permission prompt.
Responding to support requests: performance of a contract and legitimate interests, under Articles 6(1)(b) and 6(1)(f).
Complying with legal obligations: legal obligation, under Article 6(1)(c).
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to this processing, as described in Section 10.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can withdraw push notification consent in your device settings at any time.
6. How We Share Your Information
We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. We share information only as described below.
6.1 With Other Users
The following information is visible to other RIVAL users and may be visible to anyone who can view a shared pick card:
Your username.
Your profile photo.
Your picks and predictions, and their results.
Your points total, accuracy percentage, streak and leaderboard position.
Your follower and following counts and lists.
Likes you give to other users' picks.
Your email address, mobile number and password are never shown to other users.
When you share a pick outside the App, for example to Instagram, X, messaging apps or your clipboard, the generated image and link contain the public information above, and control of that content passes to you and the platform you share it to.
6.2 With Service Providers
We share personal information with the following service providers, who act on our instructions:
Google Firebase Cloud Messaging, operated by Google LLC and Google Ireland Limited. We share your push token and device type for the purpose of delivering push notifications. Their privacy policy is available at https://firebase.google.com/support/privacy
Google Firebase Crashlytics. We share crash logs, device model, operating system version, app version, and an installation identifier for the purpose of crash reporting and stability. Their privacy policy is available at https://firebase.google.com/support/privacy
Google Firebase Analytics. We share app usage events and device and app identifiers for the purpose of aggregate product analytics. Their privacy policy is available at https://firebase.google.com/support/privacy
Google Sign-In, operated by Google LLC. We share authentication data you authorise for the purpose of social login. Their privacy policy is available at https://policies.google.com/privacy
Sign in with Apple, operated by Apple Inc. We share authentication data you authorise for the purpose of social login. Their privacy policy is available at https://www.apple.com/legal/privacy/
AppsFlyer Ltd. We share install and attribution data, device identifiers, your user identifier, and share events for the purposes of install attribution, deep linking and referral tracking. Their privacy policy is available at https://www.appsflyer.com/legal/services-privacy-policy/
All data processed by the Services is shared for the purposes of application hosting, databases and file storage.
We require each provider to protect your information and to use it only for the purposes we specify.
6.3 For Legal and Safety Reasons
We may disclose your information where we believe in good faith that disclosure is necessary to do any of the following:
Comply with applicable law, regulation, legal process, or an enforceable governmental request.
Enforce our Terms of Service, including investigating potential violations.
Detect, prevent or address fraud, security or technical issues.
Protect the rights, property or safety of RIVAL, our users, or the public, as required or permitted by law.
6.4 Business Transfers
If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of our assets, your information may be transferred as part of that transaction. We will notify you, and where required obtain your consent, before your personal information becomes subject to a materially different privacy policy.
7. International Data Transfers
We are based in USA, and our service providers operate globally. Your personal information may be transferred to, stored in, and processed in countries other than your own, including the United States, whose data protection laws may differ from those in your jurisdiction.
Where we transfer personal information out of the EEA, the UK or Switzerland, we rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, transfers to countries covered by an adequacy decision, or your explicit consent where permitted.
You may request a copy of the safeguards we use by contacting us at hello@getrival.app.
8. Data Retention
We retain personal information for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.
Account data, including your username, email address, mobile number and profile photo, is retained for the life of your account, and is then deleted or anonymised within [30 to 90] days of account deletion.
Picks, points and leaderboard history are retained for the life of your account. After deletion, this data is retained in anonymised form for historical leaderboard integrity, with no link to you.
Support chat and ticket history is retained for [24] months from the date the ticket is closed.
Crash and diagnostic logs are retained for up to [90] days, in line with Firebase Crashlytics defaults.
Analytics data is retained for up to [14] months, in line with Firebase Analytics defaults.
Attribution data is retained for up to [24] months, in line with AppsFlyer retention settings.
Reports and moderation records are retained for [24] months, or longer where required for safety and legal defence.
Records required for legal, tax or accounting purposes are retained as required by applicable law.
Backups are retained on a rolling schedule and are overwritten within [35] days. Deleted data persists in backups only until they are cycled out.
9. Your Privacy Rights
9.1 Rights Available to All Users
Regardless of where you live, you can do all of the following:
Access and update your profile. Go to Profile, then Edit Profile, to change your username, email address, mobile number and profile photo.
Change your password. Go to Profile, then Edit Profile, then Change Password.
Delete your account. Go to Profile, then Edit Profile, then Delete Account. This is permanent.
Control push notifications. You can turn them off in your device settings at any time.
Control camera and photo access. You can revoke permission in your device settings at any time. The App remains usable, but you will not be able to set a profile photo or attach files to support tickets.
Block and report users, from any user's profile or pick.
9.2 Rights Under GDPR and UK GDPR
If you are in the EEA, UK or Switzerland, you have the following rights:
The right to access the personal data we hold about you, and to receive a copy.
The right to rectify inaccurate or incomplete data.
The right to erase your data, also known as the right to be forgotten.
The right to restrict processing in certain circumstances.
The right to object to processing based on our legitimate interests, and to object to direct marketing at any time.
The right to data portability, meaning you may receive your data in a structured, commonly used, machine-readable format.
The right to withdraw consent at any time, where processing is based on consent.
The right to lodge a complaint with your local supervisory authority. A list of EEA authorities is available at https://edpb.europa.eu/about-edpb/board/members_en and, in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/
9.3 Rights Under CCPA, CPRA and Other US State Laws
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another US state with a comprehensive privacy law, you have the following rights:
The right to know what personal information we collect, use, disclose and, if applicable, sell or share.
The right to access a copy of your personal information.
The right to delete your personal information, subject to legal exceptions.
The right to correct inaccurate personal information.
The right to opt out of the sale or sharing of personal information, and of targeted advertising.
The right to limit the use of sensitive personal information.
The right to non-discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised your rights.
Notice regarding sale and sharing
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CPRA. We have not sold or shared personal information in the preceding 12 months, including the personal information of consumers under 16 years of age.
Categories of personal information collected in the preceding 12 months
Using the categories set out in the CCPA:
Category A, identifiers. Collected. Examples include username, email address, mobile number, account ID, device identifiers, and IP address.
Category B, customer records under California Civil Code section 1798.80. Collected. Examples include name if provided via social login, phone number, and email address.
Category C, protected classifications. Not collected.
Category D, commercial information. Not collected.
Category E, biometric information. Not collected.
Category F, internet or network activity. Collected. Examples include app usage events, feature interactions, and search queries within the App.
Category G, geolocation data. Not collected.
Category H, sensory data. Collected on a limited basis. This covers photos you choose to upload as a profile picture or support attachment.
Category I, professional or employment information. Not collected.
Category J, education information. Not collected.
Category K, inferences. Collected on a limited basis. This covers sports interest preferences derived from the teams and leagues you follow.
Category L, sensitive personal information. Collected on a limited basis. This covers account log-in credentials, meaning your password. We use these solely to authenticate you and do not use them to infer characteristics about you.
How to exercise your rights
Email hello@getrival.app with the subject line "Privacy Rights Request", or use the in-app account deletion flow. Authorised agents may submit requests on your behalf with written proof of authorisation and verification of your identity.
9.4 How We Verify and Respond to Requests
To protect your data, we verify requests by matching the email address or mobile number in your request against the one registered to your account, and we may ask you to confirm through the App. We will respond within 30 days under the GDPR, or within 45 days under US state laws, and may extend by a further period where permitted, notifying you of the reason.
We do not charge a fee for these requests unless they are manifestly unfounded, excessive or repetitive.
10. How to Contact Us About Privacy
For privacy rights requests, email hello@getrival.app.
For general support, go to Profile, then Help and Support in the App, or email hello@getrival.app.
For data protection complaints, email hello@getrival.app. If your complaint is not resolved, you may contact your supervisory authority.
For postal correspondence, write to [COMPANY LEGAL NAME], [REGISTERED ADDRESS].
11. Account Deletion
You can delete your RIVAL account at any time.
In the App, go to Profile, then Edit Profile, then Delete Account, and confirm.
By email, send a request from your registered email address to hello@getrival.app with the subject "Delete My Account".
What happens when you delete your account
Your profile, username, email address, mobile number and profile photo are deleted or irreversibly anonymised within [30] days.
Your picks and leaderboard history are disassociated from your identity. We may retain them in aggregate, anonymised form so that historical leaderboards and other users' records remain accurate.
Your support conversations are retained for [24] months for legal and safety purposes, and are then deleted.
Content you shared outside the App, and content other users have saved or screenshotted, is outside our control and is not deleted by this process.
Records we are legally required to keep are retained for the required period and are then deleted.
Deletion is permanent and cannot be undone. You will need to create a new account to use RIVAL again.
12. Children's Privacy
RIVAL is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. You must be at least 13 years old to create an account. In jurisdictions where the minimum age for consenting to data processing is higher than 13, you must be old enough to consent under the law of your country, or have your parent or guardian's consent.
If you are a parent or guardian and believe your child under 13 has provided us with personal information, contact us at hello@getrival.app. We will delete the account and the associated information promptly.
We comply with the Children's Online Privacy Protection Act in the United States and equivalent requirements elsewhere. We do not knowingly sell or share the personal information of minors under 16.
13. Data Security
We take the security of your personal information seriously and implement technical and organisational measures appropriate to the risk, including the following:
Encryption in transit. All communication between the App and our servers uses HTTPS and TLS. The App enforces App Transport Security on iOS and disallows cleartext traffic.
Encrypted local storage. Authentication tokens and cached data are stored in encrypted device storage, with the encryption key held in the iOS Keychain or Android Keystore and accessible only after the device is first unlocked.
Password protection. Passwords are stored only in hashed form. We cannot read your password.
Access controls. Access to production data is restricted to authorised personnel who need it for their role.
Monitoring. We log and monitor for unauthorised access and unusual activity.
No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your password confidential and for activity that occurs under your account. If you believe your account has been compromised, contact us immediately at hello@getrival.app.
Breach notification
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay where the risk is high.
14. Third-Party Links and Services
The App contains links to third-party websites, news sources, and social platforms, including Instagram, X, and your messaging apps when you share content. It also displays news content and images from third-party sources.
This Privacy Policy does not apply to those third parties. We are not responsible for their privacy practices. We encourage you to read the privacy policy of every third-party service you visit or share to.
15. Push Notifications
With your permission, we send push notifications about match results, your picks, new followers, likes, streaks, support replies and other app activity. We use Firebase Cloud Messaging to deliver them, which requires sharing your device's push token with Google.
You can disable push notifications at any time.
On iOS, go to Settings, then Notifications, then RIVAL, then Allow Notifications.
On Android, go to Settings, then Apps, then RIVAL, then Notifications.
Disabling notifications does not affect your ability to use the App. You will continue to see in-app notifications in the App's notification centre.
16. Your Choices Summary
To edit or correct your profile data, go to Profile, then Edit Profile in the App.
To delete your account and data, go to Profile, then Edit Profile, then Delete Account in the App.
To turn off push notifications, use your device settings.
To revoke camera or photo library access, use your device settings.
To revoke Google or Apple Sign-In access, use your Google Account settings, or your Apple ID settings under Sign in with Apple.
To opt out of Firebase Analytics, contact hello@getrival.app.
To block or report another user, open that user's profile or pick in the App and use the options menu.
To request a copy of your data, contact hello@getrival.app.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make changes, we will update the "Last updated" date at the top of this policy. If the changes are material, we will provide more prominent notice, such as an in-app notice or an email to the address associated with your account, before the changes take effect, and where required by law we will obtain your consent.
We encourage you to review this policy periodically. Your continued use of the App after the effective date of an updated policy constitutes your acceptance of it.
18. Jurisdiction-Specific Disclosures
Nevada residents
Nevada law allows residents to opt out of the sale of certain personal information. We do not sell personal information as defined under Nevada law. You may submit a request to hello@getrival.app.
Australia
We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/
Canada
We comply with PIPEDA and applicable provincial privacy legislation. You may complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/
Brazil
We comply with the Lei Geral de Proteção de Dados. You have the rights of confirmation, access, correction, anonymisation, portability, deletion, and information about sharing. Contact hello@getrival.app.
India
We comply with applicable Indian data protection law, including the Digital Personal Data Protection Act, 2023.
19. App Store and Play Store Disclosures
Apple App Store, App Privacy
The data types declared for RIVAL in App Store Connect are consistent with this policy. They are contact information, meaning email address, phone number and name, user content, meaning photos and customer support content, identifiers, meaning user ID and device ID, usage data, meaning product interaction, and diagnostics, meaning crash data and performance data. Data is linked to your identity and is not used for tracking across apps and websites owned by other companies.
Google Play, Data Safety
The Data safety section for RIVAL declares that data is encrypted in transit, that users can request data deletion, and that we do not share user data with third parties for advertising or sale. Data collection is disclosed for personal information, photos, app activity, app information and performance, and device or other identifiers.
If you believe any store disclosure is inconsistent with this policy, please tell us at hello@getrival.app so we can correct it.