Privacy notice
Back1. Who is responsible
Abedalrazzak Alyagshi, Westersteig 17, 25899 Niebüll, Germany · Abed.Alyagshi@gmail.com
TipKora is in a testing phase and is currently run by a private individual; no company has been registered yet. When that changes, we will update this notice and the imprint.
2. What data we process and why
Without an account: you can browse matches, standings, league pages and match details without registering. In that case we only process the technical access data (see below) and your language choice (a cookie).
Account: email address, display name, password (stored only as a hash by our authentication provider), preferred language and plan. Purpose: registration, sign-in and providing the app. Legal basis: Art. 6(1)(b) GDPR (contract).
Sign-in with Google (only if you choose it): Google sends us your email address, your name and a Google identifier. We read nothing else from your Google account. Legal basis: Art. 6(1)(a) GDPR (consent, which you give in Google's sign-in window).
Use of the app: membership of prediction groups, predictions, bonus answers, followed teams and competitions, notification settings. Purpose and legal basis as above.
What others can see: members of the same prediction group see your display name and, once a match has kicked off, your predictions; before that your predictions are hidden from others. The only thing shown publicly is a competition's total number of followers, not who follows it.
Contact form: if you write to us through the contact form, we process your name, email address and message in order to answer you. The message is delivered to us by email (through our email provider Hetzner Online GmbH, Germany) and is not stored in the app's database. A security check is needed before sending (see section 5). We delete the message once your request is dealt with, and after 6 months at the latest, unless the law requires us to keep it longer. Legal basis: Art. 6(1)(b) GDPR (your request) or (f) (legitimate interest in answering enquiries).
Push notifications (only if you turn them on): technical data from your browser needed to deliver messages. Legal basis: Art. 6(1)(a) GDPR (consent); you can withdraw it any time in your browser settings.
Technical access data (including IP address, time and page requested) is processed briefly in the hosting provider's server logs. Purpose: secure and stable operation. Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
We show no advertising, do not track you across websites, do not build profiles and do not sell data.
3. Cookies and similar technologies
We only use what is technically necessary: sign-in cookies (your session) and a cookie for your language setting. There are no advertising or analytics cookies, which is why there is no cookie banner.
Your browser also remembers whether you confirmed the YouTube player notice (local storage, key "tipkora.youtube-consent"). You can reset that choice below.
4. YouTube videos (match highlights)
For some matches we show highlight videos from clubs' official YouTube channels. Videos play only through YouTube's embedded player and stay hosted by YouTube; we do not download, store or alter them.
Nothing is loaded from YouTube before you confirm (the preview picture comes from our own server). Only when you press "Play video" is the player loaded from youtube-nocookie.com (Google Ireland Limited / Google LLC). YouTube then receives your IP address and may store cookies or similar data on your device. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (your consent by pressing "Play video").
We use YouTube API Services. By using the videos you agree to YouTube's Terms of Service: https://www.youtube.com/t/terms. Google's privacy policy applies: https://policies.google.com/privacy.
5. Recipients and transfers outside the EU
Database and sign-in: Supabase (servers in Ireland, EU).
Website hosting: Vercel Inc., USA. The site's code runs in Frankfurt am Main (Germany), inside the EU. Because Vercel is a US company, access from the USA (for example for support or maintenance) cannot be ruled out; for that we rely on the safeguards Vercel offers (for example EU standard contractual clauses).
Sending and receiving emails (confirmation emails, contact form): a mailbox at Hetzner Online GmbH (Germany).
Sign-in with Google (only if you choose it): Google Ireland Limited / Google LLC.
Security check in the contact form: Cloudflare Turnstile (Cloudflare, Inc., USA). The script is only loaded when you press "Start the security check". Cloudflare then receives your IP address and browser details to tell whether you are human. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (your consent by pressing the button). Cloudflare is certified under the EU-US Data Privacy Framework. Privacy policy: https://www.cloudflare.com/privacypolicy/.
Football data: API-Football (API-Sports). No personal data is sent there, but your browser loads team crests and logos directly from media.api-sports.io, which therefore receives your IP address.
Backups: every day we make an encrypted backup copy of the database. It is kept for 30 days in private storage at GitHub, Inc. (Microsoft, USA) and then deleted automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and recoverability of the data).
Push notifications are delivered through your browser maker's push service (for example Google, Apple, Mozilla).
Beyond this we only pass data on where we are legally required to (for example to authorities or courts).
6. How long we keep data, and deletion
Account data and predictions are kept until you have your account deleted. Server logs are deleted automatically after a short time. Video details fetched from YouTube are refreshed regularly and renewed or deleted within 30 days at the latest.
Deleting your account: write to the email address above. We delete your account together with your predictions, group memberships and settings within one month. Data we are legally required to keep is not affected (currently none at TipKora). Deleted data can remain in the daily backup copies for up to 30 days and is then removed along with them.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15–21 GDPR), and the right to withdraw consent at any time with effect for the future. Write to the email address above.
You can also complain to a data protection authority (Art. 77 GDPR), for example the one where you live. The authority responsible for us is the Independent Centre for Privacy Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz), Holstenstraße 98, 24103 Kiel: https://www.datenschutzzentrum.de.
8. Children and young people
TipKora is not aimed at children under 16. If we learn that an account belongs to a child under 16, we delete it. Parents can ask for deletion at any time by email.
9. Changes
We update this notice when the app or the law changes. Last updated: 26 September 2026.