This policy explains what data the JakiWynik app and website collect, why we collect it and what you can do about it. We have tried to keep it short and free of legal jargon. This is an English translation of the Polish policy; if the two differ, the Polish version prevails.
1. Who controls your data
The controller of your personal data is Adam Hańczewski INTAH, ul. Baczyńskiego 21, 60-161 Poznań, Poland, tax ID (NIP) 779-213-89-46.
Your email address, the name you provide and your account ID. If you sign in with Google or Apple, they give us your email address and — if you choose to share them — your name and profile photo.
When you turn on notifications
Your device's push notification token and your notification settings. The token identifies the device, not you personally.
When you follow teams and clubs
The list of your favourites. Without an account it stays only on your device and never reaches us.
When you create or run a match
The content you enter: team names, venue, dates, scores and match events. We also record who created the match.
Always, in the background
Crash diagnostics (device model, OS version, where in the code the error happened). They do not contain your identity.
When you consent to analytics (website)
Information about how you use jakiwynik.app: pages visited, device and browser type, and an approximate region derived from your IP address. It is collected by Google Analytics only with your consent — see section 12.
We do not collect your device's location, do not profile you, do not show ads and never sell your data to anyone.
We do not collect player data. JakiWynik records team results, not records of people. There is no field for a player's first name, surname or date of birth, and we never ask for them. Teams are described by club name and squad number — for example "MOS Wola 2" — never by the names of the players.
3. Why we process data and on what legal basis
Running your account and the app
Basis: performance of a contract — Art. 6(1)(b) GDPR.
Push notifications about matches
Basis: your consent — Art. 6(1)(a) GDPR. You can withdraw it at any time in the app or system settings.
Welcome email after sign-up
Basis: performance of a contract — Art. 6(1)(b) GDPR.
Basis: your consent — Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law. You can withdraw it at any time (section 12).
Anonymous statistics in the mobile app (PostHog)
Basis: our legitimate interest — Art. 6(1)(f) GDPR — in knowing which screens people use and where they get lost. The app sends no account data and no persistent identifier: the identifier lives only until you close the app and is not stored on your phone. You can turn this off in the app's Settings (Help improve the app).
Crash diagnostics and security
Basis: our legitimate interest — Art. 6(1)(f) GDPR — in keeping the app working and preventing abuse.
4. Who processes data on our behalf
We use the services of companies that process data only on our instructions:
Google Ireland Ltd. — Firebase
Authentication, database, file storage, notifications and crash diagnostics. Our resources run in the europe-west1 (Belgium) region, so the data stays in the European Economic Area.
Expo (United States)
Push notification delivery. Your device token and the notification content pass through its servers.
Postmark / Wildbit (United States)
Sending emails, such as the welcome email. Postmark keeps no mailing list for us — only a log of sent messages, which it deletes itself after its retention period.
Search (search.jakiwynik.app)
A search index of matches, clubs and teams, hosted on our own server in the European Economic Area. It contains public content and the ID of the match's author.
Google Ireland Ltd. — Maps Platform
Place suggestions when choosing a venue. As you type a venue name, the text is sent to Google so it can return matching places with their addresses. We do not send your account or your device's location with it. You can skip the suggestions and type the venue manually.
Google Ireland Ltd. — Google Fonts
The website's heading font is loaded from Google's servers, which receive your device's IP address in the process but set no cookies.
Google Ireland Ltd. — Google Analytics
Website visit statistics, only with your consent. The mobile app does not use Google Analytics.
PostHog Inc. — PostHog
Usage statistics, stored on servers in the European Union (Frankfurt). On the website — only with your consent; in the mobile app — anonymously, with an off switch in Settings. No screen recordings and no account data.
Apple and Google
Only if you choose to sign in with their account — they act as the identity provider.
5. When you connect your YouTube account
If you run a match, you can live-stream it to your own YouTube channel straight from your phone. This feature is entirely optional — we ask for YouTube access only when you tap "Connect to YouTube" on the streaming screen. We never ask for it during regular sign-in.
What we ask for
Permission to manage your YouTube channel (the youtube scope). Google offers no narrower permission that allows creating a live broadcast.
What we use it for
Only four things: creating a broadcast on your channel, creating a stream, binding the two together and ending a broadcast you paused and did not return to (after 15 minutes of pause or after the match has ended). The broadcast title is made from the names of the playing teams.
What we do NOT do
We do not read your videos, playlists, subscriptions, comments or channel statistics. We do not change or delete anything we did not create at your request.
Where the access token is kept
The access token stays on your device, inside Google's sign-in mechanism. A single refresh token is sent to our server — encrypted — solely to end a paused broadcast while the app is closed. Without it, the "live" link would show viewers an empty picture indefinitely.
Who can see the broadcast
We create it as unlisted (viewable by link). Making it public is your decision, taken in YouTube Studio — we do not do it for you.
JakiWynik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we do not share this data with anyone, do not use it for advertising, do not use it to train AI or machine learning models and do not read it manually.
You can revoke access at any time on your Google Account permissions page. Broadcasts already created stay on your channel — they belong to you.
6. How we protect your data
We protect the data you entrust to us — including data we receive from Google when you sign in with Google or connect your YouTube account — as follows:
Encryption in transit
All communication between the app or browser and our services, Firebase, our search server and Google APIs uses encrypted HTTPS (TLS) connections only.
Encryption at rest
Data in Firebase (accounts, database, files) is stored on Google Cloud infrastructure in the europe-west1 region and encrypted on disk by Google.
Access control
Our database and file storage security rules deny every read and write by default; access is granted explicitly and narrowly. Your profile, settings and notification tokens can be read and changed only by you, the signed-in account owner. Administrative privileges are granted on the server and cannot be granted to oneself from within the app.
Google and YouTube access token
The access token Google issues after you consent is kept by Google's official sign-in library in your device's secure system storage; the app uses it for direct, encrypted requests to the YouTube API. The refresh token handed to our server is encrypted with AES-256-GCM using a key kept in Google Cloud Secret Manager, separately from the database. It is stored in a part of the database that the security rules make inaccessible to anyone but our server — including you and the app's administrators. The server uses it only to end a paused broadcast. No token is sent to our search index or our crash diagnostics.
Data minimisation
We request only what a given feature needs from Google APIs. We store no data from your YouTube channel on our servers other than the identifier of a paused broadcast — we keep it until the broadcast is resumed or ended. The stream address and stream key are remembered only on your device, so you do not have to reconnect each time.
Human access
Only the data controller has access to the Firebase and Google Cloud consoles and to the search server. We do not view your data manually unless you ask us to (for example when reporting a problem) or security or the law requires it.
Revoking access and deletion
You can revoke YouTube access at any time in your Google Account settings — the tokens on your device and on our server then stop working, and the server deletes its token the first time it tries to use it. When you delete your account, we revoke the server's token with Google, delete it and immediately erase the data described in section 9.
If a personal data breach occurs that may put your rights at risk, we will notify the Polish supervisory authority (UODO) within 72 hours and you without undue delay, as required by Articles 33 and 34 GDPR.
7. Transfers outside the EEA
Some data may leave the European Economic Area for the United States:
Expo — your device token and the push notification content. Don't want that? Don't turn on notifications, or turn them off in settings.
Postmark — your email address and the content of the messages we send you (such as the welcome email).
Google Analytics — only if you consent. The service is provided by Google Ireland, but data may also be processed by Google LLC in the US.
PostHog — data stored in the EU (Frankfurt); PostHog Inc. is based in the US, so its staff may access it when providing technical support.
Expo, Postmark and PostHog operate under Standard Contractual Clauses approved by the European Commission, and Google LLC participates in the EU-US Data Privacy Framework. All other data is processed in the EEA.
8. How long we keep data
Account data
Until you delete your account.
Matches and scores
Indefinitely, but once you delete your account they are no longer linked to you (see section 9). This is shared content — fans of both teams follow it.
Record of account deletion
24 months. We keep only the account ID and dates — no email or name — so we can show that we fulfilled the request.
Crash diagnostics
Up to 90 days.
Google Analytics data
Statistics — up to 14 months. Google Analytics cookies in your browser — up to 2 years, unless you withdraw consent earlier, in which case we delete them.
PostHog data
Statistics — up to 12 months. The PostHog entry in your browser — up to 12 months, unless you withdraw consent earlier, in which case we delete it. The mobile app stores nothing on your phone.
Your cookie choice
12 months — after that we ask again.
9. Deleting your account
You can delete your account yourself, at any time, in two ways:
in the app: Menu → Your profile → Account → Delete account,
Deletion is immediate and irreversible. The following is removed:
your account and the ability to sign in,
your profile: email, name, photo,
followed teams and clubs and your notification settings,
your devices' notification tokens.
We run no mailing list, so there is nothing to unsubscribe you from. The email provider's (Postmark) log keeps a record of messages already sent to you — it deletes that itself after its retention period.
Matches you created remain — but no longer linked to you. The author entry is overwritten, so it no longer points to any person. We do this because a match is shared content: both teams and their fans have a stake in it, and links to it may already be circulating. If you want a particular match removed too, delete it before deleting your account or write to us.
10. Your rights
You have the right to:
access your data and receive a copy of it,
have inaccurate data corrected,
have your data erased (the "right to be forgotten"),
restrict processing,
object to processing based on our legitimate interest,
data portability,
withdraw consent at any time, without affecting earlier processing.
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
11. Children
You must be at least 16 to create a JakiWynik account. If you are younger, ask a parent or guardian — you can browse match results without an account. If we learn that an account was created by a younger person without a guardian's consent, we will delete it.
Youth competitions — under-15, under-17, under-19 — are run without player data. There is no field for a player's name, and organisers may not enter names in a team name or anywhere else (section 4 of the Terms). As a result, a youth match does not reveal who actually played in it.
If you nevertheless find a child's name on the site, write to kontakt@jakiwynik.app — we remove such entries as a priority, without asking for grounds.
12. Cookies and device storage
jakiwynik.app stores two kinds of information in your browser. Essential storage needs no consent, because the site cannot work without it. For analytics we ask on your first visit.
Essential — no consent needed
Your sign-in session (Firebase Authentication, in IndexedDB), so you don't have to sign in on every visit. View settings, recently chosen venues, clubs and teams, and a draft of a tournament you are creating (localStorage). List scroll position (sessionStorage — cleared when you close the tab). Your cookie choice (jw_consent, 12 months). None of this is used for tracking or shared with anyone.
Analytics — only with consent
Google Analytics 4 (Google Ireland Ltd.): the _ga and _ga_3SR1YENCH5 cookies, valid for up to 2 years. They show us which pages are visited and on what devices. PostHog (PostHog Inc., servers in the EU): the ph_…_posthog entry in browser storage and a cookie of the same name, valid for up to 12 months — they show which screens and buttons are used. Without your consent the Google Analytics and PostHog scripts are not loaded at all, so nothing is sent to these tools.
Mobile app
Uses no cookies and no Google Analytics. It stores your settings and favourites on your device.
We do not use advertising or marketing cookies.
You can change or withdraw your consent at any time: (the same button is in the footer of every page). When you withdraw consent, we delete the Google Analytics cookies from your browser. You can also block or delete cookies in your browser settings.
13. Changes to this policy
If we change this policy, we will update the date at the top of this page. We will tell you about significant changes in the app or by email.
14. Contact
Adam Hańczewski INTAH, ul. Baczyńskiego 21, 60-161 Poznań, Poland kontakt@jakiwynik.app