Final Whistle: Scoreboard

Privacy Policy

Effective date: May 2, 2026

Effective Date: 2026-05-02 Last Updated: 2026-05-07

DongNe ("we", "us", "our") provides the mobile and web application Final Whistle: Scoreboard (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and how you can exercise your rights.

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account information (Apple, Google, or email)

Email address (required)
Display name, profile picture URL (if provided by Apple or Google)
Firebase Authentication UID — auto-generated identifier

1.2 Device data (collected automatically)

Operating system, app version, device model (Firebase Crashlytics, Analytics)
Time zone, language preference
Firebase Cloud Messaging token — non-identifying device-bound token used for push notifications
Usage events — anonymized in-app interactions (screen views, taps, session length) collected via Firebase Analytics

1.3 Content you create

Tournament & club data — clubs you create or join, tournaments you organize or enter, match results, disputes, admin rulings
Participation records — club memberships, tournament entries, posted comments
Shared scoreboard access logs — aggregated traffic on shared links
Purchase records — Apple/Google IAP receipt identifiers, transaction time, club/membership applied (we do not store payment instruments such as card numbers or bank accounts; those remain with Apple/Google)

1.4 Advertising data (free users only)

Advertising identifier (IDFA / AAID) — used by Google AdMob for ad delivery, deduplication, and fraud prevention.
Device & app context — OS version, device model, app language, ad impression and click events.
On iOS we request consent through the App Tracking Transparency dialog; if you decline, only non-personalized ads are shown. EU/EEA residents see the Google UMP (User Messaging Platform) consent form.
Plus members do not see ads, and the advertising data above is not collected for them.

We do not collect: precise location, health or medical data, financial account numbers, contact lists, or photos outside what you actively upload.

2. How We Use Your Information

Data	Purpose
Firebase UID	User identification, data isolation
Email, display name	Account recovery, multi-device sync
Profile picture	Display in tournaments, matches, and standings
Time zone, locale	UI localization, accurate match timestamps
User content (clubs, tournaments, results)	Core service functionality
FCM token	Send push notifications (your turn, results posted, etc.)
Usage events, diagnostic data	Service improvement, crash diagnosis
Purchase records	Verify active club pass / Plus, handle refunds and inquiries, accounting
IDFA/AAID, ad impression events	Show AdMob ads to free (non-Plus) users, deduplicate, prevent fraud

We do not use your data for any purpose beyond those listed above. We do not use your club/tournament content for behavioral advertising or sell it externally (advertising relies solely on the IDFA/AAID and impression events Google AdMob collects on its own).

3. Retention

We retain your data for as long as your account is active.
When you use the in-app "Delete account" function or email a deletion request to mrbigcho@gmail.com, we erase the following within 30 days:

- Firebase Authentication user - Backend database records (profile, memberships, content you authored) - Firebase Cloud Messaging tokens

Clubs and tournaments you created that are still in active use by other participants may persist after you leave. You may delete them yourself before leaving, or request removal afterward.
Diagnostic data (Crashlytics) is retained for up to 90 days.
Analytics events follow Firebase Analytics defaults (currently 2–14 months).
Data we are required to retain by law (e.g., transaction records under Korean e-commerce law for 5 years) is kept separately for the legally required period and then deleted.

4. Sharing & Processors

We do not sell your personal data. We share it only with the following processors who help us run the Service:

Processor	Purpose	Data Shared	Region
Google LLC (Firebase)	Authentication, Crashlytics, Analytics, Cloud Messaging	UID, email, diagnostic data, push tokens, anonymized usage events	United States
Google LLC (AdMob, UMP)	Ad delivery, deduplication, fraud prevention, consent management for free users	IDFA/AAID, ad impression and click events, OS, device model, app language	United States
Apple Inc. (App Store)	iOS IAP processing and receipt validation	Apple ID receipt, transaction ID, subscription status	Per Apple policy
Apple Inc.	Sign in with Apple, push delivery via APNs	Apple ID identifier, push token	Per Apple policy
Google LLC (Play Billing)	Android IAP processing and receipt validation	Purchase token, transaction ID, subscription status	United States
RevenueCat, Inc.	IAP receipt validation, subscription state tracking, event webhooks	Identifier (our profile ID), Apple/Google transaction IDs, subscription active status, locale and country	United States
Railway Corp.	Backend container hosting	Backend traffic and logs, purchase audit logs	United States
Supabase, Inc.	PostgreSQL DB hosting (stores all user data)	All items in §1	South Korea (ap-northeast-2)
Cloudflare, Inc.	Flutter Web static hosting / CDN	Anonymized request logs	Global edge

Each processor's privacy policy:

Content you publish in a public club or tournament (match results, standings, participant lists) is visible to other participants and to anyone with the shared scoreboard link. Private clubs and tournaments are visible only to invited members.

5. International Transfers

Your data is processed on infrastructure located in the United States (Google Cloud, Google AdMob, Apple App Store, Google Play, RevenueCat, Railway) and South Korea (Supabase ap-northeast-2). When you use the Service, you consent to this transfer.

Recipient	Country	When	Data	Purpose	Retention
Google LLC (Firebase)	United States	Continuous from sign-up	All items in §1	Auth, diagnostics, push, analytics	Until account deletion
Google LLC (AdMob)	United States	When a free user views an ad-supported screen	IDFA/AAID, ad impression / click events	Ad delivery, deduplication, fraud prevention	Per Google policy
Apple Inc. / Google LLC (Play)	United States	On IAP purchase / receipt validation	Transaction ID, receipt, subscription status	Payment processing	Statutory accounting / dispute periods
RevenueCat, Inc.	United States	On IAP purchase, renewal, cancellation, refund	Profile ID, transaction ID, subscription active status, locale, country	IAP receipt validation, subscription tracking, event webhooks	Until account deletion
Railway Corp.	United States	Continuous during use	Backend traffic and logs	Container hosting	Until account deletion
Cloudflare, Inc.	Global edge	On web access	IP, request metadata	CDN caching, DDoS mitigation	Within 30 days

For users in the EEA, UK, and Switzerland: we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the lawful basis for the transfer of your personal data outside your jurisdiction.

6. Your Rights

You have the right to:

Access — view all your content and participation records inside the app
Correct — edit profile, club settings, and tournament info inline
Delete — delete individual content, or use "Delete account" in the MY tab. See the Account Deletion guide for details
Restrict / Object — contact mrbigcho@gmail.com
Portability — request a JSON export by emailing mrbigcho@gmail.com (delivered within 30 days)
Withdraw consent — for consent-based processing such as push notifications, via OS or in-app settings

We respond to requests within 30 days. If you are dissatisfied with our response, you may file a complaint with your local data protection authority.

For California residents (CCPA / CPRA): you have the right to know, delete, correct, and limit use of sensitive personal information. We do not sell your club/tournament content for behavioral advertising; however, IDFA/AAID may be shared with Google LLC during ad delivery (which qualifies as "sharing" under CCPA). You can opt out of ad tracking by declining iOS App Tracking Transparency, resetting/deleting the Android advertising ID, or upgrading to Plus (no ads at all).

For EEA / UK / Swiss residents (GDPR): the lawful bases for our processing are:

Contract (Art. 6(1)(b)) — providing the Service you signed up for
Legitimate interests (Art. 6(1)(f)) — security, debugging, feature improvement; you may object at any time
Consent — push notifications and other consent-based processing; withdraw at any time
Legal obligation — where processing is required by law

7. Security

We use the following technical and organizational measures:

TLS 1.2+ encryption for all network traffic
Encryption at rest where supported by our processors
Minimized access to personal data, with access controls and audit logging
Authentication tokens stored in the device's secure storage
Passwords stored as one-way hashes by Firebase Authentication (we never see plaintext)

No system can be completely secure. If we discover a breach affecting your data, we will notify you and the relevant authorities as required by applicable law.

8. Children

Final Whistle is not directed to children under 13 (or under the equivalent age in your jurisdiction, e.g., 14 in Korea, 16 in some EU countries). We do not knowingly collect data from such children. If you become aware that a child has provided us with personal data, please contact mrbigcho@gmail.com and we will delete it.

9. Changes to this Policy

If we change this Policy, we will post the updated version inside the app or notify you by email at least 7 days before it takes effect. For changes that materially affect your rights, we will provide at least 30 days' notice and may ask for your renewed consent.

10. Contact

Field	Detail
Data Controller	DongNe
Representative	Sangwoo Cho
Address	1205-701, 107, Manhyeon-ro, Suji-gu, Yongin-si, Gyeonggi-do, Republic of Korea
Privacy Contact	mrbigcho@gmail.com
Phone	+82-10-3445-4048

Change Log

Version	Effective	Changes
v1.0	2026-05-02	Initial release
v1.1	2026-05-07	Introduced AdMob ads for free users (IDFA/AAID collection with ATT/UMP consent); added IAP payment data and international transfers
v1.2	2026-05-07	Added RevenueCat (IAP receipt validation and subscription state tracking) and Supabase (DB hosting) as data processors