Privacy Policy

Version 2.1 · Effective 2026-10-29

In short. GOALit is a free football prediction game. We collect the account details you give us (or that Apple / XSTRA share when you sign in that way), the game activity you generate (guesses, picks, tournaments, chat), and basic technical data needed to run the service securely. We never sell or share your personal data, we run no advertising or tracking SDKs, and there's nothing hidden: this page lists every category of data we hold, why, for how long, and how to see, export or delete it. If anything below conflicts with the Hebrew version of this policy, the Hebrew version governs.

This Privacy Policy explains how Crownerv Ltd, an Israeli private company, company no. 517411823 ("Crownerv", "we", "us" — Crownerv always refers to the company, never to an individual) collects, uses, shares, and protects personal data in connection with the GOALit mobile app ("GOALit", "the App") and the pages at this domain. Crownerv is the controller of the personal data described here, within the meaning of both the Israeli Protection of Privacy Law, 5741-1981 ("PPL") and the EU/UK General Data Protection Regulation ("GDPR").

Registered office: Ha'Rechs 78, Ma'ale Adumim, Israel. Contact for all privacy matters: [email protected]. General support: [email protected].

1. Scope and who this policy is for

This policy applies to everyone who downloads, installs, or uses GOALit, wherever they live. Later sections call out rights that apply specifically if you are in Israel, the EU/EEA or UK, or the United States (California) — read the section relevant to you alongside the parts that apply to everyone.

2. The data we collect, and why

Category	Examples	Source	Purpose	Legal basis (GDPR)	Who can see it
Account identity	Display name (max. 40 characters); email address; for Sign in with Apple, the identifier Apple assigns and the name/email Apple shares (which may be a private relay address); for Sign in with XSTRA, the identity XSTRA shares (XSTRA user ID, name, email and, if you have one, the link to your XSTRA profile picture, which we use as your GOALit photo until you change it — nothing else from XSTRA); for email sign-up, your login email (stored lowercased) and a one-way scrypt hash of your password (we never store the password itself)	You, or Apple / XSTRA if you use those sign-in options	Create, identify and secure your account; let you sign in	Performance of a contract (Art. 6(1)(b)); security processing under legitimate interest (Art. 6(1)(f))	Other users see only your display name and, if set, your profile photo
Profile photo	A small square JPEG/PNG you take or choose, resized on your device before upload	You	Personalize your profile; shown to other users	Consent — uploading a photo is optional (Art. 6(1)(a))	Visible to other users via the app and the photo's URL; you can remove it any time
Game activity	Favorite leagues, teams and players; tournaments you create or join, their join codes and optional passwords; your score guesses and champion / top-scorer picks; your default guess; the order you arrange your tournaments in	You, through app use	Run the game: scoring, leaderboards, Titles	Performance of a contract (Art. 6(1)(b))	Guesses are hidden from other members until kickoff; afterwards your name and guess are visible to members of that tournament. Official tournaments are open to every user
Chat messages	Text you send in a tournament's chat (max. 1,000 characters)	You	Let tournament members talk to each other	Performance of a contract / legitimate interest (Art. 6(1)(b)/(f))	Members of that tournament; a copy is retained in our moderation queue if the message is reported
Reports and blocks	Who and what you report (a message, photo, name or tournament), the reason, and a copy of the reported content at the time you reported it; the list of users you've blocked	You	Keep the app safe; enforce our Community Guidelines	Legitimate interest in platform safety (Art. 6(1)(f))	Crownerv moderators/admins only; the person you reported is not told who reported them
Notification settings and push token	Per-category toggles (kickoff reminders, results, chat, matches you follow, and — for admins only — new reports); an Expo push token per device	You; generated by your device once you grant notification permission	Send you the push notifications you've asked for	Consent, reflected through iOS notification permission and your in-app toggles	Crownerv, and our delivery processors (Apple APNs, Expo)
Sign-in tokens	A short-lived access token (1 hour) and a longer-lived, rotating refresh token (expires automatically after up to 180 days, or sooner on sign-out); for Sign in with Apple, a refresh token kept solely so we can revoke Apple's grant if you delete your account	Generated by our server when you sign in	Keep you signed in without re-entering credentials every time, securely	Performance of a contract (Art. 6(1)(b))	Not visible to anyone; stored in our database, not returned by the API except at the moment you sign in
Technical / security data	Your IP address as seen by our servers	Automatically, from your connection	Rate-limit abuse, detect attacks, operate the service securely	Legitimate interest in security (Art. 6(1)(f))	Crownerv and our hosting provider; not stored as part of your account record, only in short-lived operational logs

Notice under Section 11 of the Protection of Privacy Law

Providing the data above is voluntary, but most of it is required to create an account or use the corresponding feature (for example, we cannot create an account without a name and a way to sign you in, and we cannot show a profile photo you never uploaded). There is no legal obligation on you to provide any of this data — the consequence of not providing it is simply that the related feature won't work. Recipients of data transferred outside Crownerv, and the purpose of each transfer, are listed in §8 "Who we share data with" below. You have a right of access and correction as described in §15.

GOALit offers: Sign in with Apple (Apple shares only what you authorize — your name and an email address, possibly a private relay address); Sign in with XSTRA, XSTRA's social platform at xstra.net, a project operated by Crownerv Ltd (company no. 517411823, Israel) — the same company that operates GOALit — which shares only your XSTRA user ID, name, email and profile-picture link (the standard openid, email and profile permissions) and nothing else about your XSTRA activity; if your GOALit photo is your XSTRA picture, it is loaded from XSTRA's servers when shown. You can link or unlink XSTRA from Settings → Account at any time (unlinking is possible when you have another way to sign in; linking also works for an existing GOALit account); and email and password. We do not offer Google sign-in to users even though the underlying code exists; it is switched off.

4. On your device: local storage and cookies

The App stores your sign-in tokens, theme, language, and your accessibility and sound/haptic preferences locally on your device, using secure storage. The GOALit web pages (including this one) set no cookies. We run no analytics SDK, no crash-reporting SDK, no advertising SDK, and no cross-app or cross-site tracking — there is nothing for Apple's App Tracking Transparency prompt to ask permission for. Expo, our app-update provider, checks Expo's own servers for app updates; in doing so Expo's servers see your device's IP address, device and app-version metadata. See §8 for Expo's role.

5. Push notifications

Push notifications are sent only if you grant iOS notification permission and only for the categories you've turned on in Settings → Notifications. Kickoff reminders are off by default; results, chat, and matches-you-follow notifications are on by default (you can turn any of them off at any time). Report alerts are a separate, admin-only category used to notify Crownerv's moderators of new reports — they are never sent to ordinary users, and are delivered both by push and, optionally, as a message into Crownerv's internal moderation workspace (see §8).

6. Your profile photo and what other users can see

Your display name, and profile photo if you add one, are visible to anyone you share a tournament with, and to anyone if you join an official, publicly open tournament. Your chat messages are visible to the members of the tournament you post them in. Your guesses are hidden from other members until the match kicks off, after which they become visible to that tournament's members. We do not display your email address to other users under any circumstance.

7. Reports and moderation

Long-pressing a message, profile photo, display name, or tournament lets you report it or block the user. A copy of the reported content, the reporter, the reported user, and the reason are stored in an internal moderation queue. A chat message reported by two different members is automatically hidden for everyone, pending review. New reports alert Crownerv's app admins by push notification and, optionally, as a message into Crownerv's internal company workspace (Crownerv Suite) — only Crownerv staff can see these alerts. See the Community Guidelines for what we do with reports and how quickly we review them.

8. Automated decisions

We do not make any decision about you, using automated means, that produces legal effects or similarly significantly affects you. Scoring — comparing your guess to the match result and awarding points — is deterministic game logic applied equally to everyone's guesses, not profiling of you as a person. The filter that blocks profanity in names is a simple word-list check with no effect beyond rejecting the input; you can always try a different name.

9. Data portability: downloading and restoring your data

Settings → Account offers two tools that implement your right to data portability (Article 20 GDPR; the right of access under Israeli privacy law):

Download my data produces a single JSON file containing your own data — profile, settings, favorites, tournament memberships, predictions, your own chat messages, reports you filed, users you've blocked, and your profile photo. It also includes the join codes of your tournaments, so treat the file as private and share it only with people you trust. The App hands it to iOS's share sheet so you can save or send it anywhere you like. The file is digitally signed by our server.
Restore from file lets you load a file you downloaded this way back into the same account or a new one, with your choice of merge (add to what's already there) or overwrite (replace it). Restoring brings back your personal settings, favorites and profile, and — only for tournaments you are currently a member of — guesses for matches that have not yet kicked off. Because the file is signed by our server, a file exported by one live account cannot be imported into another live account. Chat messages in an export are never re-posted when you restore, and administrative flags (such as the admin role, ban status, or moderation history) are never imported, regardless of what a file contains.

This is separate from, and does not replace, your right to request a copy of your data or ask us to delete it by writing to [email protected] — see §15.

We use the following service providers ("processors") to run GOALit. None of them may use your data for their own purposes.

Processor	Role	Country / region
Fly.io, Inc.	Application hosting — our API runs on servers in Frankfurt, Germany	Company: United States; servers: Germany (EU)
MongoDB, Inc. (MongoDB Atlas)	Database hosting	Company: United States; database servers: Frankfurt, Germany (EU)
Apple Inc. / Apple Distribution International Ltd.	Sign in with Apple; delivery of push notifications (APNs); App Store distribution and billing-free in-app purchase infrastructure (unused)	United States / Ireland (EU)
650 Industries, Inc. (Expo)	Relay for push notifications to Apple; over-the-air app updates	United States
XSTRA (xstra.net)	Identity provider for Sign in with XSTRA — shares only identity data (user ID, name, email, profile-picture link) with us	Crownerv Ltd's own project (not a third party) — Israel. XSTRA operates mainly in Israel, its website is available in all countries, and it may be restricted in certain countries
API-Sports (API-Football, api-sports.io)	Football data: scores, fixtures, standings, club/competition/player names and images	France (its terms of service are governed by French law) — receives no personal data about you
Crownerv Suite (suite.crownerv.com)	Crownerv's own internal company workspace, used to alert our staff to new moderation reports	Israel — Crownerv's own system, not a third party

We do not sell personal data, and we do not share it for cross-context behavioral advertising or any other advertising purpose — see the California subsection of §15 for the CCPA/CPRA-specific statement. We may disclose data if required by law, a valid court order, or to protect the rights, property or safety of Crownerv, our users, or the public.

11. International data transfers

Crownerv is based in Israel. Our infrastructure runs in the EU (Frankfurt, Germany), while several of our processors — Fly.io, Expo/650 Industries, Apple, and MongoDB, Inc. — are US-headquartered companies, which means data can be processed in, or accessed from, the United States. Israel benefits from a European Commission adequacy decision, which facilitates data flows from the EU/EEA to Crownerv as controller. For transfers from Crownerv or its EU-based infrastructure to these US processors, we rely on Standard Contractual Clauses and, where the processor participates, the EU-U.S. Data Privacy Framework (and the equivalent UK and Swiss extensions). You can ask us for more detail about a specific transfer by writing to [email protected].

12. How long we keep your data

Data	Retention
Account and profile	Until you delete your account
Profile photo	Until you remove it or delete your account
Chat messages	Until deleted, the tournament is removed, or your account is deleted
Guesses, picks, tournament membership	Until your account is deleted. A finished tournament's final ranking (rank and points, keyed to an internal account ID — not your name or email) may remain after deletion so that Titles already awarded to other members stay intact; once your account is deleted this entry can no longer be linked back to you by anyone
Reports you filed, or that were filed about you	Retained after you delete your account, for safety and legal purposes; the account is shown as "Deleted account" and your name, email and photo are removed from the record, keeping only an internal account ID reference, the reason and the reported-content snapshot needed for moderation
Push token	Until you sign out, revoke notification permission, change devices, or delete your account
Access token	1 hour
Refresh token	Expires automatically after up to 180 days, or immediately on sign-out or account deletion
IP address	Processed transiently for rate-limiting; not stored as part of your account. Our hosting provider's operational logs are kept for a short, limited period
Backups	Overwritten within 30 days — this is our stated commitment, not a guarantee that every residual copy is gone sooner
Your acceptance of these Terms and this Policy	Kept for as long as your account exists, as a record of consent

13. Security

We use TLS encryption for data in transit; passwords are hashed with scrypt and never stored in reversible form; access to our systems is role-based and limited to what each function needs; sign-in uses short-lived access tokens and rotating refresh tokens; uploaded photos are validated for type and size before storage; and our API applies rate limiting and standard security headers. No system is perfectly secure, and we cannot guarantee absolute security.

14. If something goes wrong (data breach)

If we become aware of a security incident affecting your personal data, we will assess it under the Privacy Protection (Data Security) Regulations, 5777-2017, and, where required, notify the Israeli Privacy Protection Authority and affected individuals, and — for data covered by the GDPR — the competent supervisory authority without undue delay and, where feasible, within 72 hours, and affected individuals where the incident is likely to result in a high risk to their rights and freedoms.

15. Your privacy rights

If you are in Israel

Under the Protection of Privacy Law, you have a right to inspect the information we hold about you and to request that we correct or delete it if it is incorrect, incomplete, unclear or outdated. We will respond to a request to inspect your data within 30 days. You may also complain to the Privacy Protection Authority (הרשות להגנת הפרטיות) if you believe we have mishandled your data.

You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict our processing; object to processing based on legitimate interests; receive your data in a portable format (see §9); and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. We respond to such requests within one month, extendable by a further two months for complex or numerous requests (we'll tell you if that applies). You may lodge a complaint with your local supervisory authority at any time.

If you are in the EU/EEA and our processing of your data is not occasional, Crownerv would need to appoint a representative under Article 27 GDPR (and, for the UK, Article 27 UK GDPR). No EU or UK representative has been appointed at this time; please contact us directly at [email protected], and we will update this section if a representative is appointed.

If you are in California (CCPA/CPRA)

Over the past 12 months we have collected the categories of personal information described in §2, which map to the CCPA/CPRA categories: identifiers (name, email, account identifiers); internet/network activity (IP address, app interaction data); audiovisual information (your profile photo); and user-generated content (chat messages, picks). We do not collect sensitive personal information as defined by the CPRA, and we do not use or disclose sensitive personal information beyond what's necessary to provide the app. We do not sell or share personal information, including for cross-context behavioral advertising. Whether or not CCPA/CPRA's size thresholds apply to Crownerv, we honor these rights for California residents: the right to know/access, delete, and correct your personal information; the right to opt out of sale/sharing (not applicable — we don't do either); the right to limit use of sensitive personal information (not applicable); and the right to non-discrimination for exercising any of these rights. Submit a request to [email protected]; you may use an authorized agent, in which case we may ask for written proof of the agent's authority and verify your identity directly.

16. Children and minimum age

GOALit is rated for ages 13 and up, and you must be at least 13 years old to create an account. We do not knowingly collect personal data from children under 13; if we learn that we have, we will delete the account and associated data promptly. This complies with the US Children's Online Privacy Protection Act (COPPA), which protects children under 13.

If you are in the European Union or another jurisdiction that sets a higher minimum age for a child to consent to this kind of service on their own (under the GDPR, member states may set this age anywhere from 13 to 16), and you are below that age, please use GOALit only with the knowledge and consent of a parent or guardian.

17. How to exercise your rights

For most requests, the fastest option is in the app: Settings → Account → Download my data for a copy of your data, or Delete account to erase it. For anything else — correction, a question about this policy, or a request under a right described above — write to [email protected]. We will ask for enough information to verify your identity before acting on sensitive requests (e.g., deletion), proportionate to the request.

18. Regulatory information

Data security officer. Based on our current size and the scope of our processing, we do not meet the thresholds in the Privacy Protection (Data Security) Regulations, 5777-2017 that require appointing a database security officer; we will appoint one if those thresholds are met. In the meantime, direct any data-security question to [email protected].
Database registration. Following Amendment 13 to the Protection of Privacy Law (in force from 14 August 2025), our assessment is that our database does not meet the narrowed criteria that currently require registration with the Privacy Protection Authority (broadly: databases of sensitive information held at scale, data broker databases, or large public-sector databases). We will revisit this assessment if our processing changes.
Governing law for this section. Where Israeli and EU/UK law both apply and genuinely conflict on a point addressed in this policy, we apply whichever standard gives you the stronger protection.

19. Consenting to this policy

When you create a GOALit account, you are asked to tick a box confirming that you accept our Terms of Use and acknowledge this Privacy Policy. We record the version of each document and the date and time you accepted them on your account. If we make a material change to either document, we will ask you, in the app, to review and accept the new version before you can keep using GOALit.

20. Changes to this policy

We may update this policy as GOALit changes or the law requires. For material changes, we will ask you to re-accept the new version in the app as described above (not merely update the date on this page). For non-material changes we will update the version and effective date above.

21. Contact

Crownerv Ltd, company no. 517411823. Registered address: Ha'Rechs 78, Ma'ale Adumim, Israel. Privacy and rights requests: [email protected]. General support: [email protected].