This policy explains what data the FootiQX mobile application (Android and iOS) and its online services collect, why, how long it is kept and what your rights are. It applies in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is 2M IT, publisher of the FootiQX application and of the footiqx.com website (see the legal notice). For any question relating to the protection of your data: contact@footiqx.com.
2. Data collected
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (optional for a guest account), username, password (stored only in hashed, irreversible form) | Creating and managing your account, logging in | Performance of a contract (terms of use) |
| Guest account: public identifier (FQ-…), irreversible fingerprints of the device key and the recovery code, results of the app’s integrity checks (Apple App Attest / DeviceCheck, Google Play Integrity), with no device identifier | Signing in without an email address, account recovery, limiting mass account creation and duplicate welcome gifts | Legitimate interest (security of the service and fairness of the game) |
| Game data: games, answers, scores, response times, hints used, rankings, rating and its reliability, statistics | Operation of the game, leaderboards, matches between players, prevention of cheating | Performance of a contract |
| Screen signals during a competitive question: the app left or sent to the background, a screen recording or screenshot reported by the system, with their duration and the question number. Never the screen content, a screenshot or the name of another app. | Game fairness statistics, reviewed by a person: they never change the game, the rating or the account | Legitimate interest |
| Football profile from earlier versions of the application (football followed, how long you have followed it), if you had filled it in. It is no longer collected. | None: it no longer has any effect on questions, matches or rankings; it is only kept until the account is deleted and included when you access your data | Performance of the contract |
| Age declaration: optional “I’m under 18” box (minor or adult) and date of the declaration | Restricting the application to users aged 13 and over; non-personalised advertising for minors | Legal obligation |
| Gems and energy: balances and transaction history (earnings, spending, advertising rewards, purchases) | Management of the game’s virtual currency and energy | Performance of a contract |
| In-app purchases (gem packs, ad-free option): product purchased, transaction ID and date, validation status. Payment is processed by Google Play or the App Store: we never receive your bank or card details. | Delivery of purchases, fraud prevention, accounting obligations | Performance of a contract, legal obligation |
| Technical data: IP address, date and time of requests, technical errors | Security, prevention of abuse, fault diagnosis | Legitimate interest |
| Advertising data processed by Google AdMob (see section 4) | Display of non-personalised advertisements, frequency capping, aggregated measurement, rewards, fraud prevention | Consent (access to information on your device, collected by the consent message); legitimate interest (fraud prevention) |
| Aggregated advertising log: number of ad opportunities, loads, impressions, closes and failures, per day, platform and consent status, without any advertising or device identifier; for each finished game, a “full-screen ad shown” flag | Enforcing the advertising frequency rules, monitoring that ads work properly | Legitimate interest |
We do not sell your personal data.
Football profile and question difficulty
FootiQX no longer collects a football profile. If you filled one in with an earlier version of the application, it is kept without any use, is never visible to other players and is deleted with your account. Question difficulty is never adapted individually to your profile, country, language or level: in a head-to-head, both players get the same questions and the same options, at the same moment, and the language only changes the translation. Your answers are also used, in aggregated form, to measure how difficult questions really are and to spot those that need correcting.
3. Data stored on your device
The application stores your login token (to keep you logged in) and your preferences (sound, music) on your device. With a guest account, it also stores a random key that proves this account is yours, in the device’s secure storage and, where your system offers it, in its encrypted backup (iCloud Keychain on iPhone, Google Block Store on Android), so that the account can be recovered after a reinstall — without any guarantee. The server keeps only an irreversible fingerprint of it. No other data is backed up to the cloud by the application.
4. Advertising (Google AdMob)
The application displays advertisements provided by Google AdMob (Google Ireland Limited / Google LLC): at most one full-screen ad every three finished games (never during a question) and videos that you can choose to watch to regain energy. All ads are requested in non-personalised mode: they are not chosen on the basis of your profile or of your activity in other apps.
The application does not ask for iOS tracking permission (App Tracking Transparency) and does not use the IDFA; on Android, it does not request access to the advertising ID. Even for non-personalised ads, Google may process your IP address, information about the device and the application, and data on your interactions with ads, in order to display them, cap their frequency, measure their performance in aggregated form and fight fraud.
- Consent (Europe): on first launch, a consent message managed by Google (an IAB TCF-certified platform) lets you make your choices. You can change them at any time in the application (“Manage my privacy choices”).
- When consent is required and has not been given, no ads are shown. If you refuse some purposes, only limited ads may be shown, depending on what Google offers.
When you watch a rewarded video, Google sends our servers a signed confirmation containing your FootiQX player ID and a transaction ID, so that your reward can be credited.
Our servers keep an aggregated advertising log (number of opportunities, loads, impressions, closes and failures, per day, platform and consent status), without any advertising or device identifier. To enforce the frequency rules, only a “full-screen ad shown” flag is kept for each finished game, then deleted after 30 days.
Find out more: how Google uses information from sites or apps that use its services and Google’s privacy policy.
5. Recipients and hosting
- Account and game data are hosted in the European Union, on a server located in France (Lauterbourg) provided by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, acting as processor.
- Google (AdMob) for advertising, acting as an independent controller for its own purposes. Transfers outside the European Union may take place, governed by the European Commission’s standard contractual clauses and the EU-U.S. Data Privacy Framework.
- Google (Google Play) and Apple (App Store) for processing payments for in-app purchases, in accordance with their own privacy policies.
- Other players can see only your username, your in-game appearance (avatar, frame, shirt, etc.), your level, your favourite club, the date you signed up, your scores, your rating and your ranking. Your football profile, if any, and your age declaration are never visible to other players.
6. Retention periods
- Account and game data, football profile (if any) and age declaration: for as long as your account exists, then deleted within 30 days of the account’s deletion.
- Guest account with no purchases: deleted after 2 years without any use (accounts with purchases are kept).
- Technical logs: 31 days.
- Records of in-app purchases: 10 years (accounting obligations), even after the account has been deleted, in a form limited to the transaction.
- History of advertising rewards: for as long as the account exists (prevention of double crediting and fraud).
- “Full-screen ad shown” flag of a finished game: 30 days. The aggregated advertising log contains no personal data.
- Screen signals of competitive questions: 180 days, then deleted automatically.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right to withdraw your consent at any time. To exercise these rights, write to contact@footiqx.com from the email address associated with your account. We will respond within one month.
To delete your account, see the Delete my account page.
You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
8. Minors
The application is not intended for children under 13. By creating an account, you confirm that you are at least 13. An optional “I’m under 18” box is offered when signing up and in “My account”. We do not ask for your date of birth: only the “minor” or “adult” indication (box ticked or not) and the date of the declaration are recorded.
Like every player, accounts declared as minors receive only non-personalised advertisements. This declaration has no effect on the difficulty of questions, matches or rankings.
9. Security
Communications between the application and our servers are encrypted (HTTPS). Passwords are stored in hashed form. Access to the servers is restricted.
10. Changes
This policy may change. In the event of a significant change, you will be informed in the application.
11. The footiqx.com website
The footiqx.com website uses no cookies, no audience measurement tools and no third-party services (fonts, scripts and images are hosted on our own server). The server records technical logs (IP address, date, page requested, browser) for security and diagnostic purposes, retained as set out in section 6. The “Notify me” links simply open your email application: if you write to us, your email address is used solely to reply to you and to notify you of the application’s release, and is deleted upon request.