Last updated: August 10, 2026
The controller responsible for data processing in the "Football Spy" app is:
Horster & Vahldieck GbR represented by its partners David Horster and Jasper Vahldieck Am Ziegelofen 3, 40668 Meerbusch, Germany E-mail: vahlhogames1506@gmail.com
We collect data you voluntarily provide – in particular a freely chosen username (max. 12 characters) and inputs in online features (e.g. names and, where offered, chat messages). If you contact us by e-mail, we process the data you provide. We do not process special categories of personal data (Art. 9 GDPR).
On first launch, the app signs you in anonymously (Firebase Authentication), creating a random user identifier (UID). No registration with name, e-mail or password takes place, and no account can be created.
When you use the app, we automatically collect certain technical information that does not directly identify you:
We process data to:
We share data with carefully selected service providers acting on our behalf (processors) or as independent recipients. Contractual safeguards (incl. data processing agreements and standard contractual clauses) are in place.
| Service | Provider | Purpose |
|---|---|---|
| Firebase Authentication | Google Ireland Ltd. / Google LLC | Anonymous sign-in (UID) |
| Cloud Firestore | Google Ireland Ltd. / Google LLC | Leaderboard, online multiplayer, app config |
| Firebase Analytics | Google Ireland Ltd. / Google LLC | Usage analytics (only with consent) |
| Google AdMob | Google Ireland Ltd. / Google LLC | Advertising in the free version |
| RevenueCat | RevenueCat, Inc. (USA) | Managing and verifying the subscription |
| App Store / Google Play | Apple Inc. / Google | Purchase and payment processing |
We may also share data in the context of business transactions (e.g. merger, sale, acquisition) and where necessary to comply with legal obligations or to establish, exercise or defend legal claims.
For online features you choose a username. We strongly recommend not using your real name.
When you take part in a challenge, we store an entry in Cloud Firestore containing
your username (display_name), best score (score), game mode, anonymous UID,
timestamp and an expiry date (expires_at). Your username and score are
publicly visible to other signed-in users.
In online multiplayer, lobby data, game states and – where offered – names and chat messages are processed and shown to other players. Inputs are checked against a blocklist. Do not enter personal data about yourself or others in names or chat.
Retention of leaderboard entries: automatic deletion 90 days after the end of the respective challenge. For deletion on request, see Section 13.
The free version is funded by advertising (banner and rewarded ads) from Google AdMob. On launch, we obtain your advertising choice via the Google User Messaging Platform (UMP):
You can change your advertising consent at any time in the app's privacy settings.
iOS note: If the advertising identifier (IDFA) is used for advertising on Apple devices, the operating system additionally asks for your permission via the App Tracking Transparency (ATT) dialog.
"Football Spy Premium" is an optional subscription that removes advertising, available on iOS and Android. No app account is required to purchase – the subscription is tied to your Apple ID / Google Play account and can be reactivated after reinstalling via "Restore Purchases".
Payment and processing are handled solely by Apple or Google; we store no payment or card data. To manage and verify the subscription status we use RevenueCat (transaction/purchase data such as purchase and expiry date, product identifier, platform user/device identifier). RevenueCat privacy notice: https://www.revenuecat.com/privacy
In mobile apps, instead of classic cookies we mainly use SDK identifiers and device/advertising identifiers (e.g. via Firebase and AdMob). These serve core functionality, security and – with your consent – analytics and advertising. You can exercise control via the consent dialog (Section 6) and your device settings (e.g. resetting the advertising ID).
When using the services above, data may be transferred to third countries, in particular the USA (incl. Google/Firebase, AdMob, RevenueCat, Apple). For these transfers we rely on appropriate safeguards under Art. 46 GDPR, in particular the EU Commission's Standard Contractual Clauses, and – where applicable – the recipients' certification under the EU-U.S. Data Privacy Framework. Further details are available on request.
We retain personal data only as long as necessary for the stated purposes or as required by law. In particular:
We take appropriate technical and organisational measures to protect your data. Despite all care, no transmission over the internet or storage technology can be guaranteed to be entirely secure. Use online features only in a secure environment.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw it at any time with future effect (Art. 7(3) GDPR) without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, simply e-mail vahlhogames1506@gmail.com.
Right to complain: You may lodge a complaint with a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Because we keep no accounts and no real names, you can remove data stored on the device (incl. the username) by uninstalling the app or via the app settings. If you want a public leaderboard entry removed before its automatic deletion, just e-mail vahlhogames1506@gmail.com and we will delete the entry.
There is currently no uniform standard for interpreting "Do-Not-Track" signals, so we do not respond to them. You control your advertising and analytics consent via the consent dialog (Section 6).
Residents of certain U.S. states (incl. California, Colorado, Connecticut, Virginia, Texas and others) may have the right to request access to the data processed about them, to have it corrected or deleted, to obtain a copy, and to opt out of processing for targeted advertising or a "sale"/"sharing". To the extent serving personalised ads via AdMob qualifies as a "sale" or "sharing" under applicable U.S. law, you can disable it via the consent dialog. Send requests to vahlhogames1506@gmail.com; on request we will designate an authorised agent. You also have a right to appeal/complain to the competent authority of your state.
Canada: You may give consent expressly or implicitly and withdraw it at any time. In statutory exceptional cases we may process data without consent (e.g. fraud investigation).
Australia and New Zealand: We process data under the Privacy Act 1988 (AU) and the Privacy Act 2020 (NZ). You may request access and correction and complain to the relevant authority (OAIC or the Office of the NZ Privacy Commissioner).
Republic of South Africa: You may request access and correction and complain to the Information Regulator (South Africa) (enquiries@inforegulator.org.za).
The app is intended for a general audience and is not directed at children. For consent to data-relevant processing (analytics, personalised advertising), a minimum age of 16 applies in Germany; younger persons require the consent of a parent/guardian. If we become aware that we have processed a child's data without the required consent, we will delete it.
The app may link to third-party websites or services or contain third-party advertising. We are not responsible for their content or privacy practices; the respective providers' privacy notices apply.
We will update this Privacy Policy when our processing or the legal situation changes. The version available in the app (identifiable by the "Last updated" date) applies.
Horster & Vahldieck GbR, Am Ziegelofen 3, 40668 Meerbusch, Germany, vahlhogames1506@gmail.com