XI Privacy Policy

Last updated: [DATE OF PUBLISH]

XI ("XI", "we", "us") is a mobile app for building fantasy XIs (starting lineups), predicting match outcomes, and competing on community leaderboards. This page explains what data XI collects, why, how long it's kept, and how to have it deleted. It is written to describe what the app actually does — every claim below was checked against XI's own database schema and source code, not against a template.

If anything here is unclear, contact us at xidreamteamfootball@gmail.com.

Data we collect

We collect only what's needed to run your account, your team, and the predictions/competitions you take part in. The app itself does not request or use your location, contacts, or photo library — XI's own code never asks iOS for any of those permissions, and nothing in the app reads them. (Location has one narrow exception, from our advertising partner rather than XI itself — see "Third-party SDKs" below.)

Account data

• Email address (used to sign you in and for account-related communication; also used to send the App Attestation / password-reset emails Supabase Auth, our authentication provider, sends on our behalf; used for marketing email too, but only if you opt in — see "Marketing emails" below).
• Username (chosen by you at signup; shown publicly next to your predictions, team, and leaderboard entries).

Where this data lives: every table above — your account, team, predictions, credit ledger, purchase records, device tokens, everything this page describes — is stored and processed on Supabase, our backend provider, which hosts XI's authentication, database, and all server-side functions in one project on AWS infrastructure in the eu-west-1 (Ireland) region. Supabase Auth (mentioned above) is one part of that same platform, not a separate vendor. See "Third-party SDKs & processors" below for the other companies with any access to your data.

User content

• Your team: the formation, plan, and lineup of players you pick, plus its computed rating and written review.
• Your predictions: the scorelines you submit for matches, and the short written reason you give for each one. Predictions and reasons are shown publicly next to your username (this is the core social feature of the app), and may be quoted by the automated match referee's report.
• Reports you file against another prediction, and any account you choose to block. These are private to your own account — nobody else can see who reported or blocked whom.
• Friendly challenges you send or receive, and their outcome.

Purchase records

• If you buy a credit pack or XI Pro subscription, we store the App Store transaction id, which product you bought, and when it was credited to your account. We never see or store your card number, billing address, or any other payment details — Apple's App Store handles the transaction directly, and only hands us the receipt/transaction id to confirm what you bought.

Device data

• If you allow notifications, we store your device's push token so we can send you match and verdict alerts. You can turn this off in iOS Settings at any time; the token stops being used once notifications are disabled or you sign out.
• If you consent to it (see "Advertising" below), an advertising identifier is used to serve and measure ads.

Advertising identifiers — only with your consent

• XI shows ads to free (non-subscriber) users through Google AdMob. Before any ad loads, we ask for your consent (via Google's User Messaging Platform) and, on iOS, request App Tracking Transparency (ATT) permission. If you decline either, you still see ads, but they are not personalized and your advertising identifier is not used for tracking. XI Pro subscribers never see ads and never go through this flow at all.

Third-party SDKs & processors

Two outside companies touch your data as part of running XI, and only in the ways described here — we don't hand your data to anyone else.

Google Mobile Ads (AdMob) — only for free (non-Pro) users, and only after you've been through the consent flow above. Google's own SDK, bundled with XI, declares (in the privacy manifest Apple requires every SDK to publish) that it collects:

• Device identifiers — the advertising identifier and other device IDs, used to serve and measure ads (and, if you consented via ATT/UMP, for cross-app ad tracking).
• Coarse location — inferred from your network connection (e.g. IP address), not GPS or any location permission XI requests — used to serve regionally-relevant ads. This is Google's SDK doing this on-device, independently of anything XI's own code asks iOS for; it's why the location line above is scoped to "the app itself" rather than a blanket "we never see your location."
• Ad-interaction and diagnostic data — which ads you saw/tapped, plus the SDK's own performance/crash data, for measurement and to keep the ads SDK working.

None of this runs, and none of it is collected, for XI Pro subscribers — ad initialization is gated in code behind Pro status, so the SDK never starts for them. For the exact declared data types, see Google's own ad-services privacy documentation: {GOOGLE_ADS_PRIVACY_DOCS_URL} (placeholder — link Google's current AdMob/UMP data-disclosure page here before publishing).

Supabase — our backend provider (see "Where this data lives" above) processes every data category on this page on our behalf, under its own hosting agreement; it does not use your data for its own purposes.

Usage implied by your activity

• Actions that earn or spend credits (predicting, winning a match, watching a rewarded ad, buying a credit pack, referring a friend, etc.) are recorded in your account's credit ledger, which you can see in-app under Profile. This is bookkeeping for the in-app economy, not a behavioral profile — it is never sold or shared, and is used only to keep your own balance correct.

Marketing emails

Sending you marketing email is entirely opt-in, off by default. When you create your account, or any time afterward in Profile → News & Updates, you can turn on "Send me XI news and updates." Leaving it off (the default — nobody is signed up for this without asking) means we never send you anything beyond the account-related email described under "Account data" above (sign-in, password reset).

If you do turn it on:

• What we send: occasional email about new features, gameplay updates, and other XI news — nothing else, and never more than a handful of emails a month.
• The address we use is the same one already on your account — turning this on does not collect any new information about you, it only changes what we're allowed to send to the email address you already gave us at signup.
• Your email is never sold, shared, or handed to a marketing/advertising third party for this or any other purpose — see "No sale of data" below, which applies here without exception.
• You can turn it off just as easily as you turned it on — the same Profile toggle, any time — or via the unsubscribe link included in every marketing email itself, once that sending infrastructure is live. Turning it off takes effect immediately and stops future marketing email; it never affects the account-related email XI still needs to send you (sign-in, password reset) to keep your account working.

We record the date you opted in (and clear that record the moment you opt out) so we can show you, and prove to regulators if ever asked, exactly when consent was given — standard GDPR recordkeeping, not something used for any other purpose.

What we don't collect

XI's own code does not collect or request access to your contacts, calendar, photo library, microphone, or camera. XI has no feature that uses any of these, and the app never asks iOS for permission to any of them. The same is true of precise (GPS) location — XI never requests it. The one exception is the coarse, network-inferred location Google's bundled ad SDK collects for free-tier users, described under "Third-party SDKs & processors" above — that's Google's SDK acting on its own, not a permission or feature XI itself asks for.

Why we collect it

• To create and secure your account, and let you sign back in.
• To run the app's core features: building a team, submitting predictions, seeing match verdicts, and competing on leaderboards and in your division.
• To credit purchases and rewarded-ad credits to the right account.
• To send you notifications you've opted into.
• To show ads that keep the free tier of XI running, only after you've had the chance to consent (or decline) via Google's consent flow and Apple's ATT prompt.
• To send you marketing email about new features and XI news, only if you've opted in (see "Marketing emails" above) — never on by default.
• To moderate content: reports and blocks exist so abusive or spammy predictions can be hidden from public view pending review, and so you can stop seeing a specific user's activity.

How long we keep it

We keep your account data and content for as long as your account exists. Purchase records are kept for as long as your account exists, for accounting and App Store compliance purposes. Device push tokens are removed once notifications are turned off, the app is uninstalled (Apple reports this to us), or your account is deleted.

Deleting your data

You can delete your account at any time, entirely inside the app: Profile → Delete Account. This immediately:

• Removes your predictions, votes, reports, blocks, and credit-ledger history.
• Deletes your team outright, unless it has already played a match — in that case the team is kept (so match history and other players' results stay intact) but is anonymized: its link to your account is permanently removed, and it no longer carries any username, email, or other identifying information.
• Deletes your profile and signs you out. This cannot be undone from within the app.

If you'd rather request deletion or ask what data we hold on you by email instead of using the in-app flow, contact xidreamteamfootball@gmail.com and we'll act on it directly.

No sale of data

We do not sell your personal data to anyone, for any reason.

Your rights (GDPR / CCPA-CPRA, in plain language)

If you're in the EU/UK or California, you have the right to:

• Access the data we hold about you — ask at xidreamteamfootball@gmail.com.
• Correct inaccurate data — most of it (username, team, predictions) you can already edit yourself in the app.
• Delete your data — use Profile → Delete Account, or email us.
• Object to or opt out of ad personalization — decline consent in the Google consent form on first launch, or change your choice any time via Profile → Privacy Choices; XI Pro subscribers see no ads at all.
• Opt out of marketing email — it's off by default; if you turned it on, turn it back off any time via Profile → News & Updates (see "Marketing emails" above).
• Data portability — email us and we'll provide a copy of your data in a common format.

California specifically (CCPA/CPRA) — "sharing," not just "sale": we've said above that we don't sell your data, and that's true without qualification. But CPRA also covers "sharing" your data for cross-context behavioral advertising — a separate category precisely for arrangements like ours with Google AdMob, where we don't receive payment for your data but Google does receive your advertising identifier (and the other signals listed under "Third-party SDKs" above) so it can serve and measure ads. That counts as "sharing" under CPRA's definition, and you have the right to opt out of it specifically:

• The opt-out surface is the same consent flow described throughout this page — declining or withdrawing consent in Google's User Messaging Platform (UMP) form (first launch, or any time via Profile → Privacy Choices) stops your advertising identifier from being shared with AdMob for personalized/cross-context advertising. You'll still see ads (funding the free tier), just not personalized ones built on that sharing.
• Buying XI Pro removes ads — and this sharing — entirely. A Pro subscriber's device never initializes the AdMob SDK at all, so nothing is ever shared with Google for as long as the subscription is active.

We don't discriminate against anyone for exercising any of these rights.

Children

XI is not directed at children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect data from them.

Changes to this policy

If this policy changes in a material way, we'll update the "Last updated" date above.

Contact

Questions about this policy or your data: xidreamteamfootball@gmail.com.