Privacy Policy — thefinal

Who we are

The controller of your personal data is True Growth OÜ, a company registered in Estonia under registry code 16504010, at Pae tn 25-47, 11414 Tallinn, Harju maakond, Estonia. Full details are on the legal notice page.

For anything in this policy — questions, requests, complaints — write to [email protected]. That single address reaches us for every kind of request; there is no separate queue to find.

We have not appointed a Data Protection Officer, and are not required to: we do not carry out large-scale systematic monitoring, and we process no special categories of data. We also need no EU representative under Article 27 — the controller is itself established in the EU.

What we collect, and why we may

Four groups, nothing else. Each is listed with the legal ground we rely on under Article 6 of the GDPR, because a purpose without a ground is just a preference.

What	Why	Legal ground
Account Email address, password, display name, your age declaration, and which revision of the Terms you accepted and when. If you sign in with Google instead of a password, we receive from your Google account its email address, name, profile-photo address and Google account identifier — the game itself uses only the email address, but Firebase Authentication stores them all.	To create and hold your account, to show your display name on leaderboards, and to prove you were told the terms you agreed to.	Performance of a contract — Art. 6(1)(b). Without it there is no account.
Game Your Predictions and Live Moment answers, your Prediction Point balance and spending, your Score and Rating, your Followed Club, your leaderboard positions.	To run the game: to resolve Predictions against real match events, keep your budget, and rank you.	Performance of a contract — Art. 6(1)(b). This is the service.
Technical IP address, browser and device type, the pages and API paths you requested, timestamps, and error reports when something crashes (which include your account identifier so we can tell one player's broken session from a site-wide outage).	To keep the service up, find and fix faults, and detect abuse such as automated play or multiple accounts.	Legitimate interests — Art. 6(1)(f): operating and securing a service you asked to use. You can object; see your rights.
Analytics Google Analytics 4 and Firebase Performance Monitoring events — which screens you open, how the app performs, and an identifier tied to your account.	To understand which parts of the game are used and where it is slow.	Your consent — Art. 6(1)(a). Nothing analytics-related runs until you say yes, and you may withdraw at any time.

We never ask for and never store payment details, because there is nothing to pay for. We do not profile you for advertising, we run no advertising, and we do not sell or rent personal data to anyone.

Match data — fixtures, line-ups, goals, cards — comes from a sports data provider and is about football, not about you. Nothing about you is ever sent to them.

Cookies & device storage

We store a small amount of data on your device. Some of it is unavoidable — your sign-in token, your saved profile, the offline cache that lets the game work on a weak connection — and it is there whatever you choose. Analytics storage is not, and it only appears if you allow it.

The full list, item by item, is on the Cookie Policy page, along with the control to change your mind.

Who processes it besides us

We run on Google Cloud and Firebase. That means Google processes your data on our instructions, under Google's data processing terms — it does not get to use it for its own purposes.

Processor	What it handles
Google Cloud / Firebase Google Ireland Limited & Google Cloud EMEA Limited	Firebase Authentication (your email and password, or your Google sign-in), Cloud Firestore (your account and game data), Cloud Run (serving the site and API), Cloud Logging (technical logs), Error Reporting (crash reports).
Google Analytics 4 & Firebase Performance Google Ireland Limited	Analytics events — only with your consent.
Cloudflare Cloudflare, Inc.	Delivers and protects both sites. Every request passes through Cloudflare before it reaches us, so it handles your IP address, the page you asked for and your browser's user agent — this is how the site is served to you and it is not optional. Separately, only with your consent, Cloudflare Web Analytics measures page performance; it sets nothing on your device and does not profile you across sites.
Google reCAPTCHA Enterprise Google Ireland Limited	Checks that requests to the game come from the real app rather than an automated script, so that nobody can run up our costs or scrape other players' scores. It runs on every visit and is not covered by the analytics toggle, because switching it off would leave the service undefended — see necessary cookies.

If we ever add a processor we will list it here before it starts processing anything, and if it involves a new category of data or a new purpose we will tell you directly rather than quietly editing this table.

Where your data is held

In the European Union. Our servers run in Google's Belgium region (europe-west1) and the database is in Google's multi-region European location (eur3). We did not pick those by accident and we do not move them casually — the database location, in particular, is permanent once chosen.

One exception, and only if you consent to analytics: Google Analytics may transfer some data to the United States. Google relies on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses for those transfers. Decline analytics and this does not apply to you at all.

A second qualification, and this one applies to everybody: since 4 August 2026 both sites are served through Cloudflare, whose network is global. Your request is handled by whichever Cloudflare location is nearest you, which may be outside the EU, and Cloudflare is a US company. Cloudflare relies on the EU–US Data Privacy Framework and on standard contractual clauses. What reaches Cloudflare is the request itself — your IP address, the address you asked for, your user agent — not your account or game data, which stay in the European locations named above.

How long we keep it

Concrete periods, not "as long as necessary":

Account and game data — for as long as your account exists. When you ask us to delete it, we do so within 30 days.
Dormant accounts — deleted after 24 months with no sign-in. We will email you before that happens.
Technical logs and error reports — 30 days, then discarded automatically.
Analytics — 14 months, then deleted by Google.
Consent record — 12 months on your device, then we ask again.

Your rights

Under the GDPR you may ask us to:

Show you what we hold about you, and a copy of it (Art. 15).
Correct anything wrong (Art. 16).
Delete your account and data (Art. 17).
Export your data in a machine-readable form (Art. 20).
Restrict what we do with it while a dispute is resolved (Art. 18).
Object to processing we base on legitimate interests (Art. 21).
Withdraw consent to analytics, at any time, from the Cookie Policy page. Withdrawing does not undo what was lawfully collected before.

Email [email protected] from the address on your account. We reply within one month, as Article 12(3) requires; if a request is genuinely complex we may take longer and will tell you why within that first month. We do not charge for this.

If you think we have handled your data badly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live. We would rather you told us first, but that is your choice, not a precondition.

US state privacy rights

If you live in California or another US state with a comprehensive privacy law, you have rights to know what we collect, to delete it, to correct it, and not to be treated worse for exercising them. Use the same address: [email protected].

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA. There is no opt-out link here because there is nothing to opt out of. We do not process sensitive personal information for inferring characteristics.

Children

thefinal is for people aged 16 and over. You confirm your age when you register. We do not knowingly collect data from anyone younger, and if we find out we have, we delete the account and its data.

If you are a parent or guardian and believe your child has registered, write to [email protected] and we will remove it.

Security

Traffic is encrypted in transit (HTTPS everywhere) and data is encrypted at rest by Google Cloud. Passwords are handled by Firebase Authentication and stored hashed — we never see your password and cannot recover it for you; we can only help you reset it.

Access to production data is limited to what the services themselves need. No system is perfect, and we will not pretend otherwise: if a breach occurs that is likely to put your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours and tell you directly when the law requires it.

Changes to this policy

When we change this page we bump the version at the top and record what changed in the changelog below. Small changes — clearer wording, a new processor doing something we already disclosed — move the minor number and take effect when published.

Substantive changes — a new category of data, a new purpose, a new legal ground, a transfer somewhere new, or anything that reduces your rights — move the major number, and we tell you before they take effect rather than after.

Changelog

Version	Date	What changed
`2.1`	2026-08-05	Added sign-in with Google as an alternative to a password, and listed what it brings: the email address, name, profile-photo address and account identifier from your Google account. Same purpose, same legal ground, same retention as the rest of your account data.
`2.0`	2026-08-04	Added Cloudflare, which from this date serves and protects both sites — so it handles every request, including your IP address, and its network is global. Added Cloudflare Web Analytics, which runs only if you allow analytics. Added Google reCAPTCHA Enterprise, which checks that requests come from the real app. Recorded the transfer position for Cloudflare alongside the existing one for Google Analytics.
`1.0`	2026-07-29	First published.