1. Data controller
František Jánoš ID No.: 02721864 Husovická 902/18, Brno - Husovice, 614 00, Czech Republic
Contact: frantisek@trefa.app
2. What personal data we process
While you use Trefa.app, we process the following data:
- Identification data from your Google account: name, e-mail address, profile photo
- Activity data: match predictions, points, tournament participation
- Technical data: IP address, browser type (for security purposes)
- Signup origin data: the first trefa.app page you landed on in your browser, the domain of the site you came from (for example google.com), and any campaign tag in the link (UTM). We store this once, when you create your account, so nothing is stored in your browser for this.
- Payment data: subscription status and history, billing e-mail. When you set up a recurring payment, we additionally store the IP address, browser information, date, and version of the terms you consented to — used solely as proof that consent was given. Payment card details are processed exclusively by the payment gateway provider — the operator has no access to them.
3. Purpose of processing
We process your personal data for these purposes:
- Providing the prediction league service
- Identifying users within tournaments
- Displaying standings and statistics
- Communication in the tournament chat
- Ensuring security and preventing abuse
- Evaluating where our new users come from (which articles and channels work)
4. Legal basis for processing
We process personal data on the grounds of contract performance (Art. 6 (1) (b) GDPR) – providing the prediction league service, and legitimate interest (Art. 6 (1) (f) GDPR) – ensuring the security and operation of the service, and evaluating where our new users come from. We use advertising cookies and personalised ads only on the basis of your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time.
5. Retention period
We keep your data for as long as your account exists.
When you delete your account in the app's settings, we immediately disconnect it from your Google account and delete your e-mail address, Google account identifier, and profile photo. You will no longer be able to sign in. We remove your other personal data — notifications, tournament chat messages, shared cards, and records of sent e-mails — promptly, within 30 days at the latest.
The display name you set in the app remains next to your past predictions. Your predictions, points, and standings are not deleted, so that other players keep a readable leaderboard and history of past tournaments. This is not full anonymisation: if you set your real name as your display name, it stays visible next to your predictions even after you delete your account. You can change it at any time before deletion, in settings.
We also retain records required by law or needed to defend our legal rights: payment records, records of the consent given for a recurring payment, and records of any e-mail unsubscribe.
6. Data sharing
We do not share your personal data with third parties for marketing purposes. Data may be shared:
- With other tournament participants: name, profile photo, predictions and points (within the tournament)
- With infrastructure providers: hosting (Vercel, Hetzner) used to operate the service
- Google: for Google OAuth sign-in
- Google and its advertising partners: showing ads through Google AdSense (see section 8)
- Payment gateway provider: subscription-payment processing
7. Your rights
Under the GDPR you have the following rights:
- Right of access – obtain information about the data we process
- Right to rectification – correct inaccurate data
- Right to erasure – delete your account yourself in the app under Settings, or ask us to do so
- Right to data portability – obtain your data in a machine-readable format
- Right to lodge a complaint – with the Czech Office for Personal Data Protection (uoou.cz)
To exercise your rights, contact us at frantisek@trefa.app.
8. Cookies
We use technically necessary cookies for sign-in and for the service to work. These do not require your consent.
We show ads on this website through Google AdSense. Google and its partners use cookies and similar technologies to show you ads based on your previous visits to this and other websites. Google describes the details on its page How Google uses information from sites or apps that use its services.
Users in the EU, the European Economic Area, the United Kingdom and Switzerland first see a consent dialog. You will only receive personalised ads if you agree to them. If you do not give consent, Google shows non-personalised ads. You can change your choice at any time via the privacy settings link shown on the website, and you can turn off ad personalisation by Google in My Ad Center.
We do not use third-party analytics cookies.
9. Data security
We protect your data with encrypted communication (HTTPS), secure sign-in via Google OAuth, and regular security updates. Data is stored on servers within the EU.
10. Policy changes
This policy may be updated. We will inform you about significant changes through the app.
Last updated: 19 October 2026