1. Data controller
František Jánoš ID No.: 02721864 Husovická 902/18, Brno - Husovice, 614 00, Czech Republic
Contact: frantisek@trefa.app
2. What personal data we process
While you use Trefa.app, we process the following data:
- Identification data from your Google account: name, e-mail address, profile photo
- Activity data: match predictions, points, tournament participation
- Technical data: IP address, browser type (for security purposes)
- Payment data: subscription status and history, billing e-mail. When you set up a recurring payment, we additionally store the IP address, browser information, date, and version of the terms you consented to — used solely as proof that consent was given. Payment card details are processed exclusively by the payment gateway provider — the operator has no access to them.
3. Purpose of processing
We process your personal data for these purposes:
- Providing the prediction league service
- Identifying users within tournaments
- Displaying standings and statistics
- Communication in the tournament chat
- Ensuring security and preventing abuse
4. Legal basis for processing
We process personal data on the grounds of contract performance (Art. 6 (1) (b) GDPR) – providing the prediction league service, and legitimate interest (Art. 6 (1) (f) GDPR) – ensuring the security and operation of the service.
5. Retention period
We keep your data for as long as your account exists.
When you delete your account in the app's settings, we immediately disconnect it from your Google account and delete your e-mail address, Google account identifier, and profile photo. You will no longer be able to sign in. We remove your other personal data — notifications, tournament chat messages, shared cards, and records of sent e-mails — promptly, within 30 days at the latest.
The display name you set in the app remains next to your past predictions. Your predictions, points, and standings are not deleted, so that other players keep a readable leaderboard and history of past tournaments. This is not full anonymisation: if you set your real name as your display name, it stays visible next to your predictions even after you delete your account. You can change it at any time before deletion, in settings.
We also retain records required by law or needed to defend our legal rights: payment records, records of the consent given for a recurring payment, and records of any e-mail unsubscribe.
6. Data sharing
We do not share your personal data with third parties for marketing purposes. Data may be shared:
- With other tournament participants: name, profile photo, predictions and points (within the tournament)
- With infrastructure providers: hosting (Vercel, Hetzner) used to operate the service
- Google: for Google OAuth sign-in
- Payment gateway provider: subscription-payment processing
7. Your rights
Under the GDPR you have the following rights:
- Right of access – obtain information about the data we process
- Right to rectification – correct inaccurate data
- Right to erasure – delete your account yourself in the app under Settings, or ask us to do so
- Right to data portability – obtain your data in a machine-readable format
- Right to lodge a complaint – with the Czech Office for Personal Data Protection (uoou.cz)
To exercise your rights, contact us at frantisek@trefa.app.
8. Cookies
We only use technically necessary cookies for sign-in and for the service to work. We do not use advertising or third-party analytics cookies.
9. Data security
We protect your data with encrypted communication (HTTPS), secure sign-in via Google OAuth, and regular security updates. Data is stored on servers within the EU.
10. Policy changes
This policy may be updated. We will inform you about significant changes through the app.
Last updated: 2 August 2026