Privacy Policy
Effective date: 8 November 2026 · Version 1.8
What changed in version 1.8: you can now buy league plans in the App Store on iPhone. We added Apple as a payment provider and describe the purchase records and the reference code we give to the App Store.
This policy explains what personal data the BragCrew app and the website bragcrew.com process, why, and what rights you have.
Who we are
The controller of your personal data is Ing. Alexandr Kánský, founder of BragCrew, Company ID (IČO) 73122513, registered office Květinková 371/14, 130 00 Praha 3, Czech Republic ("we", "us").
Contact for all privacy matters: support@bragcrew.com.
What data we process
| Data | When | Why (legal basis) |
|---|---|---|
| Player profile: nickname, the leagues you join or found, your role in them | When you play | To run the game and show league rankings (contract) |
| Your picks, points and rankings, including past seasons | When you play | To score picks and show rankings (contract) |
| A random installation ID created by the app, and when a device was first and last used | When you open the app | To keep you signed in on your devices and manage sessions (contract) |
| Device and app details sent with your requests: the app version, the operating system version, the device model and make (Android only), the language and the time zone, and when the app was last used | When you use the app while signed in (also as a guest) | To run and improve the app, fix problems on specific devices, count installs and check how far testers get (legitimate interest) |
| Campaign tags (UTM) from the link you installed the app from, as passed on by Google Play (Install Referrer), stored with your player profile | When you install the app from a link that carries campaign tags | To see which campaigns bring players (legitimate interest) |
| Push notification token of your device (a code issued by Google or Apple), your notification settings (which messages you want, and quiet hours if you set them) and the messages waiting to be sent to you | When you allow notifications in the app | To send you the pick reminders, round results and league messages you asked for (consent; you can switch each kind off in the app, or turn notifications off in your phone settings) |
| Sign-in data: your email address, or an account identifier and email address from Google or Apple if you sign in with them | When you secure your account or sign in | To let you sign in and recover access (contract) |
| One-time sign-in codes (stored only in a protected form) | When you ask for a code | To confirm you own the email address (contract) |
| Your choice about promotional emails: yes or no, the wording version and the date | When you make the choice | To respect your choice and prove it (consent; legal obligation) |
| Purchase records of paid league plans: the store (Google Play or the App Store), the plan, the order number (for the App Store, the transaction number), the league, the state of the purchase (for example confirmed, applied or refunded), the times, a protected (hashed) value of the purchase token, and the account of the buyer | When a founder buys a plan for a league | To give the league the plan that was paid for, to make sure a purchase is applied only once, to handle refunds and for accounting (contract; legal obligation) |
| Reports and blocks you make, including the optional text you write | When you report or block | To keep the community safe and review reports within 24 hours (legitimate interest) |
| Security records: protected (hashed) values derived from your IP address, installation or email address, and signs that a sign-in token was reused | When you sign in or create a guest player | To prevent abuse and protect accounts (legitimate interest) |
| Messages you send us | When you write to support@bragcrew.com | To answer you (legitimate interest) |
| Website statistics: the bragcrew.com page you view (without anything after "?" or "#"), the website you came from, your browser, operating system, device type, screen size and language | When you visit bragcrew.com | To see how people find and use our website and to improve it (legitimate interest) |
| A one-way (hashed) value derived from an app-specific identifier of your Android phone | When a guest player is created on Android | To recognise your guest player if you reinstall the app (legitimate interest) |
You can play as a guest without giving us an email address. We do not ask for your real name, phone number, location, contacts or photos.
What we don't do: no advertising, no ad tracking, no selling or renting of your data, no profiling for marketing. The app contains no third-party analytics or advertising tools. Our servers keep no access logs with visitors' IP addresses.
Website statistics: bragcrew.com counts visits with Umami, an open-source statistics tool that we run ourselves on our server in the EU; no external analytics provider receives the data. Like the rest of our server, it is hosted by Hetzner Online GmbH as our infrastructure processor (see "Who we share data with"). It uses no cookies and stores nothing on your device, and it never receives your IP address. Visits are grouped only by an anonymous code calculated from your browser details and a secret value that changes every month, so we cannot identify you or follow you across websites. If your browser sends a "Do Not Track" signal, nothing is recorded. Visits to the pages for joining a league and for deleting an account are not counted. When you open a bragcrew.com link that carries campaign tags (UTM), we add one to a daily total for that page and those tags. The total contains no IP address, browser details, cookie or other identifier, and nothing is stored on your device.
App usage details: to run and improve the app we keep, for each device you use, the app version, the operating system version, the device model and make (Android only), the language, the time zone and the time of the last use. We link them to your account and use them only to operate the service, fix problems on particular devices and to count installs and active users and see how far people get (for example whether they set a nickname, make a first pick or join a league). Only our team sees them, on the private administration page, and no one else receives them. We do not use them for advertising or profiling and we do not read an advertising ID. On Android we keep a one-way (hashed) value derived from an app-specific identifier of your phone, so we can recognise your guest player if you reinstall the app. We don’t use it for advertising or tracking, and we delete it when your player is deleted. Our legal basis is our legitimate interest in running and improving a free game; you can object at any time (see "Your rights").
Install source: When you install the app from a link that carries campaign tags (UTM), Google Play can tell the app which tags were in the link (Google Play Install Referrer). We store these tags with your player profile to see which campaigns bring players; they say nothing else about you, and we delete them together with your account.
Our launch waiting list on bragcrew.com is closed: we no longer collect new email addresses. If you joined it earlier, we keep your email address, the language and page you signed up from, whether you would like to try the app early as a tester, the campaign tags (UTM) in the link you came from, and the time you confirmed. We do this with your consent, only to tell you when the Android app launches and, if you ticked the box, to invite you to test the app early.
We send the launch email through our email provider Resend (recipient of your address). An address that was not confirmed within 7 days is deleted. After the launch announcement we delete the list 30 days later. Every email has an unsubscribe link that removes your address immediately.
No real money in the game: BragCrew is a game for fun. You never pay to make picks, nothing of money value can be won, and we do not share data with companies that offer games for money. The only thing you can buy is a paid plan for a league (a larger league and league features), which gives nobody an advantage in the game.
Who we share data with
We use these service providers, which process data only on our instructions:
- Hetzner Online GmbH (Germany): servers and encrypted backup storage in the European Union, including the website statistics.
- Resend (Plus Five Five, Inc., USA): delivery of sign-in code emails, processed in its EU (Ireland) region. Any transfer outside the EU is covered by the safeguards required by the GDPR, such as the EU Standard Contractual Clauses.
- Google Workspace (Google Ireland Ltd.): our support mailbox.
- Google (Google Ireland Ltd., Firebase Cloud Messaging) and Apple (Apple Distribution International Ltd., Apple Push Notification service): delivery of push notifications to your device. They receive your device token and the text of each message, which can include the names of the teams in a match, the competition and round, your points for the round, or the name of a league.
- Google (Google Play): payment for paid league plans. Google processes your payment under its own terms and privacy policy as an independent controller and tells us only what we need for the purchase: the order number, the plan, the time and the state of the purchase. To match a purchase with the right league, we give Google Play a hashed value of your player ID and the ID of the league; we do not give it your nickname or email address. We never receive your card or other payment details.
- Apple (App Store): payment for paid league plans. Apple (Apple Distribution International Ltd.) processes your payment under its own terms and privacy policy as an independent controller and tells us only what we need for the purchase: the transaction number, the plan, the time and the state of the purchase, including a refund. To match a purchase with the right league, we give the App Store a random reference code that only we can link to your player and your league; we do not give it your nickname or email address. We delete the link between you and the code when you delete your account. We never receive your card or other payment details.
- Cloudflare, Inc.: domain name service (DNS) for bragcrew.com and secure access to our private administration page, which our team uses to run the service. That page can show text that other players have reported to us (for example a nickname or a league name). Cloudflare does not receive the content of your use of BragCrew beyond that. Separately, Cloudflare receives and forwards to our systems the invoices and receipts that reach a business mailbox of our own for bookkeeping; they are company documents, not data of players. Any transfer outside the EU is covered by the safeguards required by the GDPR, such as the EU Standard Contractual Clauses.
If you sign in with Google or Apple, they act as independent controllers under their own privacy policies and tell us only your account identifier and email address.
Other players in your leagues see your nickname, your picks once a match has started, your points and your ranking. Players you block see you as "Blocked player". If you make at least one pick in a competition, your nickname, points and rank appear in that competition's public standings, which other players can see. We never show your account ID or email there. You can block a player to stop seeing their nickname, and you can delete your account at any time, which removes you from the standings. If you are the administrator of a league, anyone who has the invite code for that league also sees the league name and your nickname (if you set one) on the invitation page; we show nothing else about you there.
We may disclose data if the law requires it.
Company leagues
A company can buy a company plan for its leagues. For this we keep the company name, the plan and its season, the company logo and colour, and which players the company names to run its leagues. The logo and colour come only from the company, and we use them only to show its own leagues and invites. People named by the company have the same rights as a league founder in every league of that company: for example, they can approve or remove players. They see the same data about players as a league founder. When the plan ends, the logo and colour are no longer shown, and players and their history stay in the league.
How long we keep data
- Account and game data: until you delete the account or ask us to delete it.
- App and device details: for as long as you have the account; they are deleted together with the account (see "Deleting your account").
- Campaign tags from the install link: for as long as you have the account; they are deleted together with the account (see "Deleting your account").
- Notifications: records of sent and skipped notifications are deleted after 30 days. Your device token is deleted when you sign out on that device; your token, notification settings and waiting messages are deleted together with the account.
- One-time codes: until they are used or expire (minutes).
- Security records: only for the short time needed to limit abuse; old records are deleted automatically.
- Reports: until the review is finished, then for at most 12 months to deal with repeated abuse.
- Promotional email choice: kept as proof even after the account is deleted, but without your name or email address (an anonymous ID, the date and the wording).
- Purchase records: kept after you delete your account, without any link to you (the buyer's account is detached), for as long as accounting and tax rules require, and to handle refunds.
- Support emails: as long as needed to handle your request, at most 2 years.
- Website statistics: 25 months, then deleted automatically.
- Backups: deleted on a rolling basis; every backup copy is removed within 30 days.
Deleting your account
You can delete your account in the BragCrew app or on our website at https://bragcrew.com/delete-account. Once we accept the request, you can no longer play with that account. We delete the account and its data from our live systems within 24 hours and remove backup copies and the record of the request no later than 30 days after accepting it. Other players' points don't change. Records of purchases of paid league plans are the exception: we keep them without any link to you (see "How long we keep data"). Deletion can't be undone.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interest. You can withdraw your consent to promotional emails at any time in the app or via the link in each email; this does not affect processing before the withdrawal.
Write to support@bragcrew.com. We reply within one month.
You can also lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů (www.uoou.gov.cz), or the authority in your country.
Age
BragCrew is for people aged 16 and over. We do not knowingly process data of anyone younger; if you think someone under 16 uses BragCrew, write to us and we will delete the account.
Security
Data travels encrypted (HTTPS). Sign-in tokens and codes are stored only in a protected (hashed) form. Backups are encrypted.
Changes
If we change this policy, we will publish the new version here with a new effective date and a short note of what changed.