Site privacy policy

The data controller is Anil Orsel, publisher of the site, 72 boulevard du Temple, 93390 Clichy-sous-Bois, France.

For any question or request about your data, write to support@flashsportapp.com.

This policy covers the flashsportapp.com site. The FlashSport mobile app has its own privacy policy (in English).

You do not have to provide anything to browse the site. Here, one by one, is the data processed during your visit.

• Your connection. To send you the pages, the site’s server receives your IP address and the technical information of any web request (page requested, browser type). The site’s program does not record your IP address in its logs: for requests, it only notes errors, with their type and path.
• The “Who will win?” vote. When you vote, the server keeps your choice and a fingerprint calculated from your IP address and the match: a one-way code; the address itself is never written to disk. This fingerprint is used to count a single vote per person and per match, and to show you your vote. Against abuse, the server also counts, in memory only, the votes sent from the same address (30 per minute and 300 per day at most).
• The AI chat. The answers to the suggested questions are already in the page. A question you write yourself stays in your browser: it is sent neither to our server nor to an artificial intelligence service.
• The fan chat. On the site, it is read-only: it shows the nicknames and messages published by app users, without any identifier.
• Search. The list of teams and competitions is downloaded once, then the search happens in your browser: what you type is not sent.
• Crests and logos. They are loaded directly from media.api-sports.io, the image service of our sports data provider (API-Football). As with any image on a website, your browser sends it your IP address and technical information, which it processes according to its own rules.
• No other external service. The site uses your device’s fonts and loads no script from another site. Its content security policy only allows the site itself, this image service and, for accounts, Supabase.
• No real advertising today. The site’s ad slots are mock-ups: no ad network is connected and no data is sent to an advertiser. The site counts, in your browser only, how often each slot is displayed; this count is not sent anywhere.
• No audience measurement. No visit statistics tool is installed on the site.

The site’s accounts are those of the FlashSport app. They are managed by Supabase, our authentication provider, whose project is hosted in Frankfurt (Germany). Your browser talks directly to Supabase: your password does not go through the site’s server.

• Your email address: it is used to sign you in and to receive the 6-digit verification code or the link to change your password.
• Your password (at least 8 characters), sent to Supabase over an encrypted connection.
• Your first name and last name, if you provide them, as well as the account language and the origin of the sign-up (the site).
• Your consent to receive news emails, only if you tick the box. You can withdraw it at any time from your account page.
• The date of birth is only used to check, in your browser, that you are 18 or over. Neither it nor the country asked for at sign-up is sent or recorded.
• Account emails (code, forgotten password) are sent by Supabase with the Resend sending service, configured in the European Union region.
• To give you the free pick offered at sign-up, the site’s server checks your session with Supabase; it records nothing.

Your account is kept until you delete it. You can delete it at any time from the app or online.

Your favourites, your consent choice and, if you are signed in, your session are kept in your browser’s storage. These are not cookies, and they are used neither for advertising nor for audience measurement. The details, key by key, are on the page Cookies and storage.

• Sending you the pages, protecting the site against abuse and keeping it secure: our legitimate interest in running a reliable site (Article 6(1)(f) GDPR).
• Counting votes, only one per person and per match: our legitimate interest in publishing honest vote results (Article 6(1)(f) GDPR).
• Creating and running your account: the performance of the service you request (Article 6(1)(b) GDPR).
• Sending you news emails: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• Keeping your favourites, settings and session on your device: storage strictly necessary for the service you request, exempt from consent (Article 82 of the French Data Protection Act, “loi Informatique et Libertés”).

• Votes: your choice and its fingerprint are deleted 10 days after the last vote on the match.
• Anti-abuse counters: kept in memory only, never written to disk; they disappear when the server restarts.
• Account: until you delete it.
• Server error logs: as long as needed to diagnose faults.
• Your browser’s storage: until you delete it, or until the tab is closed for session storage. Your account session is deleted when you sign out.

Your data is neither sold nor rented, and is not used for any advertising. Only our technical providers have access to it, for the service they provide to us:

• DigitalOcean, LLC (105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA): hosting of the site’s server.
• Supabase: accounts (project hosted in Frankfurt).
• Resend: sending account emails.
• API-Football (media.api-sports.io): the images of crests and logos, loaded by your browser.

We may also have to disclose data to an authority that requests it within the framework provided by law.

DigitalOcean, LLC is a company established in the United States. The data that goes through the site’s server (IP address, votes) may therefore be processed by a company subject to US law: this is a transfer outside the European Union within the meaning of the GDPR. To find out how this transfer is governed, write to support@flashsportapp.com.

You can at any time ask to access your data, have it rectified or erased, object to its processing, request its restriction or portability, withdraw your consent, and give instructions on what happens to it after your death.

Write to support@flashsportapp.com, specifying your request. We reply within one month, which may be extended in the cases provided for by the GDPR. If we have reasonable doubt about your identity, we may ask you to confirm it.

Votes are linked to a fingerprint, never to your name or your account. They are deleted automatically 10 days after the last vote on the match.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).

The site is intended for people aged 18 and over. Creating an account is reserved for adults: the date of birth is checked and a box confirms the age. If you learn that a minor has created an account, write to us: we will delete it.

The site is served over an encrypted connection (HTTPS) and its content security policy only allows the sources listed above. For votes, the IP address is never written in clear to disk, and passwords do not go through our server. As no system is safe from a flaw, we will inform you, as the law requires, if a breach of your data poses a high risk to you.

This policy describes the site as it works today. It will be updated before any significant change, for example the arrival of an ad network or an audience measurement tool. The date at the top of the page shows its last update.

• FlashSport takes no bets and makes no payouts. The probabilities shown are statistical estimates that may be wrong: nothing on this site is betting advice.
• Scores and statistics come from a sports data provider and are provided as is: they may contain delays or errors. To the extent permitted by law, the publisher cannot be held liable for decisions made on the basis of the site, nor for an interruption or an error of the service. Nothing on this page limits the rights the law grants you.
• The texts, the FlashSport logo, the layout and the code of the site belong to the publisher. Reproducing them without permission is prohibited, except in the cases provided for by law, such as a short quotation with its source.
• The names, logos and crests of clubs and competitions belong to their owners. They are only used to identify the teams and competitions; their presence does not imply any partnership.
• The site is governed by French law.