Privacy Policy

Last updated: February 2026

1. Data Controller

WinOnly is the data controller for personal data collected through this service. Contact us at support@winonly.io.

2. Information We Collect

We collect: email address (for account identification), password (stored as a secure bcrypt hash), disclaimer acceptance timestamp, session data (encrypted cookie), and push notification subscription (if opted in). We do not collect browsing history, IP addresses for tracking, or any data beyond what is listed.

3. Legal Basis for Processing (GDPR)

We process data under: Contract performance (Article 6(1)(b)) for email and password; Legitimate interest (Article 6(1)(f)) for security; Consent (Article 6(1)(a)) for push notifications.

4. How We Use Your Information

Account authentication, subscription management, push notifications (opt-in only), and service communications. We do not use your data for marketing, profiling, or automated decision-making.

5. Third-Party Services

Stripe for payment processing (we never see your card number). API-Football for match data (no personal data shared).

6. International Data Transfers

Data is stored within the EEA. Transfers outside the EEA use Standard Contractual Clauses.

7. Data Retention

Account data is retained while your account is active. Deleted within 30 days of account deletion, except where required by law.

8. Cookies

We use only essential session cookies for authentication. No analytics, tracking, or advertising cookies.

9. Your Rights Under GDPR

You have rights to: access, rectification, erasure, restrict processing, data portability, object to processing, and withdraw consent. Contact support@winonly.io to exercise these rights.

10. Right to Lodge a Complaint

Contact the Irish Data Protection Commission (DPC) at www.dataprotection.ie or +353 (0)76 110 4800.

11. Children's Privacy

WinOnly is not intended for anyone under 18.

12. Changes to This Policy

Material changes will be notified by email.

13. Contact

Email: support@winonly.io