Scoreper Privacy Notice

1. Controller and contact

Perplatform Oy (Business ID 3568783-4), Vilkastuksenkatu 7, 20320 Turku, Finland, is the controller. Contact support@scoreper.com for privacy requests. Toni Leivo is the responsible owner and legal approver. We have not appointed a data protection officer.

2. Data we process

Depending on the features you use, Scoreper processes account and profile details, settings, round scores and participant snapshots, course interactions, private equipment and practice data, achievements and statistics, social relationships, community contributions, support messages, device and security signals, subscription entitlement evidence, and optional media or location-derived facts.

We do not sell personal data. We do not use advertising trackers. Optional permissions such as location, photos, notifications and activity sensors can be controlled in your device settings and in Scoreper where available.

3. Purposes and legal bases

We process data to provide your account and requested product features, synchronize and preserve your confirmed scores, secure the service, answer support requests, meet legal obligations, and improve Scoreper using privacy-safe aggregates. The legal basis is performance of the service contract, legitimate interests in security and reliable operation, consent for optional device capabilities, and legal obligations where applicable.

4. Location, media and public contributions

Precise location is collected only for an approved feature and permission. Routine staff tools do not expose personal movement history. Public course facts and accepted contributions may remain after account deletion only when user attribution and reidentification paths have been irreversibly removed. Private media is not published without its applicable moderation and rights checks.

5. Processors and international transfers

Scoreper uses service providers such as Supabase for authentication, databases and storage; Apple and Google for app distribution and platform services; Sentry for privacy-filtered error monitoring when enabled; Try Discs for attributed disc-catalog source data; Cloudflare Turnstile for contact abuse prevention; Resend for support email delivery when configured; and Vercel for website hosting. Providers process data under their own locations and safeguards. Where data leaves the EEA, we use an applicable transfer mechanism such as adequacy decisions or contractual safeguards.

6. Website, contact and diagnostics

This website uses no non-essential analytics or advertising cookies by default. Contact form fields are sent only after Turnstile verification and are delivered to the fixed Scoreper support mailbox. The site does not retain a separate message database. Provider and mailbox retention applies, and messages are deleted when no longer needed for the request or a legal obligation. We do not put message content or reply addresses in URLs, analytics, Sentry or browser storage.

7. Retention, export and deletion

Account exports expire after 7 days. Final account-deletion confirmation has no cooling-off period: access is restricted and sessions are revoked immediately, with a 24-hour production completion objective. Private account data and user-linked projections are erased. Encrypted Supabase database backups may retain unavailable copies for the provider's current 7-day window; Storage is reconciled separately.

Irreversible product aggregates may remain only without an account or device key, exact time or location, or free text, and only at a cohort of at least 20. Privacy-job operational facts expire after 30 days unless a documented legal obligation requires a narrower record for a defined period.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and withdraw consent without affecting earlier lawful processing. You may complain to the Finnish Data Protection Ombudsman. We may verify identity before acting on a request.

9. Children

Scoreper is suitable for a broad sporting audience, but independent account creation is 13+ for the first release. An under-13 account requires a future verified guardian-consent lifecycle and is not enabled merely by an app-store content rating.

10. Security and changes

We use access controls, encryption in transit, least privilege, audit, private storage and tested recovery boundaries. No internet service is risk-free. We will version material changes and provide notice where required. Contact support@scoreper.com if you believe your data or account is at risk.