Privacy Policy

Last updated: June 1, 2026

Data controller: BALLO NETWORK LTD operating Ballo (“we,” “us”).
Contact / privacy inquiries / data rights: [email protected]
Address: Uganda, Kampala, Makindye Division West, Makindye Division, Makindye II, Dubai

1. Scope

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Ballo mobile application and related services.

2. Information We Collect

2.1 Information you provide

Account: email address, password (stored by our authentication provider), verification codes.
Profile: username, display name, position, country (self-selected), profile photo, optional social media URLs.
Sports data: match events, statistics, lineups, ratings, memberships, applications, invites.
User content: images and videos you upload, including match highlights.
Communications: messages you send to support.
Safety: content reports, user blocks, and community guidelines acknowledgments where provided in the app.

2.2 Information from third-party sign-in

If you use Google or Apple sign-in, we receive information permitted by your settings (e.g., email, name, provider user ID) through Supabase Auth.

2.3 Information collected automatically

Device and usage: app interactions, timestamps, session identifiers for the video feed, error/connection states.
Feed analytics: videos shown, watch duration, completion rate, likes, follows, shares (clipboard action logged as interaction), swipe behavior, session ID (UUID).
Log data: IP address, user agent, and request metadata processed by our hosting provider.
Content safety: moderation results for text, images, and sampled video frames processed to enforce our Community Guidelines.

2.4 Information from others

League organizers, team admins, and other users may enter or upload data that identifies you (e.g., your name on a lineup, stats, or video). Organizers are responsible for having a lawful basis to provide that data.

3. Sensitive Information

We do not intentionally collect government IDs, payment cards, or health records. Sports performance data is not treated as medical data but may reveal physical capabilities.

Videos and photos may contain biometric or likeness information of you or others. Upload only where you have permission.

4. Location Data

We collect the country you select during onboarding. We do not collect precise GPS location from your device based on the current application.

5. Cookies and Similar Technologies

The native mobile app does not use browser cookies. If you access web-based components or our website:

Essential hosting and security logs may apply on our website and app host.
Google Fonts may cause your device to request font files from Google servers, which may log IP address and technical data.
Local storage/cache: the app may cache images and videos on your device via flutter_cache_manager for performance.

6. How We Use Information

We use personal information to:

Provide and maintain the Service (auth, profiles, stats, leagues, teams, matches);
Store and deliver User Content;
Operate leaderboards, ratings, badges, and standings;
Personalize the Explore video feed and measure engagement;
Moderate User Content for safety and policy compliance (including OpenAI Moderation);
Send transactional communications (e.g., verification emails via Supabase);
Display in-app notifications (e.g., team invites);
Secure the Service, prevent fraud and abuse, enforce policies;
Comply with law and respond to lawful requests;
Improve features and troubleshoot errors.

7. Legal Bases for Processing (EEA/UK)

Where GDPR/UK GDPR applies, we rely on:

Contract — to provide the Service you request;
Legitimate interests — security, analytics, feed ranking, improvement (balanced against your rights);
Consent — where required (e.g., optional marketing if introduced, or certain uploads in some jurisdictions);
Legal obligation — compliance with applicable laws.

You may withdraw consent where processing is consent-based without affecting lawfulness before withdrawal.

8. Automated Decision-Making and Profiling

We use automated systems to:

Calculate player ratings and leaderboard points;
Rank feed videos using watch and engagement signals;
Display match prediction / win-probability estimates (non-binding, non-financial);
Screen User Content for policy violations before or during posting.

These do not produce legal effects equivalent to government decisions. You may contact us to question significant rankings affecting you; we will review in good faith.

9. How We Share Information

We share information:

With other users — according to league/team visibility (profiles, stats, videos, standings).
With service providers — under contracts requiring appropriate safeguards:
- Supabase, Inc. — hosting, database, authentication, storage, realtime, and edge functions (primary processor).
- OpenAI — content moderation of text, images, and sampled video frames for safety classification.
- Google — OAuth sign-in; font delivery if enabled.
- Apple — Sign in with Apple.
For legal reasons — if required by law or to protect rights and safety.
Business transfers — merger, acquisition, or asset sale (with notice where required).

We do not sell personal information for money. We do not share for cross-context behavioral advertising based on the current application.

10. International Data Transfers

Our infrastructure is provided by Supabase. Data may be processed in the European Union, United States, and other countries where Supabase or subprocessors operate (including our project region configuration).

For EEA/UK transfers, we implement appropriate safeguards (e.g., Standard Contractual Clauses) as required by applicable law.

11. Data Retention

Data type	Retention approach
Account & profile	Until account deletion request, then deleted or anonymized within 30 days except backups/legal holds
Match/league historical stats	May be retained in league records if integral to competition history; personal fields may be anonymized after account deletion
Videos/images	Until deleted by user/admin or account deletion, subject to backup cycles
Feed interaction logs	As needed for recommendation integrity and abuse prevention
Server logs	Per Supabase/provider defaults
Reports & moderation records	Retained as needed for safety, enforcement, and legal compliance

12. Security Measures

We use industry-standard measures including encryption in transit (HTTPS/TLS), access controls (RLS in Supabase), and authenticated API access. No method is 100% secure.

13. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object, portability, and withdraw consent.

California (CCPA/CPRA): Rights to know, delete, correct, and opt out of sale/sharing (we do not sell). Non-discrimination applies.

Brazil (LGPD), Canada (PIPEDA): Similar rights subject to local law.

To exercise rights, email [email protected]. We may verify your identity. You may lodge a complaint with your supervisory authority (EEA/UK).

14. Account Deletion Procedures

You may delete your account in the app under Settings → Edit Profile → Delete account. You may also email [email protected] from your registered email. A dedicated walkthrough for store listings is at Account & data deletion.

We will delete or anonymize your account and personal data subject to exceptions (legal obligations, dispute resolution, league integrity records). Shared match history needed for other players’ competitions may remain in anonymized form.

15. Children’s Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child provided data, contact us for deletion.

16. Marketing Communications

We may send transactional emails (verification, password reset). We do not currently send promotional email. If we do in future, we will provide opt-out.

17. Push Notifications

The current version uses in-app invite notifications via Supabase data/realtime, not mobile push SDKs. If push is added later, we will request OS permission and update this policy.

18. User Controls

You may:

Edit profile and social links in the app (where enabled);
Sign out from Settings;
Delete your account in Settings;
Manage team/league memberships and invites;
Report content and block users;
Control follow/like actions on the Explore feed.

19. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via the app or email where required. The “Last updated” date at the top of this page will change when we post a new version.

20. Contact Us

BALLO NETWORK LTD
Email: [email protected]
Address: Uganda, Kampala, Makindye Division West, Makindye Division, Makindye II, Dubai