PIVOT Privacy Policy

Effective date: 28 August 2026. Version 1.0.

This Privacy Policy explains how Ivan Gajinov ("PIVOT", "we", "us", "our") collects, uses, shares and protects personal data when you use the PIVOT mobile application and the services behind it (together, the "Service"). It applies wherever you are in the world. Where a particular law gives you extra rights, section 13 explains them.

Please read this policy together with our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Who is responsible for your data

The controller of your personal data is:

Ivan Gajinov, Republic of Serbia
Privacy contact: support@pivotball.com

If you have any question about this policy or about how we handle your data, contact us at the privacy address above. We aim to answer every request within one month.

2. The short version

• PIVOT is a free-to-play basketball prediction app. There are no stakes, no payments and no advertising.
• To create an account we need an email address and a password, or a Google or Apple sign-in, plus a nickname. Everything else on your profile is optional.
• Your nickname, join date, prediction record, settled arena picks and leaderboard position are public. Your email, name, age, country, pending picks and private-league picks are not.
• We do not use analytics or advertising SDKs, do not track you across other apps or websites, and do not sell your data.
• Your data is stored in the European Union, with providers bound by data processing agreements.
• You can download everything we hold about you and delete your account, immediately and permanently, from inside the app.
• PIVOT is for adults. You must be 18 or older to use it.

3. The data we collect

3.1 Data you give us

Account data. When you register with an email address we collect your email address, a password (stored only as a salted hash by our authentication provider; we never see the password itself) and the nickname you choose. When you sign in with Google or Apple we receive from that provider your email address, a provider account identifier and, depending on the provider and your settings, your name and profile picture. We use these to create and sign you into your PIVOT account.

Profile data. After registration you may choose to add a first name, last name, age and country to your profile. These fields are optional, you can clear them at any time, and they are never shown to other users. Your nickname (also called your username) is public.

Messages you send us. If you contact us by email we keep the correspondence so that we can answer you and keep a record of what was agreed.

3.2 Data generated by your use of PIVOT

Predictions ("picks"). Every pick you make is recorded with the market it was made on, the side you chose, the time you made it and, once the game is settled, its outcome (hit, miss or void). Picks you withdraw before a game starts are deleted.

Performance statistics. From your settled picks we compute your record: total picks, hits, misses, win rate, current and best streak, and breakdowns by competition, month, round and market type. Some of these figures are public (see section 5).

Private leagues. When you create a league we store its name, the scoring category you chose and your ownership of it. When you join a league we store your membership, the date you joined, your league picks and your league standing. Invite codes you generate are stored with your account identifier until they expire, are used up or are revoked.

Search queries. Text you type into search is sent to our servers to return results. Queries are not stored beyond the request and are not linked to your account.

Device settings. Your theme choice, favourite competition and "remember me" preference are stored only on your device.

3.3 Data collected automatically

Server logs. When your device communicates with our servers we record the IP address, the request path and parameters, the response status and timing, and technical request headers such as the user agent string that identifies your app version, operating system and device model. Authentication tokens are redacted from these logs. Logs are used for security, debugging and abuse prevention and are kept for a short period (see section 8).

Authentication events. Our authentication provider records sign-in, sign-out, token refresh and password reset events together with the IP address and user agent of the device making them.

Rate limiting. To prevent abuse, our servers hold a short-lived in-memory count of requests per account and, for unauthenticated requests, per IP address. These counts are discarded within one minute.

Push notifications (when available). If we add push notifications and you enable them, your device will issue a notification token that we store so we can deliver notifications to it. You can turn notifications off at any time in your device settings, and we delete the token when you do or when you delete your account.

3.4 Data we do not collect

We do not collect precise location, contacts, photos, camera or microphone data, advertising identifiers, payment details or biometric data. The PIVOT app contains no analytics, crash-reporting or advertising SDKs and does not set cookies.

3.5 Data about athletes, teams and competitions

PIVOT displays names, positions, ages, nationalities, statistics and results of professional basketball players and teams. This information is licensed from third-party sports data providers and concerns public figures in their professional capacity. We process it on the basis of our legitimate interest in providing a sports information and prediction service. It is not derived from your data, and nothing about you is sent to those providers.

4. Why we use your data and on what legal basis

We only process your personal data where we have a legal basis to do so. Under the GDPR and equivalent laws, those bases are:

To provide the Service (performance of a contract, Article 6(1)(b) GDPR). Creating and maintaining your account, signing you in, recording and settling your picks, computing your record, running leaderboards and private leagues, showing you the community's split on each game, delivering the data export and carrying out the account deletion you request, and sending transactional emails such as verification codes and password resets. The public profile and leaderboard are core features of the Service you sign up for.

To keep the Service secure and working (legitimate interests, Article 6(1)(f) GDPR). Logging requests, rate limiting, detecting and preventing fraud, cheating and abuse, debugging errors, maintaining backups and enforcing our Terms of Service. Our interest is in running a safe, reliable service for all users; we have assessed that this processing does not override your rights, and we have limited the data and retention to what is needed.

To comply with the law (legal obligation, Article 6(1)(c) GDPR). Responding to lawful requests from authorities, keeping records we are required to keep and handling data protection requests.

With your consent (Article 6(1)(a) GDPR). Push notifications, and any marketing communications we may introduce in the future. We do not send marketing communications today. Where processing is based on consent you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you. The settlement of picks and the calculation of rankings are automated but follow fixed, published rules and have no legal effect.

5. What other users can see

Because PIVOT is a community prediction game, some of your information is visible to other users and, through public profile pages, to anyone using the app:

• your nickname, your account identifier and the date you joined;
• your prediction record: total picks, hits, misses, win rate, current and best streak, and breakdowns by market type;
• your settled arena picks (hit, miss or void), together with the game and market each one was made on;
• your position on the global leaderboard;
• a profile picture, if that feature is offered and you set one.

The following are never shown to other users: your email address, first and last name, age, country, pending (unsettled) arena picks, and all private-league picks. Private-league picks are not visible even to other members of the same league. Your league standing and membership are visible to the other members of that league.

The percentage split shown on each game is an anonymous aggregate of all users' picks. It cannot be used to identify any individual user.

Please choose your nickname and league names with this visibility in mind. Do not include personal information about yourself or anyone else in them.

6. Who we share your data with

We do not sell your personal data and we do not share it with anyone for advertising. We share data only in the following cases.

6.1 Service providers (processors)

These companies process data on our behalf, under our instructions and a written data processing agreement, and may not use it for their own purposes:

• Supabase, Inc. (United States) provides our authentication service, database, realtime updates and transactional email delivery. Supabase hosts our project on Amazon Web Services infrastructure in a European Union region. Supabase holds your email address, password hash, sign-in provider identity, session tokens, authentication event logs, and the application database described in section 3.
• Railway Corp. (United States) hosts our application servers in a European Union region. Railway holds the server logs described in section 3.3 for the retention period in section 8.
• Amazon Web Services EMEA SARL (Luxembourg) provides the underlying cloud infrastructure used by Supabase.

6.2 Independent third parties

These parties receive limited data as a consequence of features you use, and process it under their own privacy policies as independent controllers:

• Google LLC and Apple Inc., when you choose to sign in with Google or Sign in with Apple. Google or Apple learns that you are signing in to PIVOT and shares with us the data described in section 3.1. Their handling of your data is governed by their own policies.
• Google Fonts (Google LLC; Google Ireland Limited for users in the EEA, UK and Switzerland). The PIVOT app loads its typeface from Google Fonts when it first runs on your device. Your device's IP address and a standard font request are sent to Google for that purpose. Google states that it does not use Google Fonts requests to set cookies or build profiles. We intend to bundle the typeface inside the app in a future release, which will remove this request.
• Apple Inc. and Google LLC as app store operators. Downloading PIVOT from the App Store or Google Play is governed by Apple's and Google's own terms and privacy policies. We receive no personal data from the stores beyond aggregated, non-identifying statistics.

6.3 Sports data providers

Our schedules, live scores, statistics and reference lines come from third-party sports data providers (currently API-Sports and The Odds API). Our servers request this data on your behalf. No personal data about you is sent to those providers.

6.4 Legal and business reasons

We may disclose personal data where we believe in good faith that it is necessary to comply with a law, regulation, court order or lawful request from a public authority; to enforce our Terms of Service; to protect the rights, property or safety of PIVOT, our users or the public; or in connection with a merger, acquisition, financing or sale of all or part of our business, in which case the recipient will be bound by this policy.

7. International transfers

Your data is stored on servers in the European Union. Some of our service providers are established in the United States and may access data from there, for example for support or maintenance. Where personal data is transferred outside the European Economic Area, the United Kingdom, Switzerland or Serbia, we rely on:

• the European Commission's Standard Contractual Clauses, as incorporated in our data processing agreements with Supabase and Railway, together with the UK International Data Transfer Addendum where UK data is concerned; or
• an adequacy decision of the European Commission (or the equivalent UK or Swiss decision) for the destination country; and
• additional technical measures, including encryption in transit and at rest.

You may ask us for a copy of the safeguards in place by contacting the privacy address in section 1.

8. How long we keep your data

• Account, profile, picks, statistics and league data: for as long as your account exists. When you delete your account, all of it is deleted immediately and permanently (see section 9.2). We may also delete accounts that have not signed in for 36 months, after which the same deletion applies.
• Anonymous aggregate pick counts: the community split shown on each game counts your picks without any identifier. These counts are retained after account deletion because they cannot be linked to you.
• Invite codes: until they expire, are used up or are revoked, whichever comes first, and in any event no later than account deletion.
• Server logs: up to 30 days, after which they are automatically deleted by our hosting provider.
• Authentication event logs held by our authentication provider: up to 7 days.
• Rate-limiting counters: up to 60 seconds, in memory only.
• Database backups: encrypted daily backups are rotated on a fixed schedule and are deleted within 7 days. Data deleted from the live database may persist in a backup until that backup is rotated out; backups are used only to restore the Service after a failure and are never used to restore an individual's deleted account.
• Correspondence with us: up to 3 years after the matter is closed, or longer where the law requires.
• Data needed to establish, exercise or defend legal claims: for the applicable limitation period.

9. Your rights

9.1 What you can ask for

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data. You can edit your nickname, name, age and country at any time in the app.
• Erase your data ("right to be forgotten").
• Restrict processing in certain circumstances, for example while a dispute about accuracy is resolved.
• Port your data: receive it in a structured, commonly used, machine-readable format.
• Object to processing based on our legitimate interests, and to any direct marketing at any time.
• Withdraw consent where processing is based on consent.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Lodge a complaint with a supervisory authority (see section 9.4).

We will not discriminate against you for exercising any of these rights.

9.2 Tools inside the app

Two of these rights are built into PIVOT so you do not need to ask us:

• Export my data (Settings, Account, Export my data) produces a JSON file containing your profile, your account identifier and email, all your arena picks with their outcomes, your league memberships and all your league picks, together with the game and market each pick relates to. The file is handed to your device's share sheet; we do not send it anywhere ourselves.
• Delete account (Settings, Account, Delete account) permanently deletes your login and every record we hold about you in a single operation: your profile, picks, statistics, league memberships, league picks, standings and invite codes. If you own a league that has other members, ownership passes to the longest-standing member so that the league can continue; a league with no other members is dissolved. Deletion is immediate and cannot be undone. Anonymous aggregate pick counts and server logs within their retention period are not affected.

9.3 Asking us directly

For any other request, or if you cannot use the in-app tools, email the privacy address in section 1 from the email address linked to your account. We may ask you for further information to confirm your identity before acting on a request. We respond within one month; where a request is complex we may extend this by up to two further months and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

9.4 Supervisory authorities

You may complain to a data protection authority at any time, in particular in the country where you live, work or where you believe an infringement occurred.

• Serbia: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection), Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs.
• European Union and EEA: the authority of your member state; a list is published by the European Data Protection Board at edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.
• Switzerland: the Federal Data Protection and Information Commissioner, edoeb.admin.ch.

We would appreciate the chance to resolve your concern first, so please consider contacting us before you contact an authority.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk, including: encryption of all traffic between the app and our servers (TLS) and of data at rest; passwords stored only as salted hashes by our authentication provider; short-lived signed access tokens; database access rules that block any direct access to personal tables from outside our servers; server-side rate limiting; redaction of credentials from logs; access to production systems restricted to the people who operate the Service; and separate staging and production environments.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, without undue delay and in accordance with applicable law.

Please protect your account by choosing a strong, unique password and keeping your device secure.

11. Children

PIVOT is intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a person under 18, we will delete it. If you believe a minor has created an account, contact us at the privacy address in section 1.

12. Marketing, notifications and future features

We do not send marketing emails today. If we introduce marketing communications, we will ask for your consent first where the law requires it, and every message will contain an easy way to opt out.

If we introduce push notifications, they will be off until you enable them, and you can disable them at any time in your device settings.

If we introduce contests or promotions with prizes, each one will have its own official rules describing any additional data we collect for it, such as the details needed to deliver a prize.

13. Additional information for specific regions

13.1 European Economic Area, United Kingdom and Switzerland

The GDPR, the UK GDPR and the Swiss Federal Act on Data Protection apply to our processing of your data. Sections 4, 7 and 9 describe the legal bases, transfer safeguards and rights those laws provide. You may contact us directly, at the privacy address in section 1, about any matter concerning your data.

13.2 Republic of Serbia

We are established in Serbia and process personal data in accordance with the Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette of the Republic of Serbia No. 87/2018). The rights described in section 9 correspond to your rights under that law. Where this policy refers to a GDPR article, the corresponding provision of the Serbian law applies to you in the same way. The competent supervisory authority is the Commissioner named in section 9.4.

13.3 United States

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive privacy law, the following applies in addition to the rest of this policy.

Categories of personal information. In the preceding 12 months we have collected the categories described in section 3: identifiers (email address, account identifier, nickname, IP address, sign-in provider identifier), personal details (optional first name, last name, age and country), internet or network activity (server logs, app usage such as picks and league activity), and inferences limited to your prediction statistics. We collect them from you directly, from your device, and from Google or Apple if you sign in with them. We use them for the purposes in section 4 and disclose them to the service providers in section 6.1 for business purposes.

Sale and sharing. We do not sell personal information and have not done so in the preceding 12 months. We do not share personal information for cross-context behavioural advertising, and we do not process sensitive personal information for the purpose of inferring characteristics about you. Because we do not sell or share, there is no opt-out to offer, and we do not respond differently to Global Privacy Control signals.

Your rights. You have the right to know what personal information we collect, use and disclose; to access it in a portable format; to correct it; to delete it; and not to be discriminated against for exercising these rights. Use the in-app tools in section 9.2 or contact us as described in section 9.3. You may designate an authorised agent to make a request on your behalf; we will ask the agent for proof of your written authorisation and may verify your identity directly with you. If we deny a request you may appeal by replying to our decision; we will explain the outcome of the appeal and, where applicable, how to contact your state attorney general.

California "Shine the Light" (Civil Code section 1798.83). We do not disclose personal information to third parties for their direct marketing purposes.

Retention. Section 8 sets out how long we keep each category of personal information.

13.4 Brazil

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. The legal bases in section 4 correspond to Articles 7 and 11 of the LGPD. You may exercise the rights in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing, by using the tools in section 9.2 or contacting us. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our contact for the purposes of Article 41 is the privacy address in section 1.

13.5 Canada

If you are in Canada, we process your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. By using PIVOT you consent to the collection, use and disclosure described in this policy, and you may withdraw that consent, subject to legal and contractual restrictions, by deleting your account or contacting us. You may access and correct your personal information and complain to the Office of the Privacy Commissioner of Canada.

13.6 Australia

If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply. Your data is stored outside Australia, in the European Union, with the safeguards described in section 7. You may access and correct your personal information and complain to us; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner.

13.7 Other countries

Wherever you are, you have at least the rights described in section 9, and we apply the safeguards described in this policy to your data. If the law of your country gives you further rights, contact us and we will honour them.

14. Changes to this policy

We may update this policy from time to time. The effective date and version number at the top tell you when it last changed. For material changes we will notify you inside the app, by email, or both, before the change takes effect, and where the law requires it we will ask for your consent. The current version is always available in the app under Settings, App info, Privacy policy.

15. Contact

For anything concerning your personal data:

Ivan Gajinov, Republic of Serbia
Email: support@pivotball.com

For general support: support@pivotball.com.