Privacy Policy

1. Who we are

Pub XI is operated by Anemova Ltd, a company registered in England and Wales ("we", "us", "our"). We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER]. This Privacy Policy explains what personal data we collect when you use the Pub XI app, why we collect it, the legal basis under UK GDPR on which we process it, and the rights you have over it. For questions about this policy, contact us at contact@anemova.com.

2. Data we collect and why

We collect only what is necessary to run the service. The categories below set out each type of data, our purpose, and the lawful basis under UK GDPR:

Account data — your email address, display name, and optional avatar image. Purpose: to create and authenticate your account and identify you to league members. Lawful basis: performance of our contract with you (UK GDPR Art. 6(1)(b)).

Gameplay data — leagues you create or join, virtual coin balances, market predictions you place (including the market selected, stake, and outcome), yellow and red card content you write, and votes you cast. Purpose: to run your leagues and display standings. Lawful basis: performance of contract (Art. 6(1)(b)).

Technical and diagnostic data — device model, operating system version, app version, locale, anonymised installation identifiers, and crash or performance diagnostics. Purpose: to keep the app stable and fix bugs. Lawful basis: legitimate interests (Art. 6(1)(f)) — specifically our interest in maintaining a reliable service. We have balanced this against your interests and concluded it does not override your rights.

Communications — if you email us or submit a support request, we retain that correspondence. Purpose: to resolve your issue. Lawful basis: legitimate interests (Art. 6(1)(f)).

Push notification preferences — whether you have opted in to notifications and your push token. Purpose: to send in-app activity alerts. Lawful basis: consent (Art. 6(1)(a)). You can withdraw consent at any time in your device settings.

We do not collect your precise location. We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

3. Virtual currency and no real-money processing

Pub XI does not process any real-money payments for virtual coins or wagers. Any virtual coins used in the app are an entertainment mechanic with no monetary value and cannot be redeemed, exchanged, or converted into money, goods, prizes, or anything of real-world value. No financial data (card numbers, bank details) is collected or stored by us. Where in-app subscriptions are offered, payment is processed entirely by Apple or Google under their own privacy policies; we receive only a transaction confirmation and subscription status, not your payment details.

4. Third-party processors

We share data with the following processors who act on our instructions and are bound by data processing agreements:

Supabase (US, with EU data residency options) — account authentication, database, and file storage. Your account and league data is stored on Supabase infrastructure.

Sentry (US) — crash and performance diagnostics. Crash reports contain technical device data and anonymised identifiers; they do not contain your email address or display name unless these appear in an error message.

RevenueCat (US) — in-app subscription management. RevenueCat receives your anonymised app user ID and subscription status.

Apple / Expo Push Notification Service — delivery of push notifications to your device.

Where these processors are based outside the UK, we rely on appropriate safeguards for the transfer, including the UK International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses.

5. Data retention

We keep your account and league data for as long as your account is active. If you delete your account inside the app (Profile → Settings → Delete Account) we permanently and irreversibly delete your profile, display name, avatar, league memberships, predictions, cards, votes, and virtual coin history. Crash diagnostics held by Sentry are deleted on a rolling 90-day basis. Backup snapshots for disaster recovery may persist for up to 90 days after deletion before being purged from all systems. We may retain minimal records required by law (for example, transaction records for subscription refunds) for up to six years.

6. User-generated content

Yellow and red card content, league names, and display names are created by users and are visible only to members of the private league in which they were created. We do not proactively monitor content, but we will act on reports. To report abusive, harassing, hateful, sexual, or otherwise unlawful content, email report@anemova.com with the league name, a description of the content, and a screenshot if available. We aim to respond within one working week. Content that violates our Terms of Service will be removed and the responsible account may be suspended or terminated.

7. Children

Pub XI is not directed at users under 17. We do not knowingly collect personal data from anyone under 17. If you believe a child under 17 has created an account, please contact us at report@anemova.com and we will delete the account and all associated data promptly.

8. Your rights under UK GDPR

If you are based in the UK, EU, or EEA you have the following rights, which you can exercise free of charge:

Access — you can request a copy of the personal data we hold about you.

Rectification — you can correct inaccurate data via the profile settings in the app, or by emailing us.

Erasure — you can delete your account in-app (Profile → Settings → Delete Account), which erases all your personal data.

Restriction — you can ask us to restrict processing of your data in certain circumstances.

Portability — you can request a structured, machine-readable copy of data you have provided to us.

Objection — you can object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds that override your interests.

Withdraw consent — where processing is based on consent (push notifications), you can withdraw at any time in your device settings without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@anemova.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (TLS), access controls on our database, and use of industry-standard third-party infrastructure. No method of transmission over the internet is completely secure; if you become aware of any security vulnerability in the app, please disclose it responsibly to security@anemova.com.

10. Cookies and analytics

The Pub XI mobile app does not use browser cookies. We use Sentry's SDK, which sets anonymous session identifiers on-device for the purposes of grouping crash reports. No cross-app or advertising tracking is performed. We do not use advertising networks or sell data to data brokers.

11. Changes to this policy

We will update this policy when the product or applicable law changes. We will notify you of material changes through an in-app notice before the change takes effect. The version date at the top of this page shows when the policy was last revised. Continued use of the app after a material change constitutes acceptance of the updated policy.

12. Contact and complaints

Data controller: Anemova Ltd, registered in England and Wales. ICO registration: [ICO REGISTRATION NUMBER].

For privacy questions, data subject requests, or complaints: contact@anemova.com

If you are not satisfied with our response you have the right to complain to the ICO at ico.org.uk.