Privacy Policy

Last updated: May 1, 2026 | In effect since: May 1, 2026

0. Data Controller

This App is operated by the Leopardo operators. For any privacy matter, contact us at [email protected].

Nature of the App. Leopardo is a sports prediction game with no real-money wagering. Prizes are non-monetary (rankings, badges, social recognition). The Premium subscription unlocks premium features (advanced statistics and an ad-free experience); it does not grant access to chance-based activities.

1. Information We Collect

Leopardo ("the App") collects the following information:

• Account data: Email, username, and password (stored encrypted with bcrypt). Email and password are required to create and access your account; without them you cannot use the App.
• Usage data: Match predictions, groups you belong to, scores, rankings, and interactions with invitation links ("landing visits").
• Technical data: IP address (for security and geo-blocking), device language, device type, and an internal install identifier. This identifier is local to the App, is not the IDFA or AAID, and is not used for cross-app tracking.
• Advertising identifiers: On iOS the IDFA (Identifier for Advertisers) and on Android the Advertising ID (AAID), only when you authorize tracking (see section 9).
• Push notification token: Firebase Cloud Messaging identifier used to send match alerts and pool activity.
• Purchase history: If you subscribe to the Premium plan, we record the subscription events (start, renewal, cancellation) through RevenueCat. We do not store your card number — it is handled by Apple/Google.
• Google Sign-In: If you use Google, we receive your name, email, and profile photo. We do not access your contacts or other data.
• Sign in with Apple: If you use Apple, we receive a unique identifier and, optionally, your name and email. If you enable "Hide My Email", Apple gives us a relay address and your real email never reaches our servers.

We do not use third-party analytics or automated crash reporting (no Firebase Analytics, no Crashlytics). We do not collect special categories or sensitive personal information (CCPA/CPRA).

2. How We Use Your Information and Legal Bases (GDPR Art. 6)

We process your data for the following purposes, on the following legal bases:

• Performance of contract: creating and operating your account, participation in groups and tournaments, score and ranking calculation, validating and recording Premium subscriptions.
• Legitimate interest: platform security, fraud and abuse prevention, geo-blocking, non-personalized advertising, service improvement.
• Consent: push notifications, advertising identifiers (IDFA/AAID), personalized advertising, and receiving data from Google Sign-In or Sign in with Apple.
• Legal obligation: retention of accounting and tax records associated with Premium subscriptions.

You may withdraw consent at any time without affecting the lawfulness of prior processing. We do not make automated decisions producing legal or similarly significant effects (GDPR Art. 22).

3. Sharing Information

We do not sell your personal information. We share it only with the providers we need to operate the App, and they only process data according to our instructions under Data Processing Agreements (DPAs). Any third party with whom we share data is contractually required to provide the same or greater protection as set out in this Policy:

• Google / Firebase: Authentication (sign-in), Cloud Messaging (push notifications), and AdMob (advertising).
• Apple: Sign in with Apple (alternate sign-in).
• RevenueCat: Subscription management and purchase validation.
• Infrastructure (Data Processors): Hosting, database, and transactional email delivery, operated by enterprise providers based in the United States under Data Processing Agreements with the European Commission's Standard Contractual Clauses. The current list of processors is available free of charge on request at [email protected] within 10 business days.
• Legal requirements: If required by law or legal process.

4. Storage, Security and International Transfers

• Data is stored on servers in the United States (us-east-1) with SSL/TLS encryption.
• Passwords are stored with bcrypt hashing (never in plain text).
• Authentication tokens are stored encrypted on mobile devices.
• We implement rate limiting, account lockout, and input sanitization.
• International transfers: personal data transfers outside the EEA / United Kingdom / Switzerland are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission and, for UK users, the International Data Transfer Addendum (IDTA) issued by the ICO.

5. Your Rights

You can:

• Access your personal data through your profile in the App.
• Delete your account directly from the App: Settings → Delete account. The deletion removes your account, predictions, special predictions (champion, top scorer, etc.), owned groups and the tournaments created within them, sent invitations, landing visits derived from those invitations, associated transactional email logs, registered devices (FCM/APNs tokens), and subscription data. As a backup, you can also request it by email at [email protected].
• Revoke Google Sign-In access from your Google account.
• Revoke Sign in with Apple from Settings → Apple ID → Sign in with Apple.

6. Data Retention

We keep your data while your account is active. If you request deletion (in-app or by email), your data will be removed within 30 days. Records required by legal obligations (subscription accounting and tax records) are retained for the applicable legal period after deletion.

7. Children

The App is not intended for children under 13 and we do not knowingly collect their information. If we receive actual knowledge (for example, by report) that an account belongs to a child under 13, we will delete the account and associated data without delay.

8. Advertising

Free plan users will see ads provided by Google AdMob. Premium users do not see ads. For more information on how Google and its partners use data to serve ads, see https://policies.google.com/technologies/partner-sites. Read section 9 about how you control ad personalization.

9. App Tracking Transparency, IDFA and UMP Consent

On iOS, the first time you open the App we will ask permission to use the "Identifier for Advertisers" (IDFA) via Apple's standard App Tracking Transparency dialog.

• If you allow: Google AdMob may use the IDFA to show personalized ads and measure their performance. The IDFA may be shared with ad networks.
• If you do not allow: You will only see non-personalized ads. AdMob does not receive the IDFA.
• Change your decision: You can enable or disable tracking at any time in Settings → Privacy & Security → Tracking on your iPhone.

In the European Union, the United Kingdom and Switzerland, on both iOS and Android, we show a UMP (User Messaging Platform) consent form before loading personalized ads, with options independent of the iOS decision.

10. GDPR Rights (EEA / UK / Switzerland users)

If you reside in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate data.
• Erasure: Delete your account and associated data (in-app or by email).
• Restriction: Limit how we process certain data.
• Portability: Receive an exportable copy of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
• No automated decision-making: We do not subject you to automated decisions with legal or similarly significant effects.
• Complaint: Lodge a complaint with your country's supervisory authority.

To exercise any of these rights, write to [email protected]. We will respond within the legal 30-day window.

11. Notice for California Residents (CCPA/CPRA)

In the past 12 months we collected the following categories of personal information:

• Identifiers: email, internal account ID, IDFA/AAID (when you authorize tracking).
• Commercial information: Premium subscription history.
• Internet or other network activity: in-app usage, predictions, interactions.
• Approximate geolocation: derived from IP address.

Sources: directly from you when you use the App, and from providers such as Google and Apple when you choose to sign in with them.

Business purposes: those described in section 2.

We do not sell personal information for monetary consideration. When you authorize tracking (ATT) on iOS, we share the IDFA with Google AdMob for cross-context behavioral advertising, which the CPRA defines as "Sharing".

Do Not Sell or Share My Personal Information. You can opt out by: (a) declining the App Tracking Transparency dialog on iOS; (b) declining the "personalized ads" option in the UMP form when shown; or (c) emailing [email protected].

We do not collect sensitive personal information in the CPRA sense.

As a California resident you also have the right to know, delete, correct, limit the use of sensitive personal information (not applicable here), and not be discriminated against for exercising these rights.

12. Colombia Section — Habeas Data (Law 1581 of 2012, Decree 1377 of 2013)

As a Data Subject, under Colombian law you have the right to:

• Know, update, and rectify your personal data.
• Request proof of the authorization granted to the Controller.
• Be informed, upon request, about the use given to your data.
• File complaints with the Superintendencia de Industria y Comercio (SIC) for breaches of Law 1581 of 2012.
• Revoke the authorization and/or request the deletion of data when processing does not comply with the law.
• Free access to your personal data being processed.

Procedure. Inquiries are handled within 10 business days (extendable by 5) and complaints within 15 business days (extendable by 8), counted from receipt of the request. Contact channel: [email protected].

Authorization. By creating an account or accepting this Policy within the App you grant your prior, express, and informed authorization to process your data for the purposes described in section 2.

Effective date. This policy enters into force on May 1, 2026. Data will be processed for the duration of your account and for applicable legal periods after deletion.

13. Changes to This Policy

We may update this policy occasionally. We will notify you of significant changes through the App or by email.

14. Contact

For privacy questions: [email protected]

Politica de Privacidade

Ultima atualizacao: 1 de maio de 2026 | Vigencia: a partir de 1 de maio de 2026

0. Controlador dos Dados

Este App e operado pelos operadores de Leopardo. Para questoes de privacidade contate-nos em [email protected]. Este canal tambem atende como Encarregado (DPO) sob a LGPD.

Natureza do App. Leopardo e um jogo de previsoes esportivas sem apostas com dinheiro real. Os premios sao nao monetarios (rankings, insignias, reconhecimento social). A assinatura Premium desbloqueia funcionalidades premium (estatisticas avancadas e experiencia sem publicidade); nao concede acesso a atividades de azar.

1. Informacoes que coletamos

Leopardo ("o App") coleta as seguintes informacoes:

• Dados da conta: Email, nome de usuario e senha (armazenada criptografada com bcrypt). Email e senha sao necessarios para criar e acessar a conta; sem eles nao e possivel utilizar o App.
• Dados de uso: Previsoes de partidas, grupos, pontuacoes, rankings e interacoes com links de convite ("landing visits").
• Dados tecnicos: Endereco IP (seguranca e geo-bloqueio), idioma do dispositivo, tipo de dispositivo e identificador interno de instalacao (local ao App, nao e IDFA nem AAID, nao usado para rastreamento entre apps).
• Identificadores publicitarios: No iOS o IDFA e no Android o Advertising ID (AAID), somente quando voce autoriza o rastreamento (ver secao 9).
• Token de notificacoes push: Identificador do Firebase Cloud Messaging para enviar avisos de partidas e atividade do seu grupo.
• Historico de compras: Se voce assina o plano Premium, registramos os eventos da assinatura (inicio, renovacao, cancelamento) atraves do RevenueCat. Nao armazenamos seu numero de cartao — e processado pela Apple/Google.
• Login com Google: Recebemos seu nome, email e foto de perfil. Nao acessamos seus contatos ou outros dados.
• Login com Apple: Recebemos um identificador unico e, opcionalmente, seu nome e email. Se ativar "Ocultar meu email", a Apple nos entrega um endereco de relay e seu email real nunca chega aos nossos servidores.

Nao utilizamos analitica de terceiros nem reporte automatico de falhas (sem Firebase Analytics, sem Crashlytics). Nao coletamos categorias especiais nem informacoes pessoais sensiveis.

2. Como usamos suas informacoes e bases legais (LGPD Art. 7 / RGPD Art. 6)

Tratamos seus dados para os seguintes fins, sob as seguintes bases legais:

• Execucao de contrato: criacao e operacao da conta, participacao em grupos e torneios, calculo de pontuacoes e rankings, validacao e registro de assinaturas Premium.
• Legitimo interesse: seguranca, prevencao de fraude e abuso, geo-bloqueio, publicidade nao personalizada, melhoria do servico.
• Consentimento: notificacoes push, identificadores publicitarios (IDFA/AAID), publicidade personalizada e recebimento de dados via Google ou Apple Sign-In.
• Cumprimento de obrigacao legal: conservacao de registros contabeis e fiscais associados as assinaturas Premium.

Voce pode revogar o consentimento a qualquer momento sem que isso afete a licitude do tratamento previo. Nao realizamos decisoes automatizadas com efeitos juridicos ou que afetem voce significativamente (LGPD Art. 20, RGPD Art. 22).

3. Compartilhamento

Nao vendemos suas informacoes pessoais. Compartilhamos apenas com os provedores necessarios para operar o App, sob Acordos de Tratamento de Dados (DPA), e somente conforme nossas instrucoes. Qualquer terceiro com quem compartilhamos dados esta contratualmente obrigado a oferecer protecao igual ou maior a desta Politica:

• Google / Firebase: Authentication (login), Cloud Messaging (push notifications) e AdMob (publicidade).
• Apple: Sign in with Apple (login alternativo).
• RevenueCat: Gestao de assinaturas e validacao de compras.
• Infraestrutura (Operadores de Tratamento): Hospedagem, banco de dados e envio de emails transacionais operados por provedores empresariais nos Estados Unidos, sob DPAs com Clausulas Contratuais Padrao da Comissao Europeia. A lista atualizada de operadores esta disponivel gratuitamente mediante solicitacao a [email protected] em ate 10 dias uteis.
• Requisitos legais: Se exigido por lei ou processo judicial.

4. Armazenamento, seguranca e transferencias internacionais

• Dados armazenados em servidores nos EUA (us-east-1) com criptografia SSL/TLS.
• Senhas armazenadas com hash bcrypt (nunca em texto puro).
• Tokens de autenticacao criptografados no dispositivo movel.
• Implementamos rate limiting, bloqueio de contas e sanitizacao de inputs.
• Transferencias internacionais: transferencias de dados pessoais fora do EEE / Reino Unido / Suica sao amparadas pelas Clausulas Contratuais Padrao (SCCs) da Comissao Europeia e, para usuarios do Reino Unido, pelo International Data Transfer Addendum (IDTA) do ICO. Para titulares no Brasil, transferencias internacionais ocorrem com base em garantias adequadas conforme a LGPD.

5. Seus direitos

Voce pode:

• Acessar seus dados pelo perfil no App.
• Excluir sua conta diretamente do App: Configuracoes → Excluir conta. A exclusao remove sua conta, previsoes, previsoes especiais (campeao, artilheiro, etc.), grupos proprios e os torneios criados, convites enviados, visitas a landing derivadas desses convites, registros de email transacional associados, dispositivos registrados (tokens FCM/APNs) e dados de assinatura. Como backup, voce tambem pode solicitar por email: [email protected].
• Revogar acesso do Google Sign-In pela sua conta Google.
• Revogar Sign in with Apple em Ajustes → ID Apple → Login com Apple.

6. Retencao

Mantemos seus dados enquanto sua conta estiver ativa. Apos solicitacao de exclusao (in-app ou por email), os dados sao removidos em ate 30 dias. Registros minimos exigidos por obrigacoes legais (contabeis e fiscais de assinaturas) sao conservados pelo prazo legal aplicavel apos a exclusao.

7. Menores

O App nao e destinado a menores de 13 anos e nao coletamos informacoes deles intencionalmente. Se recebermos conhecimento real (por exemplo, mediante denuncia) de que uma conta pertence a um menor de 13, excluiremos a conta e os dados associados sem demora.

8. Publicidade

Usuarios gratuitos verao anuncios do Google AdMob. Usuarios Premium nao veem anuncios. Para mais informacoes sobre como o Google e seus parceiros usam dados para anuncios, consulte https://policies.google.com/technologies/partner-sites. Veja a secao 9 sobre como controla a personalizacao.

9. App Tracking Transparency, IDFA e Consentimento UMP

No iOS, na primeira vez que voce abre o App pediremos permissao para usar o IDFA atraves do dialogo padrao da Apple (App Tracking Transparency).

• Se autorizar: Google AdMob pode usar o IDFA para anuncios personalizados e medir desempenho.
• Se nao autorizar: Voce so vera anuncios nao personalizados. AdMob nao recebe o IDFA.
• Mudar a decisao: A qualquer momento em Ajustes → Privacidade e Seguranca → Rastreamento no iPhone.

Na Uniao Europeia, Reino Unido e Suica, tanto em iOS quanto em Android, mostramos um formulario de consentimento UMP antes de carregar publicidade personalizada, com opcoes independentes da decisao do iOS.

10. Direitos LGPD (usuarios no Brasil)

Em conformidade com a Lei 13.709/2018 (LGPD), voce tem direito a:

• Confirmacao da existencia de tratamento.
• Acesso aos dados.
• Correcao de dados incompletos, inexatos ou desatualizados.
• Anonimizacao, bloqueio ou eliminacao de dados desnecessarios, excessivos ou tratados em desconformidade com a LGPD.
• Portabilidade dos dados a outro fornecedor de servico ou produto.
• Eliminacao dos dados pessoais tratados com base em consentimento.
• Informacao sobre as entidades publicas e privadas com as quais o controlador realizou uso compartilhado dos dados.
• Informacao sobre a possibilidade de nao consentir e suas consequencias.
• Revogacao do consentimento.
• Oposicao a tratamento realizado com fundamento em hipotese de dispensa de consentimento.
• Revisao de decisoes automatizadas (nao aplicavel — nao realizamos).

Canal do Encarregado: [email protected]. Resposta em ate 15 dias conforme art. 19 da LGPD.

Voce pode apresentar reclamacao a Autoridade Nacional de Protecao de Dados (ANPD) em https://www.gov.br/anpd.

11. Aviso para residentes da California (CCPA/CPRA)

Nos ultimos 12 meses coletamos categorias de informacao pessoal: identificadores (email, ID interno, IDFA/AAID quando autorizado), informacao comercial (historico de assinaturas), atividade de Internet (uso no App), geolocalizacao aproximada (a partir do IP). Nao vendemos informacao pessoal por dinheiro. Quando voce autoriza ATT no iOS, compartilhamos o IDFA com Google AdMob para publicidade de contexto cruzado (definido como "Sharing" pela CPRA). Voce pode optar por nao compartilhar recusando o ATT, recusando "anuncios personalizados" no UMP, ou escrevendo para [email protected]. Nao coletamos informacao pessoal sensivel. Voce tambem tem direito a saber, excluir, corrigir e a nao sofrer tratamento discriminatorio.

12. Secao Colombia — Habeas Data (Lei 1581 de 2012)

Titulares de dados na Colombia tem direitos previstos na Lei 1581 de 2012 e Decreto 1377 de 2013 (consultar, atualizar, retificar, prova da autorizacao, informacao sobre uso, queja a SIC, revogacao da autorizacao, acesso gratuito). Consultas: 10 dias uteis (prorrogaveis 5); reclamos: 15 dias uteis (prorrogaveis 8). Canal: [email protected]. Autoridade: Superintendencia de Industria y Comercio (SIC).

13. Mudancas

Podemos atualizar esta politica ocasionalmente. Notificaremos mudancas significativas pelo App ou por email.

14. Contato

[email protected]