WinBall privacy policy and information on how personal data is protected.
CH Global Bilişim Teknolojileri Limited Şirketi — Istanbul, Turkey
Version 2.0 · Effective: 10 July 2026
Data Controller: CH Global Bilişim Teknolojileri Limited Şirketi — Istanbul, Turkey ("WinBall", "we"). Contact: info@winballapp.com
WinBall is a mobile application and website that provides statistics, analysis, and prediction content relating to football matches. WinBall is not a betting platform: no betting is offered within the app, no redirection to betting sites takes place, and no money transfers are carried out through the app. Our content is for informational purposes only and is intended for users over the age of 18.
This policy covers the WinBall mobile application (iOS and Android) and the winballapp.com website. We process your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the European Union General Data Protection Regulation ("GDPR") depending on your country of residence, and applicable legislation. For the detailed disclosure under the KVKK, you may also review our KVKK / Disclosure Notice page.
1. What Data Do We Collect?
a) Information you provide directly to us (when creating an account)
Email address (required) — the identifier of your account; used for login, email verification, and password reset.
First and last name (required) — for display on your profile and to address you.
Password (required) — never stored in plain text; irreversibly encrypted using the industry-standard bcrypt algorithm.
Date of birth (required) — its sole purpose is 18-years-of-age verification. Age verification is performed server-side; registrations by persons under 18 are rejected. Your date of birth is not used for any other purpose and is not shared with third parties.
b) Collected automatically (while you use the app)
User ID — a random identifier assigned to your account within our system.
Device/push identifiers (Device ID, push token) — generated only if you grant notification permission, in order to deliver notifications to your device.
App language — so that notifications and emails are sent to you in your language.
Device platform (iOS/Android) — for aggregate usage statistics; raw device information is not stored.
Subscription status — whether your Premium membership is active (see Section 4).
IP address — processed only for security purposes (to limit account takeover and abuse attempts), for a short duration; it is not saved to our database.
Diagnostic data (not linked to your identity) — your device's operating system provider (Apple/Google) may transmit to us aggregate crash and performance data not associated with your identity, if you have granted permission in your device settings; in addition, our notification infrastructure produces aggregate delivery statistics. There is no separate analytics or crash-tracking SDK embedded in the app.
c) On the website
Our site does NOT use advertising or tracking cookies. Records are kept in your browser's local storage (localStorage) for two purposes only: (1) to remember your language preference (this record is not transmitted to us) and (2) to measure the site's total visits anonymously. Visit counting runs on our own server; your IP address is not stored, no personal information is kept, no cross-site tracking is performed, and this data is not linked to your identity.
If you use the contact form, your name, email, and message are processed solely to respond to your request.
What we do not collect: We do not collect location, contacts, photos/camera, microphone, health data, or advertising identifiers (IDFA/AAID); we do not use third-party advertising or tracking SDKs; your credit card/bank details never reach us at any stage.
2. Why and on What Legal Basis Do We Process Your Data?
We process your data for the following purposes and on the legal bases set out in KVKK Art. 5 / GDPR Art. 6:
Creation of your account, login, and content delivery — Establishment and performance of a contract (m.5/2-c · 6/1-b).
18-years-of-age verification — Legitimate interest: our adults-only content policy and app store rules (m.5/2-f · 6/1-f).
Email verification, password reset, account security — Performance of a contract and legitimate interest (security).
Subscription verification and Premium access — Performance of a contract.
Push notifications — Your explicit consent; you grant the notification permission on your device and may turn it off at any time (m.5/1 · 6/1-a).
Promotional notifications — Consent; can also be turned off from the app settings.
Security and abuse prevention (IP rate limiting) — Legitimate interest.
Compliance with legal obligations — As prescribed by law (m.5/2-a,ç · 6/1-c).
No automated decision-making or profiling producing legal effects concerning you is carried out on your data. Basic content targeting is performed based on your notification preferences and membership status; this is not profiling that produces legal effects.
3. With Whom Is Your Data Shared?
We do not sell your data and do not share it for advertising purposes. We share limited data only with contractually bound service providers necessary for the operation of the service:
Our hosting provider (Germany) — Server and database hosting. The provider does not process the data for its own purposes.
Our notification infrastructure provider (USA) — Delivery of push notifications. User ID, push identifiers, language, and notification preferences are shared; name, email, and date of birth are not sent.
Our subscription verification provider (USA) — Verification of subscription purchases. User ID, email, display name, and store transaction data (product, store) are shared.
Apple App Store / Google Play (USA) — Payment processing. All payment and card transactions are carried out directly by Apple/Google; only the subscription verification result is transmitted to us.
Our email delivery provider (USA) — Transactional emails (verification, password reset). Recipient email address and name are shared.
No user data is sent to the sports-data provider from which we obtain match, odds, and score data; those requests are made from our servers, using match parameters only.
Each of these providers processes your data only on our instructions and under an obligation to protect it to at least the level we provide.
International transfers
As shown in the table above, notification, subscription, and email services are carried out through providers established in the USA. Our notification infrastructure provider holds the EU-U.S. Data Privacy Framework certification and applies Standard Contractual Clauses; transfers with the other providers are carried out under data processing agreements and appropriate safeguards. The current list of these providers is shared with you upon your request, within the scope of your rights set out in Section 10. Transfers under the KVKK are carried out in accordance with the conditions in the legislation relating to these processing activities that are necessary for the performance of the service.
4. About Purchase Data
When you purchase a Premium subscription, your payment is processed entirely by the Apple App Store or Google Play. Your card details never reach us. No transaction-level purchase record is kept in our systems; only whether your subscription is active and its end date are stored. The verification record of your subscription is kept, associated with your account, at our subscription verification provider.
5. How Long Is Your Data Retained?
Account data (email, first/last name, date of birth, language, platform) — Until your account is deleted.
Session key (on your device) — 7 days; invalidated immediately upon a password change.
Subscription event logs (technical) — 30 days (deleted automatically).
Security counters (IP-based) — 15 minutes (in memory; not written to disk).
Backup copies of deleted account data — Up to 14 days (automatic destruction).
6. Deleting Your Account and Your Data
You can delete your account yourself, from within the app: Profile → Delete Account (you confirm with your password). Upon deletion:
Your account record and associated notification records are deleted from our system immediately and permanently (there is no waiting period),
Your record in the notification infrastructure is also deleted automatically,
Deleted data may remain in routine backup copies for up to a further 14 days and is then destroyed automatically,
Subscription verification records may additionally be retained at the subscription provider within the framework of obligations arising from financial legislation.
If you cannot access the app, you can send your deletion request to info@winballapp.com from your account's registered email address. If you have an active subscription, you must also cancel your store subscription separately from your App Store/Google Play subscription settings (deleting your account does not automatically cancel the store subscription).
7. Notification Preferences
Push notifications are entirely optional. You can turn off notifications completely from your device settings, or manage them by category (free content, picks of the day, promotions) from the notification preferences screen within the app. You may withdraw your consent at any time; this does not affect the lawfulness of processing prior to the withdrawal.
8. Data Security
All data transmission is encrypted with TLS (HTTPS).
Passwords are stored irreversibly with bcrypt; they are hidden by default in system queries.
Sessions are managed with signed, time-limited keys (JWT); upon a password change, old sessions are invalidated.
The session key on your device is kept in the operating system's encrypted secure store.
Verification/reset links are stored in the database only as a hash.
Server access is restricted by key-based authentication; rate limiting is applied to account operations.
Premium content access is verified server-side; email addresses are masked in logs.
No system is 100% secure; however, we apply industry-standard technical and administrative measures to protect your data and review them regularly.
9. Children's Privacy
WinBall is not intended for persons under the age of 18. Age verification is performed via date of birth during registration, and registrations by persons under 18 are rejected server-side. If we detect that data belonging to a user under 18 has been processed, we delete the account and its associated data. If you suspect such a situation, please report it to info@winballapp.com.
10. Your Rights
Under KVKK Art. 11 and (if you are resident in the EU) the GDPR, you have the following rights:
To learn whether your data is being processed and to request access to it,
Rectification — to request the correction of incomplete or inaccurate data,
Erasure / right to be forgotten — to request the deletion of your data within the framework of the conditions in the legislation,
To request restriction of processing and to object to processing,
Data portability — to receive your data in a structured format,
To withdraw the consent you have given at any time,
To request notification of third parties to whom data has been transferred; to object to an adverse outcome arising as a result of analysis by automated systems,
To claim compensation in the event you suffer damages.
You can send your requests to info@winballapp.com; after verifying your identity, we respond free of charge within 30 days at the latest. You also retain the right to lodge a complaint with the Personal Data Protection Authority in Turkey (kvkk.gov.tr) or, if you are resident in the EU, with the data protection authority of your country.
11. Changes to This Policy
We may update this policy from time to time. We announce significant changes via in-app notification or email; the effective date of each version appears at the top of this page. Your continued use of the service after a change means that you accept the updated policy.
12. Contact
For all privacy-related questions, requests, and applications: CH Global Bilişim Teknolojileri Limited Şirketi — Istanbul, Turkey. Email: info@winballapp.com
Stay one step ahead with professional football analyses and data-driven predictions.
Payments are handled securely in-app via the App Store and Google Play.
18+ · Our predictions are for information and analysis purposes only; they do not guarantee any outcome. This platform does not offer betting and does not direct users to any betting site. Illegal betting is a crime. Please act responsibly.