Privacy Policy
Last updated: 26 July 2026.
1. Data Controller
| Name: | Tippy (World Cup 2026 Tipping Game) |
| Email: | [email protected] |
| Website: | https://www.tippy.hu |
Hereinafter: "Data Controller", "we" or "Operator".
2. Data Protection Officer (DPO)
Given the nature, scope and volume of data processed, the Operator is not required to appoint a Data Protection Officer under GDPR Article 37. For data protection enquiries, please contact us at [email protected].
3. Scope and Applicable Law
This policy applies to the processing of personal data carried out through the "World Cup 2026 Tipping Game" service available at https://www.tippy.hu.
The legal framework for data processing is provided by:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
- Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.)
4. What Data Do We Collect?
4.1. Registration Data
| Data | Source | Purpose |
|---|---|---|
| Email address | Provided by the user | Account creation, login, notifications |
| Display name | Provided by the user | Identification on leaderboard and in groups |
Visibility of the display name. Your display name is visible to other members on the leaderboards and member lists of your groups. For open leagues(groups anyone may join), the top-ranked players are shown on the tournament's public page and can be viewed without signing in. You can change your display name at any time in your account. Please do not use your email address as your name — registration no longer allows it, and for names entered this way in the past we do not display the part after the @ on public surfaces.
4.2. Social Login (OAuth) Data
| Provider | Data received |
|---|---|
| Email address, display name, profile picture URL | |
| Email address, display name, profile picture URL |
Only the data listed above is received during social login. We do not access the password, friends list, or any other data from your social account.
4.3. Game Data
Match score predictions, joker activations, group memberships, scores and leaderboard positions.
4.3a. Partner Prize Draw Data
Some groups are run by a corporate partner who offers a prize draw among the group's members. In these groups, when joining, the partner may request additional details —voluntarily and behind a separate opt-in: full name, email address, year of birth and city. Providing these is not a conditionof joining the group or of playing; anyone who skips it can still make predictions and is simply left out of the prize draw. The details can be added or changed at any time on the group's page.
We store these details on the partner's behalf and make them availableexclusively to the partner running that group, for the purpose of running the prize draw. The legal basis is the data subject'sconsent(GDPR Article 6(1)(a)), which may be withdrawn at any time without giving reasons. The detailed terms of the prize draw, the purpose and the duration of the processing are set out in the partner's own prize draw terms, which we link to on the joining screen. Only people aged 18 or over may enter the draw.
4.4. Technical Data
Session cookies (to maintain logged-in state), browser type and version, IP address and device data (in server logs and in a login security log, for the prevention of abuse and unauthorised access).
4.5. Newsletter (Marketing) Data
If you give separate, explicit consent during registration or later, we also process your email address and display name for the purpose of sending newsletters (Tippy news and partner offers). This consent is voluntary, not a condition of registration, and may be withdrawn at any time via the unsubscribe link at the bottom of each email or by writing to [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
5. Purposes and Legal Bases for Processing
| Purpose | Legal basis (GDPR Art. 6) | Data processed |
|---|---|---|
| Account creation and login | Art. 6(1)(b) – performance of contract | Email, display name |
| Running the tipping game (predictions, leaderboard, joker) | Art. 6(1)(b) – performance of contract | Game data, display name |
| Prevention of abuse and unauthorised access (rate limiting, spam filtering, login security log) | Art. 6(1)(f) – legitimate interest | IP address, device/technical data, login timestamp |
| Serving advertisements (Google AdSense) | Art. 6(1)(a) – consent (via cookie banner) | Cookie identifiers, browsing data |
| Contact form enquiries | Art. 6(1)(a) – consent | Name, email, message content |
| Sending newsletters (Tippy news and partner offers) | Art. 6(1)(a) – consent | Email address, display name |
Legitimate interest balancing test (Art. 6(1)(f)): The limited processing for the prevention of abuse and unauthorised access (IP logging, rate limiting, a login security log) is a proportionate measure that protects user accounts against unauthorised access, is necessary for the security of the Service, does not unduly restrict the rights of the data subject, and is retained only for a limited period.
6. Cookies
6.1. Strictly Necessary Cookies
| Cookie name | Purpose | Expiry |
|---|---|---|
| Supabase Auth session | Maintains logged-in state | End of session / up to 30 days (or 14 days of inactivity) |
These cookies are essential for the basic functionality of the Service and may be used without consent.
6.2. Advertising and Analytics Cookies
Google AdSense advertisements may be displayed on the site. Google uses its own cookies (e.g. __gads, __gpi, NID) and tracking technologies for this purpose. These cookies are placed only with the user's prior, voluntary consent.
Consent is requested via the cookie banner displayed on the first visit. Consent may be withdrawn at any time via the browser cookie settings or the cookie banner settings.
Google's privacy policy: https://policies.google.com/privacy
7. Data Retention
| Data type | Retention period |
|---|---|
| Account data (email, name) | Until account deletion |
| Game data | Until account deletion |
| Contact form data | 1 year after the matter is closed |
| Newsletter subscription data (email, name) | Until consent is withdrawn (unsubscribe) |
| Partner prize draw data | Until consent is withdrawn, until account deletion, or until the contract with the partner ends — whichever comes first |
| Technical logs (IP address) | Maximum 30 days |
| Login security log (IP, device, timestamp) | 90 days |
After account deletion, all data is permanently removed within 30 days, unless a legal obligation requires longer retention.
8. Data Processors and International Transfers
8.1. Data Processors
| Processor | Activity | Server location | Legal basis for transfer |
|---|---|---|---|
| Supabase Inc. (USA) | Database management, authentication | EU (Frankfurt, Germany) | Standard Contractual Clauses (SCC) + EU server location |
| Vercel Inc. (USA) | Web hosting, edge network | EU edge network | Standard Contractual Clauses (SCC) + EU edge network |
| Google LLC (USA) | Ad serving (AdSense) | EU / USA | EU–US Data Privacy Framework + SCC |
8.2. Third Country Transfers
Supabase and Vercel are US-based companies that use EU servers to operate the Service. Where personal data is transferred to a third country (outside the EU/EEA), the transfer is based on the European Commission's approved Standard Contractual Clauses (SCC) pursuant to GDPR Article 46(2)(c). You may request a copy of the SCCs at [email protected].
8.3. Support — Independent Controllers
Clicking a support link takes you off tippy.hu. Payment is handled by Donably (Barion Payment Zrt.) or Revolut acting as independent controllersunder their own privacy policies — not on the Operator's behalf, which is why they are not listed among the processors in section 8.1. The Operator does not receive or processsupporters' personal data (name, email address, payment details). Clicks on the support button are recorded as an analytics event — the processing described in section 6.2 applies.
9. Your Rights
| Right | Description |
|---|---|
| Right of access (Art. 15) | Request information about what data we hold about you |
| Right to rectification (Art. 16) | Request correction of inaccurate data |
| Right to erasure (Art. 17) | Request deletion of your data ("right to be forgotten") |
| Right to restriction (Art. 18) | Request restriction of processing |
| Right to data portability (Art. 20) | Request your data in a machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interest |
| Withdrawal of consent | Withdraw consent at any time; this does not affect the lawfulness of prior processing |
Submit your request to [email protected]. We will respond within 30 days. If the complexity or number of requests warrants it, the deadline may be extended by a further 60 days; we will notify you in such cases.
You may also lodge a complaint with your local supervisory authority. In Hungary:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Phone: +36 (1) 391-1400
Email: [email protected]
Website: naih.hu
10. Automated Decision-Making
The Service uses automated score calculation for the tipping game. This automated processing is limited to scoring and ranking within the game; it produces no legal or similarly significant effect on the data subject and does not constitute automated decision-making within the meaning of GDPR Article 22. The Operator will investigate any well-founded objection regarding score calculation and manually correct it if necessary.
11. Children's Data
The Service is not available to persons under the age of 16. Under Hungarian law and GDPR Article 8, processing of personal data of a person below the age of 16 is lawful only if parental consent has been given. If we become aware that a person under 16 has registered without parental consent, we will delete that data without delay.
12. Facebook Data Deletion
If you registered with a Facebook account and would like us to delete your Tippy-related data, send an email to [email protected] with the subject "Facebook data deletion". We will process your request within 30 days.
13. Changes to This Policy
The Operator reserves the right to amend this policy. In the event of material changes, users will be notified by email and a site notice at least 15 days before the changes take effect. Where a change affects the legal basis or purpose of processing, we will seek renewed consent where required.
14. Contact
- Email: [email protected]
- Response time: within 30 days
This policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR).