Privacy Policy — ScoreSay
Published at: https://scoresay.com/en/privacy/
This policy covers the ScoreSay mobile app and shop orders. Novaurion’s other websites and voice AI platforms are governed by a separate privacy policy; the two must not be confused.
Data controller: Novaurion Yazılım ve Yapay Zeka Çözümleri
Teknopark İzmir, İzmir, Türkiye · [email protected]
Short answer
The app works without an account; an account is entirely optional. Without one it never asks for your name, email or location, and your scores stay on your phone. If you do create an account we take only your email, the nickname you choose and, if you want, an avatar; your settings and match summaries are kept on our server so they follow you across devices, and everything is deleted the moment you tap “Delete account” (details: Account). The free version shows an ad after each match via Google AdMob, and the ad technology processes limited device data for that purpose. If you buy the Ad-Free subscription (monthly or yearly), both the ads and that data processing stop entirely.
Long answer
Account is optional. The app does not require an account; every feature works without registration or sign-in, and in that case it never asks for your name, email, phone number or location. If you want your settings and match history on more than one device, you can create an account with your email address. There is no password: at sign-in a 6-digit code is emailed to you; the code is valid for 10 minutes, only its hash is kept on the server, and code records are purged within a day.
What we collect when you create an account: your email address, the nickname you choose, an optional avatar photo, the device name and platform of each device you sign in on (e.g. “iPhone · iOS”), your preferred sport and hand, and the app language. While you are signed in the following is stored on our server (scoresay.com, hosted in the United Kingdom) and synced between your devices: your app settings, your match summaries (including the player names you type), the tournaments linked to your account, and the list of signed-in devices. This data is used only to run your account; it is not used for advertising or marketing and not shared with third parties. Account data is kept until you delete the account; inside the app you can download a copy of your data (JSON) and delete everything instantly with “Delete account” (see Deleting your data).
Stored on your device. The following stays in your phone’s own storage:
- the score of the match in progress
- a summary of your recent matches
- your settings (announcement preference, remote setup, etc.)
- the last known state of your Ad-Free subscription (so you stay ad-free offline)
Player names you type are part of these records and, if you have no account, never leave the device (the one exception is tournament mode). Deleting the app deletes all of it. If you created an account and are signed in, your settings and match summaries are additionally kept on our server; the score of the match in progress is never synced.
Advertising (Google AdMob). In the free version a full-screen ad is shown when a match ends; there are no other ad placements. Ads are served by Google’s AdMob service, and Google may process: the advertising identifier (the Android advertising ID; on iOS the IDFA only if you allow it), IP address, general device information and diagnostics about ad performance.
- On Android ads may be personalised to your interests. Users in the EU/UK are shown Google’s consent screen on first launch and their choice is honoured. You can reset or delete your advertising ID at any time in your device settings (Settings → Google → Ads).
- On iOS Apple’s App Tracking Transparency prompt is shown on first launch. If you allow it, ads may be personalised and Google may use your advertising identifier (IDFA) to link activity across apps. If you decline, only non-personalised ads are shown, there is no cross-app tracking, and the app works exactly the same. You can change your choice at any time in Settings → Privacy & Security → Tracking.
How Google uses this data: policies.google.com/technologies/partner-sites
If you buy the Ad-Free subscription, the ad technology is never initialised and the ad-related data processing above stops entirely.
Purchases (RevenueCat). The Ad-Free, Tournament Pro and Tournament Elite subscriptions are bought through the App Store’s or Google Play’s own payment sheet. Your payment details (card, billing address, etc.) stay with Apple/Google; neither the app nor Novaurion ever sees them. To verify that the subscription is active we use the RevenueCat service: RevenueCat processes a randomly generated anonymous ID and the store receipt — it receives no name, email or payment information. If you created an account and are signed in, your account’s random ID is used instead of that anonymous ID so your subscription follows you across devices — RevenueCat still receives no name or email. RevenueCat privacy policy: revenuecat.com/privacy
Analytics: anonymous usage measurement only. The app (unlike the website, see Website analytics) contains no third-party analytics tool, no crash reporter and no cookies. To understand at which step people stop using the app, it sends the following events to our own server together with a randomly generated device identifier: app open, match setup, match start and end, score card share, subscription screen view, purchase, notification permission, Academy lesson start and completion, module test score and post-match self-evaluation answers. This identifier is never linked to your account, your advertising ID or your IP address; the records are deleted after 90 days. Cross-app tracking happens only on iOS if you granted the tracking permission, and only through the ad service (AdMob) and ad measurement (Meta). Ad measurement (Meta SDK): the app tells Meta that it was installed and opened; this is used solely to measure how many installs our ads on Meta lead to. Data processed: the advertising identifier (on iOS only if you allowed tracking), IP address and general device information. If you decline tracking, the install is counted but not linked to you. No data is collected for any other purpose.
Permissions.
| Permission | Why |
|---|---|
| Vibrate | Haptic feedback when a point is scored |
| Internet | Loading ads, verifying the subscription and tournament mode |
| Camera and Photos (only when you ask) | To read player names from a photo or screenshot of a list when setting up a tournament. Text recognition runs on your device. So that names and their pairings are read correctly, the image you choose is sent to our server and read by an AI model; the image is held in memory only for that moment, never written to disk or logged, and is discarded as soon as the answer comes back (details: Reading names from a photo). With no internet connection this step is skipped and reading happens on your device alone. The camera opens only when you tap the button. |
| Photos (only when you ask) | To pick an avatar photo for your account. Only the image you choose is uploaded to our server, downscaled, and shown on your profile; the rest of your library is not accessed. You can remove the avatar at any time. |
Advertising ID (Android AD_ID) | Ad serving and frequency capping |
Bluetooth remote. The remote connects to the phone as a keyboard, handled by the operating system. The app only hears key presses; pairing and connection are entirely the OS’s business. The app requests no Bluetooth permission.
Spoken announcements. The score is spoken using your phone’s own text-to-speech. The microphone is not used, no audio is recorded, and no audio data is processed or transmitted.
Feedback. If you send feedback from inside the app, your rating, topic, message, optional email address (pre-filled from your account if you have one; you can clear it), your account ID and nickname if you are signed in, the app version, operating system, language and IP address are sent to our server. They are used only to reply to you, improve the app and thank you inside the app once your suggestion ships; never for advertising or profiling, never shared with third parties. Without an email address or account, feedback is anonymous.
KVKK and GDPR. Data processed for ad serving and subscription verification (advertising ID, IP address, anonymous subscription ID) is processed on Google’s and RevenueCat’s servers abroad; under Turkish law (KVKK) this constitutes a cross-border transfer. The legal basis is legitimate interest, and explicit consent for personalised ads — Google’s consent screen in the EU/UK, and Apple’s tracking prompt on iOS. Without an account your scores and settings never leave the device: clear match history inside the app, or uninstall to erase everything on the device. If you created the optional account, the account and sync data (email, nickname, device name, settings, match summaries) is processed on the basis of performance of a contract (KVKK Art. 5/2-(c), GDPR Art. 6(1)(b)), and your avatar photo on the basis of your explicit consent; our server is in the United Kingdom (a cross-border transfer under KVKK). You can delete the account and download a copy of your data inside the app at any time. The Ad-Free subscription stops all ad-related processing. For questions about your rights, write to [email protected].
Reading names from a photo
When setting up a tournament, instead of typing the player list you can take a photo or pick a screenshot. This runs only when you start it; the camera and the photo library never open on their own.
Text recognition runs on your device. So that the names are read correctly and matched with the right partners, the image you choose and the recognized text lines are sent to our own server (scoresay.com) and from there read by Anthropic’s Claude AI model. The model answers only one question: which players are on this list, and who is paired with whom.
Neither the image nor the text is stored anywhere. On our server they are held in memory only while the request is being handled; they are never written to disk, never appear in log files, and are discarded as soon as the answer comes back. The only thing that reaches the database is the player names you confirm adding to the roster — and those are kept as described under tournament mode. Anthropic does not use these requests to train its models. No account is created and nothing identifying you is sent.
With no internet connection, or if this step fails for any reason, reading happens on your device alone and the flow continues unbroken; the app then shows a “read offline” note under the list. You can correct or remove any name before adding it.
Tournament mode (Americano)
Tournament mode links several phones to the same tournament, so tournament data is kept on our own server (scoresay.com, hosted in the United Kingdom). No account is needed: the person who creates the tournament (the organizer) types a tournament name and the players’ nicknames; participants join with a 6-character code and pick their own name from the list. Stored on the server: the tournament name and settings, the player names the organizer typed, match scores and standings, a randomly generated link key per device (to tell which device is scoring which match) and, if the organizer entered them, a sponsor line, a logo address and any sponsor images they upload. Tournament mode itself collects no e-mail, phone number, location or device identifier. If you are signed in to the optional account, the tournament is additionally linked to it (just a “this tournament belongs to this account” record) so you can return to it from another device; deleting the account removes the link, while the tournament itself remains.
Anyone who knows the tournament code can open the live board (scoresay.com/t/CODE) and see player names and scores, so share the code only with the people you play with. Tournament data stays on the server after the tournament ends so the standings remain viewable; if you want it deleted, e-mail the tournament code to [email protected] and we will remove it.
Sponsor impression counters. If the organizer added sponsor images, the devices showing the live board or a player screen report how many times and for how many seconds each image was displayed, as aggregate numbers; the organizer sees this in the sponsor report for their own tournament. Nothing identifying you is sent: a random number generated on the device is stored only as a hash specific to that tournament — it cannot be matched across tournaments and is deleted after 90 days. No advertising identifier is used and there are no tracking cookies.
Tournament Pro and Tournament Elite. Monthly/annual subscriptions for organizers, bought through the store’s own payment sheet. Our server checks with RevenueCat whether the subscription is active: the app attaches the anonymous subscription identifier generated by RevenueCat to tournament requests, and the server stores it alongside that device’s record. The identifier contains no name, e-mail or payment details; it is used only to answer “does this device have an active subscription?”.
Shop orders
If you order a product through scoresay.com then, unlike the app, we do have to collect personal data — we need somewhere to send the product and something to put on the invoice. We collect: your name, delivery address, phone number, e-mail address, and the contents and total of your order; plus company name, tax office and tax number if you asked for a company invoice.
Your card details never reach us. Payment runs on the infrastructure of iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., a licensed Turkish payment institution. Your card number, expiry date and CVC go straight to iyzico’s system and are never written to our server at any point. All that comes back to us is “payment succeeded / failed” and a transaction reference. In this relationship iyzico is a data processor and its own privacy policy applies.
Who we share it with. Your delivery address and phone number go to the carrier so the parcel can be moved. Invoice details enter our accounting records and the Turkish e-invoice system as tax law requires. Beyond that, your order data is shared with nobody, added to no marketing list, and used for no advertising.
How long we keep it. Commercial books and records must be kept for 10 years under the Turkish Commercial Code and Tax Procedure Law, so we cannot delete your order and invoice records during that period. This is a legal obligation, not a choice. Records are destroyed once the statutory period expires.
Legal basis. Processing order data is necessary for the conclusion and performance of a contract under Article 5/2-(c) of the Turkish Data Protection Law; retention rests on compliance with a legal obligation under Article 5/2-(a). Because this rests on contract and statute rather than consent, you cannot ask for it to be erased while your order is in progress; it is erased after the statutory retention period.
Your rights. Under Article 11 of the Turkish Data Protection Law you may access your order data, have inaccurate data corrected, and ask for erasure once the statutory retention period has passed. Write to [email protected].
The full terms of sale are on the Distance Sales Agreement and Preliminary Information Form pages.
Website analytics (scoresay.com)
On this website we may use Google Analytics 4 to understand which pages are read and how people find the site. This applies to the website only; the mobile app contains no analytics.
No cookie is set without your consent. When the site opens, a cookie preference bar appears at the bottom. Until you choose “Accept”, Google Analytics runs in consent-denied mode: it writes no cookie to your browser and cannot recognise you across visits; Google only receives a cookieless, identity-free page-view signal. If you choose “Decline”, that choice is stored in your browser and the bar does not return.
If you accept, Google Analytics sets its _ga cookies (for up to 2 years) and processes: pages viewed, time on site, referring site, browser and device type, and approximate location (country/city; the IP address is truncated and not stored). This is never matched to your name, e-mail, account or app data, and is not used for advertising (advertising cookies stay off in every case). The data is processed on our behalf by Google LLC (USA) on the basis of your consent, which you can withdraw at any time.
To change your choice: reopen the cookie preference. How Google uses data: policies.google.com/technologies/partner-sites.
Embedded Instagram content
On some pages we show our Instagram posts embedded. This content is not loaded until you press the play button: until then your browser sends no request to Instagram at all, and only a cover image from our own server is on the page.
When you press the button, the content is loaded from Instagram (Meta Platforms Ireland Ltd.); at that moment your IP address, browser and device information and any Instagram cookies you have are sent to Meta, and Meta’s own privacy policy applies: privacycenter.instagram.com/policy. If you do not press it, no data is transferred. This transfer is based on your click, that is, your explicit consent; it is independent of the analytics choice in the cookie bar.
Children. The app is not directed at children.
Changes. If this policy changes, the date above is updated and the current text is published at the same address.
Contact: [email protected]
Deleting your data
If you have an account, go to Settings → Account → “Delete account” inside the app: your email, nickname, avatar, device list, synced settings and match summaries are all deleted immediately, with no waiting period. Tournaments you created are shared with other people, so the tournament record stays and only its link to your account is removed; you can have those deleted too by the route below. Before deleting you can take a copy of your data (JSON) with “Download my data”. If you can no longer access the app, you can request the same deletion by e-mail.
If you never created an account, there is no account to delete. You can clear the match history and settings on your device from inside the app or by uninstalling it; none of that ever reaches the server. The only thing kept on our server is the record of a tournament you have run, and you can ask us to delete it.
How to request deletion by e-mail
- Email [email protected].
- Use “Data deletion” as the subject.
- For an account, write from the account’s e-mail address; for a tournament, include the tournament code (e.g. AMR-1234) — that is all we need to find the record.
- We delete it within 30 days at the latest and confirm in writing.
| Data | Where | Retention |
|---|---|---|
| Account (optional): email, nickname, avatar, device name/platform, sport/hand preference, synced settings and match summaries (including player names), list of linked tournaments | Our server | Until you delete the account — “Delete account” in the app deletes all of it immediately; by e-mail request within 30 days at the latest |
| Sign-in codes (the 6-digit code sent by e-mail) | Our server (hash only) | Valid for 10 minutes; the record is purged automatically within 1 day |
| Tournament record: player names, match scores, round schedule, standings and prizes, club name/logo, sponsor images, device join keys | Our server | Until you ask us to delete it — on request all of it is deleted |
| Sponsor impression statistics (anonymous counters) | Our server | 90 days, then deleted automatically |
| Usage events (random device identifier, event name, time, platform, language, app version) | Our server | 90 days, then deleted automatically |
| Reading names from a photo: the image sent and the recognised text lines | Nowhere | Not stored — processed as the request happens and discarded once the answer returns, so no record exists to delete |
| Match history, settings, player names (normal match, no account) | Your phone only | Until you delete them; uninstalling the app removes all of it |
| Advertising ID, IP address, subscription id (anonymous, or the account id when signed in) | Google / RevenueCat | Governed by their policies; you can reset your advertising ID in your device settings |
Invoice data for shop orders is outside this scope because we are legally required to keep it (see the order section above).