1. Who is responsible?
The data controller is the publisher of TryCast, who can be reached at contact@trycast.fr. TryCast is an independent project; the protection of your data follows the General Data Protection Regulation (GDPR).
2. What data, and what for?
On this website (waitlist)
- Email address — used only to let you know when the app opens and about the stages of the beta. Legal basis: your consent (voluntary sign-up). No resale, no sharing, no third-party marketing.
- IP address, in hashed form — to limit the number of sign-ups per visitor and protect the form from bots. Your address is never stored in clear: only an irreversible fingerprint, recalculated with a randomly drawn key every day, is kept for 24 hours at most. Legal basis: our legitimate interest in protecting the service against abuse.
For the closed beta
- Email address and your Google account address — to send you the invitation and information about the beta, and to add you to the Play Store tester list, without which the test version cannot be installed. Legal basis: your consent (you asked to take part). Every email contains an unsubscribe link, and you can leave the beta at any time.
In the app
- Email address and username — creating, logging in to and managing your account. Legal basis: performance of the contract (the Terms).
- If you choose “Continue with Google” — Google sends us your email address, your Google account identifier, your name and the address of your Google profile photo. Only the email address is used: it identifies your account. Your Google name and photo are never displayed — you choose your username yourself on first launch, and your profile photo remains the one you add in the app. We keep no Google password or token. This option is optional: creating an account with an email and password remains available. Legal basis: performance of the contract.
- Profile photo — optional. If you add one, it is resized on your phone and then stored on our servers. Legal basis: performance of the contract. You can remove it at any time.
- Predictions, points and leaderboards — the heart of the game: calculating scores and displaying your leagues' leaderboards. Legal basis: performance of the contract.
- Preferences (language, theme, notification choices) — so the app behaves the way you set it up, and so we can write to you in your language. Legal basis: performance of the contract.
- Push notification token (if you turn notifications on) — sending match reminders and results. Legal basis: your consent; the token is deleted as soon as you turn notifications off or log out.
- History of your consents — the date on which you accepted or refused our communications, usage measurement and crash reports (see §8). Legal basis: our obligation to be able to prove your choice.
We collect no location data, no address book and no sensitive data.
3. What other users see
TryCast is a game between friends: inside a league you have joined, the other members see your username, your profile photo, your predictions once kick-off has passed, and your points. Your email address is never visible to other players. If you add a photo, it is served from a public web address: it is neither listed nor indexed, but it remains accessible to anyone who has the link.
4. Where is the data hosted, and who else handles it?
Account and game data are hosted by Supabase (database, authentication and photo storage) in the European Union (AWS region eu-west-3, Paris). The following also act as processors or recipients within the meaning of the GDPR:
- Vercel — hosting of this website. A company established in the United States; transfers are governed by the European Commission's standard contractual clauses.
- Resend — delivery of account-related emails (address confirmation, password reset) and of closed beta emails. Emails are sent from servers located in the European Union (Ireland), but Resend, a company established in the United States, stores their content, their delivery logs and the beta mailing list there; transfers are governed by standard contractual clauses and the Data Privacy Framework.
- Google (Play Console), if you take part in the closed beta — your Google account address appears on the tester list, a requirement of the Play Store for installing a test version. A company established in the United States; transfers are governed by the Data Privacy Framework and standard contractual clauses.
- Proton — hosting of the contact@trycast.fr mailbox: the messages you send us, including replies to a beta email, are stored there. A company established in Switzerland, a country recognised by the European Commission as ensuring an adequate level of data protection.
- Google, if and only if you use “Continue with Google” — Google then authenticates you on our behalf and knows that one of its accounts is logging in to TryCast. A company established in the United States; transfers are governed by the Data Privacy Framework and standard contractual clauses. No game data (predictions, leagues, leaderboards) is sent to it, and you can avoid this transfer entirely by creating your account with an email address.
- Expo then Google (Firebase Cloud Messaging) or Apple — technical delivery of push notifications to your phone. They receive your device's token and the text of the notification; this step is imposed by the Android and iOS systems.
- Aptabase (European Union) and Sentry (Germany) — anonymous usage measurement and crash reports, both of which can be turned off, as well as the problem reports you choose to send (Sentry). Details in section 8.
- Highlightly — provider of fixtures, results and odds. No personal data is sent to it: the exchanges concern matches only.
None of your data is sold, rented or passed on for advertising purposes.
5. How long?
- Waitlist: until the app launches, then at the latest 6 months afterwards (or as soon as you ask for deletion).
- IP address fingerprints (form anti-abuse): 24 hours maximum.
- Closed beta: emails stop as soon as you unsubscribe; the mailing list and the tester list are deleted at the end of the beta, or earlier on request.
- Messages sent to contact@trycast.fr: 1 year after the exchange ends, 3 years for a request to exercise your rights (so we can prove it was handled).
- Account: for as long as your account exists. Deleting your account (from the app's settings) immediately and permanently erases your personal data, profile photo included.
- Inactive account: if you don't log in for 3 years, your account and the associated data are deleted. You will be warned by email before deletion, with the option to keep it by logging back in.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability over your data, as well as the right to withdraw your consent at any time.
Two of these rights can be exercised directly in the app, without asking anyone: Settings → Privacy → Export my data gives you a readable copy of all your data, and Settings → Delete my account erases everything permanently.
If you have uninstalled the app, the Delete my account page explains how to request deletion by email, and details what is erased.
For any other request, write to contact@trycast.fr — we reply within one month at most. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
7. Minimum age
The Service is reserved for people aged 16 or over. This is the publisher's choice, stricter than French law requires: in France, a minor can consent alone to the processing of their data from the age of 15. 16 is the default threshold set by the GDPR, and it is also the age rating declared to the app stores. If we learn that an account was created by a younger child, it is deleted.
8. Usage measurement and diagnostics
To know which features are really used and to be alerted when the app crashes, it sends two kinds of technical information. Both can be switched off in one tap in Settings → Privacy, and nothing is lost by refusing them: the app works exactly the same.
- Usage measurement — a handful of named events (“prediction saved”, “league joined”…), with the app version and the operating system. No account or device identifier: these events cannot be linked to anyone, not even by us. Provider: Aptabase, in the European Union.
- Crash reports — when an error occurs, its message, its technical stack trace, your device model and the screens visited just before. Neither your username, nor your email address, nor your predictions are included. Provider: Sentry, on servers located in Germany.
Legal basis: our legitimate interest in maintaining an app that works. None of this is used to profile or target you.
Report a problem. The button of the same name sends Sentry the message you write, along with the open screen, the app version and your OS version. Your email address and username are only included if you leave the “Include my email” box ticked, so that we can reply; the address is shown before sending. No screenshot is taken. The report is sent even if crash reports are turned off, since you are the one sending it. It is kept for 90 days at most. Legal basis: our legitimate interest in fixing the app at your request.
9. Advertising
No advertising, no ad tracking, no data resale, no third-party trackers for commercial purposes. This website uses no tracking cookies.
10. Security
Exchanges with our servers are encrypted (HTTPS/TLS) and your password is never stored in clear. Access to data is partitioned by security rules enforced server-side: each account can only read and write what concerns it, regardless of what the app does. As no system is infallible, you will be informed as quickly as possible of any incident affecting your data.
11. Changes to this policy
This policy may be updated, particularly when the app launches. The date of the last update appears at the top of the page; in the event of a substantial change, you will be informed by email or in the app.