We never sell your data. No targeted ads, no advertising trackers.
Your account and picks are stored in the European Union.
Notifications can be set one by one in the app.
You can delete your account at any time from the app.
01Who we are
This privacy policy explains how your personal data is collected and processed when you use the AllFight mobile app (iOS and Android) and the AllFight website (together, the "Services").
The data controller is Artefix, based in Belgium ("AllFight", "we", "us").
For any question about your personal data: support@allfight.app.
We process your data in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and any other applicable law.
02The data we collect
We follow the principle of data minimization: we only collect the data needed to run the Services.
In the app
- Account and sign-in: email address, phone number (if you choose to sign in by SMS), unique account ID, account creation date and sign-in method used (email, Google, Apple, GitHub or anonymous). We never see or store your password: it is handled directly by our authentication provider.
- Profile (optional and editable at any time): username, bio, profile photo, date of birth, sex, country or city, preferred language and favorite combat sports.
- Picks and leaderboards: your predictions (winner, method, round), the points you earn and your position on leaderboards.
- Leagues: the leagues you create or join, your role, and the name, description, image and any reward you enter.
- Favorite fighters: the list of fighters you follow.
- Notifications: your device's technical token used to send push notifications, and your notification preferences.
- Support: your email address and the content of your messages when you contact us from the app.
- Technical data: infrastructure data processed automatically by our host to run, secure and measure the performance of the Services (for example IP address, device type, OS version, error logs).
On the website
- “Become an ambassador” form: full name, handle, email, main platform, profile link, follower count and message.
- “Add my fighter profile” form: full name, nickname, email, nationality, division, record, organization, link to a public profile and additional information.
- Browsing data: your IP address and technical information about your browser are sent to our host (Hostinger) when pages load. Fonts are hosted on our own servers: no data is sent to Google.
What we do not collect
- No bank or payment data: the Services are free and no payment method is integrated.
- No targeted advertising and no advertising trackers.
- No audience measurement or commercial profiling tools.
- No sensitive data within the meaning of Article 9 GDPR (health, opinions, origin, etc.) is requested. Please do not enter any in free-text fields.
03Why and on what legal basis
Each processing activity relies on one of the legal bases set out in Article 6 GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account | Account and sign-in | Performance of the contract (Terms) |
| Displaying your profile, username and leaderboard position | Profile, picks | Performance of the contract |
| Running picks, point calculation, leaderboards and leagues | Picks, leagues | Performance of the contract |
| Following your favorite fighters | Favorites | Performance of the contract |
| Sending you push notifications | Device token, preferences | Consent, which you can withdraw at any time |
| Answering your support requests | Email, message | Legitimate interest in answering your requests |
| Reviewing ambassador applications and fighter profile requests | Website form data | Pre-contractual steps taken at your request and legitimate interest |
| Securing the Services, preventing fraud and cheating, fixing bugs | Technical data, account data | Legitimate interest in ensuring the security and integrity of the Services |
| Complying with our legal obligations and defending our rights | Data needed depending on the case | Legal obligation and legitimate interest |
We make no decision based solely on automated processing that produces legal effects concerning you. The automatic calculation of points and leaderboards is for entertainment only.
04Who receives your data
We never sell or rent your personal data. It is only accessible to authorized AllFight staff and to the technical providers below, who act on our behalf, on our instructions and under contractual confidentiality and security commitments.
| Provider | Role | Data concerned |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd. and Google LLC) | Hosting, database, authentication, image storage, server functions, push notifications, performance monitoring | App data |
| Apple, Google and GitHub | Sign-in, only if you choose these methods | Authentication tokens, email |
| Resend | Sending support emails from the app | Email and message |
| FormSubmit | Sending website form submissions by email | Data entered in the forms |
| Hostinger International Ltd. | Hosting and serving the website pages | Browsing data |
Other users only see what you choose to make visible: username, profile photo and position in leaderboards and leagues.
We may also disclose data to authorities where required by law, or in the event of a reorganization, merger or sale of the business, in which case the acquirer will be bound by this policy.
Sports data (events, fights, fighters, results) is provided by API-Sports. This provider receives no personal data about users.
05Where your data is stored
Our main database is hosted in the European Union (Belgium and the Netherlands multi-region).
Some server operations (Google Cloud backend functions) currently run in the United States, and some email providers may process data outside the European Economic Area. These transfers are covered by appropriate safeguards under Articles 44 et seq. GDPR: an adequacy decision (EU-U.S. Data Privacy Framework) where the provider is certified, or standard contractual clauses adopted by the European Commission.
You can obtain a copy of these safeguards by writing to support@allfight.app.
06How long we keep it
| Data | Retention period |
|---|---|
| Account, profile, picks, leagues, favorites and preferences | As long as your account is active. It is deleted when you delete your account. |
| Notification token | Until notifications are turned off or the account is deleted. |
| Support messages | As long as needed to handle your request and follow up on the conversation. |
| Ambassador and fighter forms | As long as needed to review your request, then for the duration of any collaboration. |
| Data needed as evidence or for a dispute | For the applicable legal limitation period. |
When these periods end, the data is deleted or fully anonymized.
07Deleting your account
You can delete your account at any time, directly in the app (Profile, then Edit your profile, then Delete account), or through our account deletion request page.
Deletion erases your profile, your picks, your league memberships, your reserved username, your notification tokens and the files you uploaded (profile photo, league images). If you were a league's only admin, admin rights are automatically handed over to another member.
Points already awarded to other users are not changed. Backup copies may remain for a limited time before being automatically overwritten, and some data may be kept where the law requires it.
08Your rights
Under the GDPR, you have the following rights:
- Access: get a copy of the data we hold about you.
- Rectification: correct inaccurate data. Most fields can be edited directly in the app.
- Erasure: ask us to delete your data.
- Restriction: ask us to temporarily freeze a processing activity.
- Objection: object to processing based on our legitimate interest.
- Portability: receive your data in a structured, machine-readable format.
- Withdrawal of consent: at any time, for example by turning off notifications in the settings, without affecting the lawfulness of prior processing.
To exercise your rights, write to support@allfight.app from the address linked to your account. We reply within one month, which may be extended by two months for complex requests. We may ask you to prove your identity if we have reasonable doubts, and may refuse manifestly unfounded or excessive requests.
If you believe your rights are not being respected, you can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, or with the authority in your country of residence.
09Security
We apply appropriate technical and organizational measures to protect your data: encrypted connections (HTTPS/TLS), encryption at rest with our host, strict database access rules, authentication delegated to trusted providers, access limited to authorized people only, and anti-spam protection on forms.
No system is infallible, so we cannot guarantee absolute security. In the event of a data breach posing a risk to your rights, we will notify the competent authority and, where required by law, the people concerned.
You are responsible for keeping your credentials confidential and your device secure.
10Minors
Under the GDPR, the age from which a person can consent alone to the processing of their data is set at 16.
If you are under 16, using AllFight requires the consent of your parents or legal guardian.
If we learn that an account was created without this consent, we may delete it. A parent can report it to us at support@allfight.app.
11Cookies and trackers
The AllFight website uses no advertising cookies, no audience measurement cookies and no third-party trackers for commercial purposes. No consent banner is therefore needed.
Loading the pages only relies on our host, which is strictly necessary for the website to work. No resource is loaded from a third-party service.
The app may store preferences and cached data (language, session, images) locally on your device, only so that it works properly.
If we ever add non-essential trackers, we will ask for your prior consent.
12Third-party links and services
The Services may contain links to third-party websites, social networks, ticketing or streaming platforms. We are not responsible for their personal data practices. Please read their own policies.
13Changes to this policy
We may change this policy to reflect changes to the Services or to the law. The date of the last update appears at the top of this page.
In the event of a significant change, we will inform you through an in-app notification or by email before it takes effect.
14Contact us
For any question about this policy or your data: support@allfight.app.
Publisher: Artefix, Belgium.