Privacy Policy

Account details: your name, username, email address and password (passwords are handled by Firebase Authentication; we never see or store them ourselves). A profile photo and a favourite club if you add them.

Your agreement: when you create your account, a record that you confirmed you are 18 or over and accepted the Terms & Conditions and this policy, with the date of each version you accepted and when you did.

If you sign in with Apple or Google: they tell us your email address and, if you let them, your name. With Apple you can choose to hide your email, and we then receive a private relay address that forwards to you. We never see your Apple or Google password, and we ask for nothing else from either account.

Things you do in the app: the tables and squads you join, the bets you place, your chip balances and results, and messages and photos you send in squad chat. If you report a message or a player, or block someone, we keep the report (including a copy of the reported content) and your block list so we can act on them, and we keep a record of the action we took.

Friends: the friend requests you send and accept, so we can show you your friends list.

Notifications: your notification settings, including any chats you have muted, and, if you allow notifications, your phone's push token and device name so they can reach it.

Purchases: if you buy a supporter sticker or a sticker pack, the record Apple or Google gives us for it: which one, when, the store's transaction or order number, and whether it has since been refunded. Each purchase carries a code worked out from your account, so the store can tell us which account it belongs to. The code cannot be turned back into your account, and we never receive your card details or billing address.

How you use the app: which screens you open and which features you use (for example, that you placed a bet or sent an invite, never what a message said), linked to your account. The detailed record is kept for 90 days; a short summary, such as when you joined and how many bets you have placed, is kept while your account exists.

Crash and error reports: when something goes wrong, the error, the screen you were on, the last few things the app did, your device model, system version and app version, linked to your account so we can find and fix it. Our own reports are kept for 30 days.

Prize competitions: if you win one, such as Player of the Season, the emails we exchange with you about the prize, anything you send to show you can claim it (proof of your age or where you live), the name, sort code and account number of the bank account we pay it into, and a record of the payment.

• Running the game: matching your predictions to fixtures, settling bets, keeping score.
• Showing you to your friends: your name, username, photo and club appear to other players in your tables and squads.
• Notifications, if you allow them: messages, bets, results, round reminders, table invites and friend requests.
• Account security: verifying your email and protecting your account.
• Purchases: giving you the stickers and sticker packs you buy, restoring them on a new phone, and removing them if a purchase is refunded.
• Prize competitions: telling a winner they have won, checking they can claim the prize, and paying it into their bank account ourselves.
• Fixing problems: diagnosing crashes and abuse.
• Improving the app: seeing which features are used, so we know what to fix and build next.

We do not sell your personal data.

There are no ads in the app, and no advertising or tracking software is built into it.

You can buy supporter stickers for your profile card and sticker packs for chat. Purchases run through Apple or Google, who take the payment: we see that a purchase happened and what it was for (see section 1), but never your card details. Our servers check each purchase with Apple or Google directly, and hear from them if one is refunded.

We may show ads in future, including ads from licensed betting companies. If we do, we will update this policy and tell you in the app before anything appears, and we will say plainly what the ad provider receives.

Two things will not change: we do not sell your personal data, and your messages, email address, friend list and chips are never handed to an advertiser.

Your account record, your tables, bets, chips and messages, and the servers that run the game are kept in Google Firebase (Cloud Firestore and Cloud Functions) in Google Cloud's London region (europe-west2).

Three Firebase services we use are not tied to London: Firebase Authentication, which holds your sign-in details (your email address, a scrambled form of your password, and which Apple or Google account you sign in with); Cloud Storage for Firebase, which holds the photos you add (profile, table and chat photos); and Firebase Crashlytics, which receives the app's crash reports (the error, the screen you were on, your device model and system version, and your account ID). Google may process these outside the UK, including in the United States.

Google processes all of this on our behalf under its standard data-processing terms, which include the safeguards UK law requires when data leaves the UK.

Notifications are sent through Expo's push notification service, which passes each one to Apple (on iPhone) or Google (on Android) to deliver to your phone. To do that they receive your phone's push token and the notification itself, which can include a player's name or username, a table or chat name, a pick, and the start of a chat message. Expo also delivers the app's updates, so it sees which version of the app your phone is running. These services may process data outside the UK.

Live football data comes from third-party sports data providers; your personal data is never shared with them.

Other players in your tables and squads can see your display name, username, profile photo, favourite club, the supporter stickers on your profile card, and your activity in shared spaces: bets on shared tables, messages in squad chats and leaderboards.

A sticker on your card shows other players that you bought it or, for Player of the Round, that you finished first in a round. Stickers you own but have not put on your card stay private to you. Which sticker packs you own is private too: other players see only the stickers you send.

Your email address and friend list are private to you. Other players can never see them. Your chips at a table are visible to everyone at that table: the chip board and the standings show them.

If you win a prize competition, the app names you as the winner where its results are shown, as the leaderboard already shows your name. If anyone asks us who won, we tell them your display name and the county you live in, unless you ask us not to. To pay you the prize, we give our bank the name, sort code and account number you gave us, as any bank transfer needs.

Beyond the services named in section 4, which handle it on our behalf, and paying a prize, we only disclose data outside the app if the law requires it.

We keep your data while your account exists.

When you delete your account (Settings → Account → Delete account) your profile, personal data, photos and usage record are permanently deleted straight away. Within a day, every message and photo you sent in any chat is deleted too, and your name in the chat's own lines, such as "Sam joined the table", becomes "Deleted user".

Some things stay because they belong to other people. Their messages stay, including any that mention you by name, and so do reactions you left, shown as coming from "Deleted user". Shared history other players need, like settled table results, is kept but no longer linked to an account. Reports made about messages stay (see below), and our record of anyone blocking you shows "Deleted user" instead of your name.

When you unsend a message it disappears from the chat for everyone straight away. We keep a private copy, which only our moderators can see, for 7 days so it can still be reported, and then delete it.

Reports and blocks are kept so we can keep the app safe. Twelve months after we have dealt with a report, or after a block, we delete the copy it holds of what was reported (the message, names and photos) and keep only the record that it happened and what we did.

We keep a daily backup for 7 days and a weekly backup for 14 weeks (98 days), so anything deleted is gone from every backup within 98 days. Crash reports held by Firebase Crashlytics carry your account's ID and are removed by Google after 90 days.

Anything you send to show you can claim a prize, and the bank details you give us to receive it, are deleted once the prize has been paid. The record of who won and what we paid, which our bank statements also show, is kept with our company records, for as long as the law requires us to keep them.

Purchase records are unlinked rather than deleted: we keep the store's transaction record and the code your purchases carried, with no name or account attached. That is what lets a new account on the same Apple ID or Google account restore what you bought, and what stops a refunded purchase being claimed again. Apple and Google keep their own records of your purchases under their own policies.

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Deleting is self-service in Settings; for anything else, email us and we will help.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

YouOnIt is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone under 18. If you believe a child is using the app, contact us and we will remove the account.

If this policy changes meaningfully we will update the date at the top and let you know in the app.

Questions or requests: email karum@youonit.co.uk, or write to YouOnIt Limited, 3 Court Drive, Lichfield, England, WS14 0JG.

This website (www.youonit.co.uk) sets no cookies and runs no analytics or advertising software. The invite pages read which kind of phone is asking, only to offer the right app store, and keep nothing.