Privacy Policy

Last updated: October 2026

This Privacy Policy explains how the Rwanda Premier League mobile application (“the App”, package rw.rwandapremierleague.rpl_app) handles your information. It applies to the App and to the accounts, fantasy game and push notifications delivered through it. The App is published by the Rwanda Premier League (BK Pro League), Kigali, Rwanda (“we”, “us”).

1. Summary

You can browse scores, tables, fixtures, news and statistics without an account and without giving us any personal data.
An account is only needed for the Fantasy game and for syncing your favourite clubs and notification settings across devices.
We collect the minimum needed to run those features: your name, username, email, phone number and a hashed password.
If you order from the Shop, we keep your order and the delivery details you enter.
If the App crashes, an anonymous crash report is sent so we can fix it. It is not linked to your account.
Everything we collect is used only to make the App work. We do not sell your personal data, do not track you across other apps or websites, and do not use advertising or analytics SDKs in the App.
You can request deletion of your account and data at any time — see our Data Deletion page.

2. Information We Collect

At a glance

This is the same summary we give in the App Store and Google Play privacy sections. “Linked to you” means the data is connected to your account. All of it is used for App Functionality only. None of it is used for advertising, for tracking, or for analytics.

Data type	Linked to you	Purpose	What it is for
Contact Info: Email Address	Yes	App Functionality	Sign-up and sign-in (verifying your email, password reset)
Identifiers: User ID (username)	Yes	App Functionality	Your profile and the fantasy leaderboard
User Content: Gameplay Content	Yes	App Functionality	Your fantasy squad, transfers, points, chips and predictions. The account-deletion dialog lists these.
User Content: Other User Content	Yes	App Functionality	Favourite clubs, favourite players and notification (alert) settings
Purchases: Purchase History	Yes	App Functionality	Shop orders, with the delivery details you enter (see 2.1)
Diagnostics: Crash Data	No	App Functionality	Fixing crashes. Crash reports are sent to Firebase Crashlytics without your user ID or account details.
Identifiers: Device ID	Yes	App Functionality	The push notification token, used to deliver your match and fantasy alerts

2.1 Information you give us

Data	When	Why
Full name, username, email address, phone number, password	When you create an account	To create and secure your account, verify your email, sign you in, and let you recover access
Profile photo (optional)	If you upload one	Shown on your profile and fantasy standings
Favourite clubs and favourite players	When you pick them in the App	To personalise your home screen and, if you choose, limit notifications to those clubs and players
Notification preferences	When you change notification settings	To send only the alerts you asked for (goals, kickoff, cards, fantasy deadline, etc.)
Fantasy squad, transfers, points, chips and predictions	When you play the Fantasy game	To run the game and calculate your points and ranking
Shop orders: items and amounts, the payment method you choose, plus the full name, phone number, email (optional), country, city, delivery address and note you type at checkout	When you place an order in the Shop	To process and deliver your order and contact you about payment and delivery. If you are signed in, the order is linked to your account so it appears in your purchase history. We do not collect card or mobile-money details in the App. Payment is arranged directly with you.
Messages you send us	When you contact support or submit a request	To respond to and keep a record of your enquiry

2.2 Information collected automatically

Data	Purpose
Device push token (Firebase Cloud Messaging)	To deliver push notifications for matches and fantasy. A token is registered even for signed-out devices so match alerts can work. Once you sign in, it is linked to your account so your alert settings follow you.
Crash reports (Firebase Crashlytics): the error and stack trace, device model, operating-system version, app version and the time of the crash	To find and fix crashes. Crash reports carry no user ID, name, email or phone number, and are not linked to your account.
Basic technical data sent with each request (IP address, app version, device type, timestamps) via standard server logs	Security, abuse prevention, diagnosing crashes and errors, and keeping the service reliable
Local settings stored on your device (theme, cached data, session token)	To keep you signed in and let the App work offline. This stays on your device.

What we do NOT collect: we do not access your contacts, photos library (beyond a photo you explicitly pick), precise location, microphone, camera roll, SMS, or call logs. The App requests only Internet, notification and foreground-service permissions. There are no advertising identifiers and no analytics or advertising SDKs. The only diagnostics tool is Firebase Crashlytics, and it is used for crash reports only.

3. How We Use Your Information

Provide and maintain your account, the Fantasy game and personalised content.
Send transactional messages (email verification, password reset) and the push notifications you have enabled.
Calculate fantasy scores, leaderboards and standings.
Process, deliver and keep a record of your Shop orders.
Keep the service secure: detect and prevent fraud, abuse and unauthorised access.
Fix bugs, monitor performance and improve features.
Comply with legal obligations and respond to lawful requests.

Our legal bases (where applicable) are: performance of a contract (running your account and the game), consent (push notifications, optional profile photo), legitimate interests (security, service improvement) and legal obligation.

4. How Your Information Is Shared

We share personal data only in these limited cases:

Service providers that operate the App on our behalf, under contract and only as needed:
- Google Firebase: Cloud Messaging for push notifications, Firestore for delivering certain live content, and Crashlytics for anonymous crash reports. See Google’s Firebase privacy information.
- The League’s shop staff and delivery partners receive only the order and delivery details they need to fulfil your Shop order.
- Our hosting and email-delivery providers.
Other users: your username, profile photo and fantasy points are visible on public leaderboards and standings. Your email and phone number are never shown to other users.
Legal: where required by law, court order, or to protect the rights, safety and property of the League, our users or the public.
Business transfer: if the League’s digital operations are reorganised or transferred, data may pass to the successor under the same protections.

We do not sell or rent personal data, and we do not share it with data brokers or advertisers.

5. Data Retention

Account data is kept while your account is active.
If you request deletion, we remove or irreversibly anonymise your account data within 30 days, except where we must retain limited records to meet a legal obligation or resolve a dispute.
Server logs are typically retained for up to 90 days, then rotated.
Crash reports are kept by Firebase Crashlytics for up to 90 days.
Shop orders are kept as long as tax and accounting law requires. If you delete your account, past orders are kept only for those legal records and are no longer linked to your account.
Verification codes expire within hours and are purged.
Backups are cycled out on a rolling schedule; data deleted from the live system is removed from backups as they age out.

6. Your Rights and Choices

Access & update: view and edit your name, email, phone and photo in the App under Profile.
Notifications: turn any category on or off in the App, or disable them entirely in your device settings.
Delete your account and data: from the App (Profile → account settings) or via the Data Deletion Request page.
Object / restrict / port: where the law gives you these rights, contact us and we will honour valid requests.
Withdraw consent: e.g. revoke notification permission at any time; this does not affect processing already carried out.

To exercise any right, email ykdann53@gmail.com. We may need to verify your identity before acting.

7. Data Security

Passwords are stored only as salted one-way hashes — we never store or can read your password. Traffic between the App and our servers uses HTTPS/TLS. Access to production data is restricted to authorised personnel. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authorities of a breach where required by law.

8. Children’s Privacy

The App is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

9. International Transfers

We are based in Rwanda. Some service providers (e.g. Google Firebase, email delivery) may process data on servers outside Rwanda. Where that happens, we rely on those providers’ contractual and technical safeguards to protect your data to a standard consistent with this Policy and applicable law, including Rwanda’s Law No. 058/2021 on the protection of personal data and privacy.

10. Changes to This Policy

We may update this Policy as the App evolves. We will change the “Last updated” date above and, for material changes, provide a more prominent notice (in the App or by email). Continued use of the App after an update means you accept the revised Policy.

11. Contact Us

Questions or requests about this Policy or your data:
Rwanda Premier League (BK Pro League)
Kigali, Rwanda
Email: ykdann53@gmail.com
Account deletion: rwandapremierleague.rw/data-deletion