Your data, kept purposeful.

Controller and contact

UNSPOOLS is operated by Buğra Kerem Özcan (KOZ Studios), a sole proprietorship established in Türkiye. Buğra Kerem Özcan is the data controller, based in Ankara, Türkiye.

For privacy questions or requests, email koz.devs@gmail.com.

Data we collect

• Account data: email address, display name, password hash, verification status and account timestamps.
• Game data: private-league memberships and settings, predictions, awarded points and leaderboard records.
• Security and technical data: essential authentication and session state, verification and reset-token hashes, basic request information, security logs and abuse-prevention or rate limit counters.
• Transactional email data needed to send account verification, password reset and other service messages.

We receive account data directly from you and collect game and technical data when you use the service. UNSPOOLS does not collect payment, wagering or prize-claim data, does not build advertising profiles and does not sell personal data.

Purposes and legal bases

We process personal data only as needed to:

• create and secure your account, provide private leagues, record predictions and calculate standings under these Terms;
• pursue our legitimate interests in service security, reliability, abuse prevention, support and game integrity, where those interests do not override your rights;
• comply with legal obligations and establish, exercise or defend legal rights; and
• use consent where applicable law requires it for an optional feature. We currently use no advertising or cross-site tracking cookies and send no marketing email.

An email address and display name are required to create an account. Without them, we cannot provide an authenticated private league account.

Who receives data

Members of the same private league can see one another's display names, predictions and points. Production hosting is provided by Vercel, database storage by Neon and transactional account email by Resend. These providers process the data needed to supply their services. We may also disclose information where required by law or necessary to protect legal rights, users or the service.

Fixtures and results are read from Football-Data.org. That request carries no personal data: it names a competition and a season, and nothing about you, your league or your predictions is sent to it or to any other data source.

International transfers

Our service providers may process personal data in countries outside Türkiye or your country of residence. Any transfer is subject to applicable transfer rules, including Article 9 of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and, where applicable, Chapter V of the General Data Protection Regulation (GDPR). The mechanism and safeguards that apply depend on the provider, destination and current legal requirements. Contact us for current information about those arrangements. We do not treat a provider's availability as a substitute for any contract, filing or notification required by applicable law.

Cookies and local storage

An essential authentication cookie keeps you signed in and helps protect your session. Your light, dark or system theme choice is stored locally in your browser. We do not use advertising or cross-site tracking cookies.

Retention

Account and league data is generally kept while the relevant account or league exists. Deleting an owner account also deletes the private leagues it owns. Their league-specific prediction records are deleted with them. Verification links expire after 24 hours and password reset links after 30 minutes; expired links cannot be used, and their records are removed with the associated account or an earlier cleanup operation.

Security, rate-limit, support and provider records are kept only for as long as reasonably necessary for their purpose. We may retain limited information longer where required by law or needed for legal claims. When the reason for processing ends, data is deleted, destroyed or anonymized as applicable.

Your controls and rights

The Profile page lets you update your display name and password, revoke sessions, download a machine-readable copy of your account data and permanently delete a standard player account. Administrator accounts must first be demoted through a controlled administrative operation before self-service deletion is available so that the service does not accidentally lose its administrator.

Depending on the law that applies to you, including KVKK and the GDPR, you may have rights to learn whether and why data is processed; access or receive a copy; correct, delete or restrict data; object to certain processing; request portability; and learn about recipients and international safeguards. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send a request to koz.devs@gmail.com. We may verify your identity before acting. We respond within the period required by applicable law—generally no later than 30 days under KVKK or one month under the GDPR. You may also complain to the competent data protection authority where the law permits.

Scoring, visibility and security

Predictions are scored automatically under the published game rules. This affects only entertainment leaderboards and does not produce legal or similarly significant effects or create a behavioural profile. Other private leagues are not discoverable. We use reasonable organizational and technical safeguards, but no internet service can guarantee absolute security.

Changes to this notice

We may update this notice when the service, providers or law changes. The effective date above identifies the current version. Material changes will be presented through the service or another appropriate channel.