Privacy Policy

Who we are and what this policy covers

We are Suffarah, a service for following live scores and match events. This policy explains how we collect, use and protect your personal data when you use our website or our Android app. Please read it together with our Terms of Service.

Data we collect

• Account data: your email address, display name and password, which we store only as a one-way Argon2id hash so it cannot be recovered, plus your preferred language, time zone and appearance setting.
• Favourites: the teams, competitions and players you choose to follow.
• Device notification tokens: sent by the app and stored for future notifications. We do not send notifications yet.
• Two-step verification secret: if you turn on this optional feature, we store it encrypted.
• Security logs: IP address, sign-in times and failed attempts. We use them to protect accounts, to limit request rates and to lock an account temporarily after repeated failed attempts.

Cookies

We use only necessary cookies:

• Session cookie: keeps you signed in and protects forms.
• Preference cookies: remember your theme, time zone and language.

We do not use any advertising or tracking cookies.

Third parties

• Google reCAPTCHA: used on the sign-up page to block automated sign-ups. Google may process data about your device and interactions under its own policy.
• Cloudflare: our network and security provider, which processes IP addresses and request data.
• Email delivery provider: sends account emails such as password reset messages, for example Amazon SES or Postmark, when enabled.

We do not sell your personal data, and we do not share it for advertising.

Why we process data and on what basis

We process your data in line with the Saudi Personal Data Protection Law (PDPL), for these purposes:

• Providing the service: creating your account and saving your preferences and favourites.
• Security: protecting accounts and the service from abuse and attacks.
• Legitimate interest: running and improving the service in ways that respect your rights.
• Consent: where the law requires it. You can withdraw your consent at any time.

How long we keep data

• We keep account data until you delete your account.
• We keep security logs for a limited period of 90 days.
• Password reset links expire after 60 minutes.

How we protect your data

• We use only encrypted connections, on every page of the service.
• We store passwords as hashes that cannot be reversed.
• We encrypt two-step verification secrets.
• We restrict administrator access, and administrators must use two-step verification.

Your rights

• Access: you can ask to see your data.
• Correction: you can edit your data on the settings page.
• Deletion: you can delete your account from the account page.
• Withdrawing consent: you can withdraw consent wherever it is the basis for processing.
• Contact: you can contact us with any request about your data.

Children

The service is not directed to children under 13, and we do not knowingly collect their data. If we learn that a child under this age has an account, we will delete it.

International transfers

Some of our service providers may process your data outside the Kingdom of Saudi Arabia. When that happens, we make sure appropriate safeguards are in place to protect it, in line with the PDPL.

Changes to this policy

We may update this policy from time to time and will post a notice on the site when we make any significant change.

Contact us

If you have any questions or requests about your privacy, write to us at our contact email.