Reckon — Privacy Policy

Last updated: 12 August 2026 Effective: 12 August 2026

1. Who we are

Reckon ("Reckon", "we", "us", "our") is a free football prediction game for the English Premier League, published by Nova Solutions Limited, a company registered in Nigeria with registration number 9168921, whose registered office is at Plot 19, Block L, Federal Housing Estate, Asaba, Delta State, Nigeria.

For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") and, where it applies to you, the EU/UK General Data Protection Regulation ("GDPR"), Nova Solutions Limited is the data controller of the personal data described in this policy.

This policy covers the Reckon mobile apps (iOS and Android), the Reckon web app, and any related services (together, the "Service").

2. The short version

• You can browse and make predictions without an account. We create an anonymous session on your device so your picks survive you closing the app.
• You only give us personal data when you lock in your picks and create an account — at that point we ask for a sign-in provider (Google or Apple), a handle, a display name, a country and a favourite club.
• We do not sell your personal data, and we do not share it with advertisers.
• Your predictions are private until the gameweek deadline passes, and public afterwards — that is how the game works, and it is explained in section 5.
• You can delete your account and your data from inside the app, or from the web without signing in, at any time. A small amount of moderation data is kept afterwards so that suspended accounts cannot simply be recreated — section 8 says exactly what and for how long.

3. Personal data we collect

3.1 Data you give us

If you sign in with Apple and use Hide My Email, Apple gives us a private relay address instead of your real one. That is fine — we treat it as your contact address and never see the underlying email.

3.2 Data we collect automatically

We do not collect precise location, contacts, photos (other than an avatar you deliberately choose), microphone or camera data, health data, or advertising identifiers.

3.3 Data we do not collect

We do not ask for and do not want: government ID numbers, payment card details, bank details, or any special category data (health, religion, political opinion, biometrics, sexual orientation, trade union membership). Please do not put any of that in your display name, avatar, or messages to us.

We also do not collect your date of birth. We ask you to confirm an age band at sign-up so that we can apply the right rules for under-18s (see section 12), and we store only that band and, where relevant, your confirmation of parental consent.

4. Why we process your data, and our lawful basis

Under section 25 of the NDPA and Article 6 GDPR, we rely on the following bases:

Performance of a contract with you (NDPA s.25(1)(b)(i); GDPR Art. 6(1)(b)) Creating and maintaining your account; recording and scoring your predictions; producing leaderboards; operating squads; providing support.

Consent (NDPA s.25(1)(a); GDPR Art. 6(1)(a)) Sending push notifications; optional analytics where your local law requires consent; any future marketing email. You can withdraw consent at any time — see section 10 — and withdrawal does not affect processing carried out before you withdrew.

Legitimate interests (NDPA s.25(1)(b)(v); GDPR Art. 6(1)(f)) Keeping the Service secure; preventing cheating, multi-accounting and abuse; moderating handles, display names and avatars; fixing crashes; understanding aggregate product usage; defending legal claims. As section 25(2) of the NDPA requires, we have satisfied ourselves that these interests do not override your fundamental rights and freedoms, do not conflict with any other lawful basis, and fall within your reasonable expectations as a user of a competitive game — the data involved is limited and the processing is what such a user would expect.

Legal obligation (NDPA s.25(1)(b)(ii); GDPR Art. 6(1)(c)) Responding to lawful requests from regulators, the NDPC or courts; keeping records we are required to keep.

5. What other people can see

This matters more in Reckon than in most apps, so it gets its own section.

Always public — to anyone using the Service, including people without accounts:

• your handle and display name
• your avatar
• your country and favourite club
• your total points, position on any leaderboard you appear in, and your public performance statistics (hit rate, precision, form)

Private, then public — your predictions for a gameweek are visible only to you until that gameweek's deadline passes. Once the deadline passes and the gameweek locks, your predictions for that gameweek become visible to other users, including in the reveal grid, aggregate "crowd" percentages, squad tables and head-to-head comparisons. This is deliberate: nobody can copy your picks, because nobody can still make picks. Do not put anything in the Service that you would not want other players to see.

Visible to your squad only — your position and picks within a private league are visible to the other members of that league.

Share cards — if you generate a share card, it contains your handle, avatar and the picks or results shown on it, and you control where you post it.

We enforce the pre-deadline privacy of predictions at the database level with row-level security, not only in the app.

6. Who we share data with

We do not sell personal data and we do not share it for third-party advertising. We share it only with service providers who process it on our instructions, under contract, and only for the purposes below. Each of these third parties is contractually required to provide the same or an equal level of protection for your data as this policy states, and none of them is permitted to use it for their own purposes.

Reckon does not track you across other companies' apps and websites. We use no advertising identifiers and no cross-app tracking SDKs, so we do not ask for permission under Apple's App Tracking Transparency framework.

We may also disclose personal data:

• where we are required to by law, court order, or a lawful request from the NDPC or another competent authority;
• where necessary to investigate suspected cheating, fraud, abuse or a threat to someone's safety;
• to professional advisers (lawyers, accountants) under a duty of confidentiality;
• to a buyer or successor entity if Reckon is sold, merged or restructured — in which case we will tell you before your data becomes subject to a different privacy policy.

We keep an up-to-date record of our processors. If you want the current list with contact details, email hello@novasolutions.ng.

7. International transfers

Reckon is operated from Nigeria, but some of our providers store or process data outside Nigeria. Where personal data leaves Nigeria, we rely on the transfer mechanisms in Part VIII (sections 41–43) of the NDPA — an adequacy determination by the NDPC where one exists, or, failing that, contractual terms binding the recipient to an adequate level of protection, or another lawful basis under section 43.

Where the GDPR applies to a transfer out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with additional technical measures such as encryption in transit and at rest.

You can request a copy of the safeguards we use for a specific transfer by emailing hello@novasolutions.ng.

8. How long we keep data

9. Security

We protect your data with:

• Row-level security on every database table, so the database itself — not just the app — enforces who can read what, including the rule that predictions stay hidden until a gameweek locks;
• encryption in transit (TLS) and encryption at rest;
• no password storage at all — authentication is delegated entirely to Google and Apple, so there is no Reckon password to leak;
• least-privilege access for the small number of people who administer the Service, with administrative actions logged;
• automated scanning of uploaded avatars for prohibited content.

No system is perfectly secure. If a personal data breach occurs:

• where it is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as required by section 40 of the NDPA (and, where the GDPR applies, Article 33);
• where it is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without undue delay, describing what happened and what you should do.

10. Your rights

Under the NDPA — and under the GDPR if you are in the EEA or UK — you have the right to:

• Be informed about how we use your data (this policy);
• Access the personal data we hold about you, and get a copy;
• Rectify data that is inaccurate or incomplete — you can edit your display name, country (until it locks, see section 11) and favourite club in the app directly;
• Erase your data ("right to be forgotten") — you can delete your account in the app under Settings → Account → Delete account, or from the web, without signing in, at https://reckonfc.com/delete-account;
• Restrict processing in certain circumstances;
• Object to processing we carry out on the basis of legitimate interests;
• Data portability — receive your predictions, results and profile in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, for example by turning push notifications off in the app or in your device settings;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Scoring your predictions is automated, but it is a game result, not a decision of that kind. Automated moderation flags are always reviewed by a person before an account is suspended.

How to exercise them: you can edit your profile, download a copy of your data (Settings → Account → Export my data) and delete your account yourself in the app. For anything else, email hello@novasolutions.ng from the address associated with your account, or use the in-app Help → Privacy request form.

We aim to respond within 30 days, which is a commitment we make to you — the NDPA (section 34) requires us to act without undue delay, and the GDPR gives us one month, extendable by up to two further months where a request is genuinely complex. If we need longer, we will tell you why within the first 30 days. We do not charge for this unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting — usually by asking you to confirm the request from your signed-in account.

Complaints. If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or, if you are in the EEA or UK, to your local supervisory authority or the UK Information Commissioner's Office.

11. Specific things worth knowing

Your country locks after three gameweeks. Country determines which national leaderboard you appear on, so we stop it being changed once you have played three gameweeks in a season. This is a fairness measure, not a data protection one, but it means the "rectify" right above is limited for this one field mid-season. If your country is genuinely wrong — you set it by mistake, or you have moved — email us and we will correct it.

Your handle cannot be changed by you. Handles appear in head-to-head records, reports and share cards, so allowing people to churn them would break moderation and recognition. We can change a handle on request in genuine cases (for example, if it contains your real name and you want it not to).

Linking accounts. If you sign in with a second provider and that identity already belongs to a different Reckon account, we cannot merge them. We will warn you before you continue, because signing into the existing account means any picks made in your current anonymous session are lost.

12. Children

You must be at least 13 years old to use the Service.

The NDPA (sections 31 and 65, read with the Child's Rights Act 2003) treats anyone under 18 as a child, and requires the consent of a parent or guardian before their data is processed. The GDPR sets the age of digital consent at 16 by default, though member states may lower it to no less than 13.

So: if you are under 18 — or under the age of digital consent where you live — you may only use Reckon with the consent and supervision of a parent or guardian.

How we check. Section 31(2) of the NDPA requires us to apply appropriate mechanisms to verify age and consent, using available technology. At sign-up we ask you to confirm your age band and, if you are under 18, to confirm that a parent or guardian has agreed. We deliberately do not store your date of birth — we keep only the age band and the confirmation, because that is the minimum needed to apply the right rules. We also rely on the age rating we declare to the App Store and Google Play. We will strengthen this as the NDPC issues further guidance under section 31.

We do not knowingly collect personal data from anyone under 13. If we learn that we have, we will delete the account and the data promptly. Parents or guardians who believe their child has created an account, or who want to withdraw consent, should email hello@novasolutions.ng — we will acknowledge within 7 days and act promptly.

13. Cookies and similar technologies

The mobile apps do not use cookies. They use local device storage to hold your session and your picks.

The web app uses:

• strictly necessary cookies and local storage for authentication and session management — these cannot be turned off without breaking sign-in;
• Firebase Analytics cookies or equivalent, where you have consented, to measure aggregate usage.

If you are in a jurisdiction that requires it, we ask for your consent to non-essential cookies before setting them, and you can change your choice at any time via the cookie settings link in the web app footer.

14. Third-party links and content

Reckon shows Premier League fixture data, results and club information. Club names and marks belong to their owners; we are not affiliated with, endorsed by, or connected to the Premier League or any club. Where the Service links out to a third-party site, that site's own privacy policy applies and we are not responsible for it.

15. Changes to this policy

We will update this policy when the Service changes or the law does. If a change is material — for example, a new category of data, a new purpose, or a new class of recipient — we will tell you in the app and by email (where we have one for you) at least 14 days before it takes effect, and where the law requires it we will ask for your consent again. The "last updated" date at the top always reflects the current version. Previous versions are available on request.

16. If you are in the United States

If you are a resident of California or another US state with a comprehensive privacy law, the following applies in addition to the rest of this policy.

In the twelve months before the date at the top of this policy, we collected the categories of personal information described in section 3 — identifiers (handle, display name, sign-in identifier, email address), internet and device activity, approximate location inferred from IP at country level, and your own content — for the purposes described in section 4.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, and we do not do so with the personal information of anyone we know to be under 16.

You have the right to know what we collect and why, to access and delete it, to correct it, to opt out of sale or sharing (nothing to opt out of, as above), to limit the use of sensitive personal information (we do not collect any), and not to be discriminated against for exercising any of these rights. Exercise them the same way as in section 10 — the app, or hello@novasolutions.ng. An authorised agent may act for you if you give them written permission and we can verify it.

17. Contact

Questions, requests or complaints:

Nova Solutions Limited Plot 19, Block L, Federal Housing Estate, Asaba, Delta State, Nigeria

All enquiries — privacy and data rights, general support, security reports, moderation appeals, and copyright or trade mark complaints — go to hello@novasolutions.ng. Please say which of those it is in the subject line so we can route it quickly.

To delete your account online: https://reckonfc.com/delete-account

Nigeria Data Protection Commission No. 6 Suleiman Barau Crescent, Off Solomon Lar Way, Utako, Abuja info@ndpc.gov.ng · ndpc.gov.ng