Privacy Policy

1. Who we are

Stadium Pro (also published as Copa do Mundo - Bolão and Bolão Copa do Mundo) is an independent mobile application for social betting pools among friends and a digital sticker album for the 2026 international football season. The app is developed and operated by an individual developer:

• Operator: Wladmyr Almeida
• Contact email (support and privacy): wladmyralmeida@gmail.com
• Country of operation: Brazil

This Privacy Policy describes how we collect, use, share, and protect your information when you use the app. It applies to both Android (Google Play) and iOS (App Store) versions.

2. What data we collect

We collect only what's needed to operate your account, display personalized content, prevent fraud, and comply with legal obligations. Summary:

3. How we use your data

• Operate your account: authenticate you, sync your progress (stickers, predictions, achievements) across devices, and display your profile to friends in the pool.
• Improve the app: understand which screens/features are most used, diagnose crashes, and prioritize fixes.
• Prevent abuse and fraud: rate limiting on scans, App Check validation, anomaly detection (e.g. attempts to add the same sticker 100 times).
• Personalize the experience: recommend trades with friends, show progress per national team, display content in the device language.
• Show ads: via Google AdMob, differentiating between free users (with ads) and Pro users (ad-free).
• Process purchases: Pro version upgrades, gem packs, virtual credits — always through Apple App Store, Google Play Billing, or Mercado Pago.
• Comply with legal obligations: respond to court orders, abuse reports, or notices from competent Brazilian authorities (LGPD).

4. Legal basis (LGPD/GDPR)

Processing of personal data follows the applicable legal bases:

• Contract performance (LGPD art. 7, V; GDPR art. 6(1)(b)): maintain your account and essential features.
• Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)): aggregated analytics, fraud prevention, product improvement.
• Consent (LGPD art. 7, I; GDPR art. 6(1)(a)): iOS ad tracking (ATT), push notifications, personalized ad content.
• Compliance with legal obligation (LGPD art. 7, II): tax and regulatory obligations.

5. Sharing with third parties

We share data only with vendors providing infrastructure to the app, under contract and with appropriate safeguards. We never sell personal data.

We do not share data with data brokers, social networks (except Google/Apple for login), or third-party marketing agencies.

6. Retention and deletion

• Active account: we keep your data while your account exists and is used.
• Inactive account for 24 months: account may be archived and data pseudonymized.
• Account deletion: upon request, we remove your personal data within 30 days from operational systems. Backups are purged within 90 days. Some data may be retained by legal obligation (e.g. payment receipts for 5 years per Brazilian tax law).
• How to delete: inside the app → Profile → Settings → "Delete account", OR send email to wladmyralmeida@gmail.com with subject "Account deletion".

7. Your rights

Per LGPD (art. 18), GDPR (arts. 15-22), and CCPA (Cal. Civ. §1798.100):

• Access: request a copy of your data.
• Correction: update inaccurate data.
• Deletion / "right to be forgotten": remove your data (with legal exceptions).
• Portability: receive your data in structured format (JSON).
• Objection: object to processing based on legitimate interest.
• Consent revocation: withdraw consents at any time (analytics, personalized ads, push).
• Complaint to authority: ANPD (Brazil), CNIL (France), ICO (UK), etc.

To exercise any right, send email to wladmyralmeida@gmail.com. We respond within 15 business days.

8. Children and minors

The app is rated for use by users aged 13+. We do not knowingly collect data from children under 13. If you are a guardian for a child who created an account in the app, please contact us and we will delete the data immediately.

Teens (13-17) may use the app, but their data processing is minimized: non-personalized ads, no ad profiling, no additional sharing.

9. Security

We implement technical and organizational measures to protect your data:

• Encrypted communication (HTTPS/TLS 1.2+) between app and servers.
• Firestore access rules validated server-side (no client trust).
• Firebase App Check to block bot/unauthorized client calls.
• Rate limiting on sensitive operations (sticker scans, pack creation).
• Passwords stored as bcrypt hashes by Firebase Authentication (never in plaintext).
• Administrative access restricted to the responsible developer, via Google Account with mandatory 2FA.

Despite the protections, no system is 100% impregnable. In case of a security incident with material risk, we will notify affected users and the ANPD as required by LGPD.

10. International transfers

Firebase servers reside in Google data centers across several regions (including the US, Europe, and Brazil — southamerica-east1 in São Paulo is our primary region). When data is transferred outside Brazil, we apply:

• Standard Contractual Clauses (SCCs) with Google (Firebase Data Processing Addendum).
• Countries adequate per ANPD (once the official list is published).

11. Advertising and identifiers

Stadium Pro shows ads via Google AdMob to free-tier users. To do so, AdMob may:

• Use advertising identifiers (IDFA on iOS, GAID on Android) for frequency and measurement.
• Collect ad interaction data (impressions, clicks).
• On iOS, we always request consent via App Tracking Transparency (ATT) before any tracking. If you decline, we show non-personalized ads.

You can revoke consent at any time: iOS Settings → Privacy & Security → Tracking; or on Android: Settings → Google → Ads → "Reset advertising ID".

For ad transparency, we maintain an app-ads.txt file at wladmyralmeida.github.io/app-ads.txt per IAB Tech Lab spec.

12. Payments and in-app purchases

In-app purchases (Pro version, gem packs, virtual credits) are processed exclusively by the platforms:

• iOS: Apple StoreKit / App Store. We do not have access to your Apple ID card data.
• Android (Play Store): Google Play Billing. We do not have access to your Google Play card data.
• PIX and direct card (Brazil): Mercado Pago Checkout Pro. You provide payment data directly to Mercado Pago — we receive only a transaction token and the status (approved/declined).

Important: the pool, quiz, and in-app points are purely social entertainment among friends. There is no distribution of cash prizes or gifts via the app — we are not a betting, casino, or gambling operation.

13. Camera and sticker scanner (OCR)

Stadium Pro includes a physical sticker scanner that uses the rear camera to read the front ID of Panini WC 2026 stickers (e.g. BRA 5, SEN 11) via on-device text recognition (Google ML Kit Text Recognition).

• Camera frames never leave your device. OCR runs entirely offline.
• Only the extracted text (short string like BRA 5) is sent to the backend to add the sticker to your inventory, validated against the official catalog.
• We do not store, transmit, or share photos, videos, or camera frames.
• You can revoke camera permission at any time in your operating system Settings.

14. Changes to this policy

We may update this policy periodically. Material changes (e.g. new vendor processing data, change of purpose) will be communicated inside the app via banner or push notification, with at least 15 days' notice before taking effect. The "Effective" date at the top of this page reflects the current version.

15. Contact

For any questions, requests, or complaints related to privacy and data protection:

• Email: wladmyralmeida@gmail.com
• Suggested subject: "[Privacy] <brief description>"
• Response time: 15 business days (LGPD)