1. Information we collect

We collect information in three ways: you give it to us, your device sends it when you use a feature, and our servers record limited technical data needed to run the Service. We do not sell your personal information.

The Service is the 90Plus app and the website at https://90plus.pro. The public pages on that website, including this one, do not require an account. The app interface is available in Arabic and English.

2. Information you provide

• Account. Email address, Clerk user id, username, and the sign-in method you choose (email, Google, or Apple). Google and Apple passwords are handled by those providers and by Clerk. We do not ask the app to store a copy of them.
• Profile. Display name, photo, cover image, bio, favorite team, country, and optional football details such as position, height, weight, preferred foot, and social links. Some of these are optional.
• Age. An age or date of birth so we can apply the minimum age of 13. If you are 13 to 17, we may store a parent or guardian email address and whether consent was confirmed, together with the IP address and user agent of that request.
• Content. Community posts, comments, polls, images, reels, match-chat messages, likes, follows, blocks, and reports.
• Play. Predictions, quiz answers, coin and XP activity, achievements, referral codes, and sponsor-competition entries.
• Sponsor store. If you create a store, we store the name, description, logo, address, delivery choice, country, phone number, and social links you submit.
• Assistant. The messages you send to the football assistant, and a voice recording if you use transcription. The recording is sent to the configured transcription provider so it can be turned into text.
• Support. Anything you send to merdevai477@gmail.com.

Camera and photo-library access are used for profile photos, covers, reels, and images you choose to upload. The microphone is used for voice messages to the assistant. Face ID, where you turn it on, stays on your device to protect sign-in. We do not receive your fingerprint or face template.

3. Information collected automatically

• IP address and user agent on terms acceptance, consent changes, data-export requests, account-deletion requests, parental-consent requests, device-session restore keys, and invite-link clicks. The server also uses the IP address to route traffic and apply rate limits.
• Device session. A hash of a long-lived device key, plus a short device description, so the app can restore a session. We store the hash, not the raw key.
• Push. An Expo push token and the platform (iOS or Android) if you allow notifications. On iOS, a Live Activity token, a device id, the match and teams you follow for that activity, and the language may be stored so the lock-screen score can update.
• Diagnostics. If Sentry is configured, crash reports and a sample of performance data are sent to Sentry. The server is set to remove authorization headers and cookies from those events, and to drop password, token, secret, and API-key fields. Sentry can still receive the app version, operating system, and the error context.
• Usage inside the product. Counts such as profile views, reel views, quiz results, and your own video statistics. These are part of the app, not a separate marketing-analytics product.

Location. We do not collect background location, and we do not build a location history of ordinary users. If you create a sponsor store and use the map, the app may ask for foreground location to place a pin and fill an address. We store the address and country you confirm. Google receives the map request when the map is shown. You can refuse the permission and type an address instead.

Cookies and the website. The marketing site and these legal pages do not use an analytics cookie or an advertising pixel. The language you pick is stored in local storage on your device. The API can set a cookie for its own admin review screen and can issue a security token for authenticated API calls. If you open the Clerk account portal, Clerk may set its own cookies under its terms. We did not find a Google Analytics, Meta, or similar tag on the public site.

4. How we use information

• To create and secure your account, and to show your profile and content.
• To run scores, news, quizzes, predictions, coins, referrals, notifications, and the assistant.
• To moderate content, investigate abuse, and enforce the Terms of Service.
• To send a push notification you have allowed, such as a match, a social action, or a reminder.
• To fix crashes and understand which requests fail.
• To answer a support message, a data export, or a deletion request.

We do not use your information to sell advertising profiles. Sponsor stores are shown because they are part of Predict & Win, not because we sell your data to an ad network.

5. Legal bases for processing

Where a law such as the GDPR or UK GDPR applies, we rely on the following bases. This is an explanation of how the product is built, not a completed legal assessment.

• Contract. Providing the account and the features you ask for.
• Legitimate interests. Keeping the Service secure, preventing abuse, moderating content, and fixing faults. These interests are weighed against your rights.
• Consent. Push notifications, optional foreground location for a store address, and parental consent for a teen account. You can withdraw a consent you gave. The in-app switches for analytics, email, and data sharing are stored. What they do today is described in section 14.
• Legal obligation. Where we must keep or disclose information to comply with a law that actually applies to the operator.

6. Sharing and processors

We share personal information with service providers that process it for us, and when you deliberately publish something. We do not sell personal information.

• Other users see the profile and content you publish, and a sponsor’s store details if you publish a store.
• Clerk processes sign-in. Google or Apple process sign-in if you choose them.
• Expo delivers push notifications. Apple delivers Live Activity updates on iOS.
• Sentry receives crash and performance events when it is configured.
• Cloudflare R2 stores media and data-export files. Mux processes reel video.
• Railway hosts the production API. The database is PostgreSQL and the cache is Redis.
• API-Football and 365Scores supply match data. We send requests for fixtures and statistics, not your profile, in the ordinary score flow.
• NewsAPI supplies World Cup headlines to our server. Google Maps is used in the sponsor address picker.
• Google Gemini, Amazon Bedrock, and OpenRouter (or another OpenAI-compatible endpoint) may receive assistant messages, quiz prompts, voice audio, or content submitted for a safety check, when those keys are configured. A safety check can include the text of a post or comment and, for images, the image.

We may also disclose information if the law requires it, or if it is reasonably necessary to protect a person, investigate abuse, or defend a legal claim. A setting in the app is labelled “data sharing” and defaults to off. In the current code, turning it on does not start a sale of your data to partners.

7. International transfers

90Plus is used in more than one country. Our providers operate in their own countries, which may include the United States and other countries outside your own. Match data, media, crash reports, and assistant messages can therefore be processed outside the country where you live.

The product does not publish a transfer tool such as Standard Contractual Clauses, and it does not name an EU or UK representative. If you are in the EEA or the UK, that is a gap a lawyer should close before this policy is treated as a completed transfer arrangement. You can still contact us about a transfer using the email below.

8. How long we keep information

• Account data is kept while the account is open.
• In-app deletion is scheduled for 30 days. You can cancel it during that time. After the date, the anonymization job replaces the email, username, and display name, clears the bio and photos, and removes notifications, follows, likes, and sessions. Captions and comments can be replaced with a deletion notice. Prediction and coin rows may remain without your name.
• Direct account deletion (the API that marks the account deleted immediately) removes the Clerk sign-in and, about 30 days later, deletes the user record and queues deletion of stored media files we can match to the account.
• Data exports are stored for about 7 days and then the file is removed.
• Invite clicks keep an IP address and user agent so a referral can be attributed.
• Moderation and security logs may be kept after deletion so we can prevent abuse and handle a dispute. The product does not configure a single published retention period for those logs.

Backups and provider logs can take additional time to fall away. We do not claim that every copy disappears on the same day.

9. Security

The public site and the API are served over HTTPS. Sign-in tokens are handled by Clerk. Device restore keys are stored as hashes. Sentry events are filtered for passwords, tokens, and cookies before they are sent. Access to the production systems is limited to the people who operate them.

No service is perfectly secure. If you believe your account was accessed without permission, email us. Please do not send your password or a one-time code in that email.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or export your information, to object to or restrict a use, and to withdraw a consent. You can edit much of your profile in the app. You can turn notifications off in the device settings and in the app. You can block users and delete content you posted, using the controls the app provides.

Privacy & Data in the app can request a JSON export and can schedule deletion. The export currently includes your profile, reels, reel comments, likes, match predictions, quiz attempts, coin history, achievements, follows, notifications, and consent records. It does not include every feature. Community posts and match chat are examples of data the export job does not currently collect. The screen says an email will be sent when the file is ready. The server saves the file for about 7 days and does not currently send that email. If you do not receive a link, email us and we will help you get your copy.

We will not discriminate against you for making a privacy request. We may refuse a request that we cannot verify, or that the law allows us to refuse. We do not promise a response time that the product does not implement.

11. European users

If the GDPR applies to you, you may have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You may lodge a complaint with a supervisory authority. We do not name an EU representative in the product, and we do not treat this page as a finding that every GDPR duty has been met.

To use these rights, email merdevai477@gmail.com. We may need to confirm that the request comes from you. The in-app export and deletion tools are the product’s current self-service path for access and erasure. They have the limits described above.

12. United Kingdom users

If the UK GDPR applies to you, you have the same kinds of rights against the operator: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to the Information Commissioner’s Office. The product does not name a UK representative. This page does not certify UK GDPR compliance.

13. Children

90Plus is not for children under 13. We block an account that declares an age under 13. We do not knowingly ask a child under 13 for personal information. If you believe a child under 13 has an account, email us and we will delete it.

For ages 13 to 17, the app can ask for a parent or guardian email and store the consent request. The product prepares a consent message, but the current server code does not connect an email provider, so that message may not be delivered. Do not rely on an email arriving. A parent who wants an account removed can email us directly.

14. Sponsors, advertising, and analytics

Predict & Win shows sponsor names, logos, store details, and prize competitions. That is sponsored content inside the app. The public website does not run an analytics or advertising pixel. app-ads.txt authorizes Google to sell advertising inventory for this app. The application code reviewed for this policy does not include an advertising SDK that requests ads inside the app, and it does not send your profile to Google for that purpose. We do not sell personal information. If in-app ads are turned on later, Google may receive an advertising request under its own policy, and this section will be updated.

The app has an analytics switch described as helping us improve the app. The switch is saved on your account. The current code does not connect it to a product-analytics SDK, and it does not turn Sentry crash reports on or off. Crash reports are described in section 3.

The email switch is saved. The current server does not run a marketing-email programme from that switch. The data-sharing switch is saved and defaults to off. Turning it on does not, in the current code, send your profile to a partner.

15. Push notifications

If you allow notifications, we store an Expo push token and your platform so we can send match alerts, social alerts, and similar messages. A push-consent flag is stored on the account. You can withdraw permission in the system settings, and you can turn the in-app push switch off. Live Activities on iOS use a separate token so a followed match can appear on the lock screen. Turning notifications off does not delete the rest of your account.

16. Account deletion

You can schedule deletion in the app under Privacy & Data, use https://90plus.pro/delete-account, or email merdevai477@gmail.com. The in-app request waits 30 days and can be cancelled while it is scheduled. At the end of that period we anonymize the account as section 8 describes. The request stores the IP address and user agent.

There is a second path that deletes the Clerk user immediately and permanently deletes the database row and matched media about 30 days later. Email us if you need to know which path ran for your account. Deletion does not remove content that other people have already copied, and it does not remove every security or moderation record.

17. Changes to this policy

We will update this page when our practices change, and we will change the date at the top. If a change is material, we will take a reasonable step to tell you in the app or on this page. The previous pages that described location tracking for local content, or payment providers, do not describe the current Service and are withdrawn.

18. Contact

Privacy requests go to the individual developer who operates 90Plus. There is no separate privacy office on file.

• Email: merdevai477@gmail.com
• Support: https://90plus.pro/support
• Support phone published on that page: +220 76 30 953. This is a support number, not a registered office.
• Website: https://90plus.pro
• Terms of Service: https://90plus.pro/terms