Privacy Policy

Last updated: February 2026

This Privacy Policy explains how the Rwanda Premier League mobile application (“the App”, package rw.rwandapremierleague.rpl_app) handles your information. It applies to the App and to the accounts, fantasy game and push notifications delivered through it. The App is published by the Rwanda Premier League (BK Pro League), Kigali, Rwanda (“we”, “us”).

1. Summary

You can browse scores, tables, fixtures, news and statistics without an account and without giving us any personal data.
An account is only needed for the Fantasy game and for syncing your favourite clubs and notification settings across devices.
We collect the minimum needed to run those features: your name, username, email, phone number and a hashed password.
We do not sell your personal data. We do not use third-party advertising or analytics SDKs in the App.
You can request deletion of your account and data at any time — see our Data Deletion page.

2. Information We Collect

2.1 Information you give us

Data	When	Why
Full name, username, email address, phone number, password	When you create an account	To create and secure your account, verify your email, sign you in, and let you recover access
Profile photo (optional)	If you upload one	Shown on your profile and fantasy standings
Favourite clubs	When you pick them in the App	To personalise your home screen and, if you choose, limit notifications to those clubs
Notification preferences	When you change notification settings	To send only the alerts you asked for (goals, kickoff, cards, fantasy deadline, etc.)
Fantasy team selections, transfers, chips and predictions	When you play the Fantasy game	To run the game and calculate your points and ranking
Messages you send us	When you contact support or submit a request	To respond to and keep a record of your enquiry

2.2 Information collected automatically

Data	Purpose
Device push token (Firebase Cloud Messaging)	To deliver push notifications for matches and fantasy. A token is registered even for signed-out devices so match alerts can work; it is not linked to an identity until you sign in.
Basic technical data sent with each request (IP address, app version, device type, timestamps) via standard server logs	Security, abuse prevention, diagnosing crashes and errors, and keeping the service reliable
Local settings stored on your device (theme, cached data, session token)	To keep you signed in and let the App work offline. This stays on your device.

What we do NOT collect: we do not access your contacts, photos library (beyond a photo you explicitly pick), precise location, microphone, camera roll, SMS, or call logs. The App requests only Internet, notification and foreground-service permissions. There are no advertising identifiers and no third-party analytics or ad SDKs.

3. How We Use Your Information

Provide and maintain your account, the Fantasy game and personalised content.
Send transactional messages (email verification, password reset) and the push notifications you have enabled.
Calculate fantasy scores, leaderboards and standings.
Keep the service secure: detect and prevent fraud, abuse and unauthorised access.
Fix bugs, monitor performance and improve features.
Comply with legal obligations and respond to lawful requests.

Our legal bases (where applicable) are: performance of a contract (running your account and the game), consent (push notifications, optional profile photo), legitimate interests (security, service improvement) and legal obligation.

4. How Your Information Is Shared

We share personal data only in these limited cases:

Service providers that operate the App on our behalf, under contract and only as needed:
- Google Firebase (Cloud Messaging for push notifications; Firestore for delivering certain live content). See Google’s Firebase privacy information.
- Our hosting and email-delivery providers.
Other users: your username, profile photo and fantasy points are visible on public leaderboards and standings. Your email and phone number are never shown to other users.
Legal: where required by law, court order, or to protect the rights, safety and property of the League, our users or the public.
Business transfer: if the League’s digital operations are reorganised or transferred, data may pass to the successor under the same protections.

We do not sell or rent personal data, and we do not share it with data brokers or advertisers.

5. Data Retention

Account data is kept while your account is active.
If you request deletion, we remove or irreversibly anonymise your account data within 30 days, except where we must retain limited records to meet a legal obligation or resolve a dispute.
Server logs are typically retained for up to 90 days, then rotated.
Verification codes expire within hours and are purged.
Backups are cycled out on a rolling schedule; data deleted from the live system is removed from backups as they age out.

6. Your Rights and Choices

Access & update: view and edit your name, email, phone and photo in the App under Profile.
Notifications: turn any category on or off in the App, or disable them entirely in your device settings.
Delete your account and data: from the App (Profile → account settings) or via the Data Deletion Request page.
Object / restrict / port: where the law gives you these rights, contact us and we will honour valid requests.
Withdraw consent: e.g. revoke notification permission at any time; this does not affect processing already carried out.

To exercise any right, email ykdann53@gmail.com. We may need to verify your identity before acting.

7. Data Security

Passwords are stored only as salted one-way hashes — we never store or can read your password. Traffic between the App and our servers uses HTTPS/TLS. Access to production data is restricted to authorised personnel. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authorities of a breach where required by law.

8. Children’s Privacy

The App is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

9. International Transfers

We are based in Rwanda. Some service providers (e.g. Google Firebase, email delivery) may process data on servers outside Rwanda. Where that happens, we rely on those providers’ contractual and technical safeguards to protect your data to a standard consistent with this Policy and applicable law, including Rwanda’s Law No. 058/2021 on the protection of personal data and privacy.

10. Changes to This Policy

We may update this Policy as the App evolves. We will change the “Last updated” date above and, for material changes, provide a more prominent notice (in the App or by email). Continued use of the App after an update means you accept the revised Policy.

11. Contact Us

Questions or requests about this Policy or your data:
Rwanda Premier League (BK Pro League)
Kigali, Rwanda
Email: ykdann53@gmail.com
Account deletion: rwandapremierleague.rw/data-deletion