Privacy
You can follow scores without an account. An account lets you save matches, take part and set up alerts. Visit counting is our own and stays in our database. Ad cookies only with your consent.
Who is responsible for your data
Bravoscores is a site run by Rice Agência LTDA, CNPJ 62.359.818/0001-52, based in Campos dos Goytacazes, RJ, Brazil. It is the controller of the data described on this page. Requests about your data: [email protected]. Outros assuntos: [email protected].
The summary, in five lines
- You can follow the scores without creating an account. An account lets you save matches, take part and set up alerts. Without an account, nothing we store identifies you.
- We count visits to know what people use. That count is ours and stays in our database.
- In Brazil and Europe, we only create an identifier that survives closing the browser, and only load ad pixels, if you accept in the cookie notice. In other countries, they turn on at the first visit and stop when you decline in the cookies section of this page.
- With an account, we store what the account needs and what you choose to write: profile, match diary, predictions, passport. The full list is just below, under "If you create an account".
- We never sell your data. That does not exist and never will.
If you do not have an account
Every time a screen opens, we record a line in our own count. It has this, and only this:
| What | What for |
|---|---|
| The event type and the page address | Knowing which screens people use |
| The domain you came from | Knowing whether the visit came from Google, a link or directly |
| A screen width range (phone, tablet, computer) | Deciding where it is worth fixing the layout |
| A number drawn by your browser, which disappears when the tab closes | Not counting the same visit ten times |
What isn't there: your IP, your name, your email, or anything that could fingerprint your browser. We don't record those things.
An honest caveat: whoever hosts the site and whoever serves the database record IP addresses in their own server logs, like any service on the internet. Those records are theirs, serve security and operations, and are not used by us to build anyone's profile.
Cookies and the notice shown on the first visit
In Brazil and Europe, what follows applies: no tracking before you answer. In other countries, the tracking described below starts at the first visit, without a notice; to decline, use the button below and it stops right away.
Until you respond to the notice, the site does not store any measurement data in your browser and does not load third-party pixels or analytics scripts. The exception is what makes the site work: if you sign in, the login session is kept in the browser (otherwise you'd have to sign in again on every page), and the sign-in screen may load Cloudflare's anti-bot check when it's switched on.
There's one more exception, and it doesn't depend on the notice: every page loads the Google AdSense code. That's how Google confirms the site is ours. Right now the site doesn't show ads; when it does, this page will be updated first.
If you accept, two things start to happen:
- We keep a number drawn in your browser, which survives closing the tab. It serves only to tell us how many people come back to the site. It is not linked to your name or your email.
- We load the Meta pixel and Google Analytics. They use their own cookies and learn that you visited the site and which steps you took (created an account, turned on alerts, subscribed). This is what lets us measure and improve the ads that bring people here.
If you decline, none of this happens. Our own count continues, per session, with nothing stored in your browser, and the site works the same: we don't hide any feature from people who decline.
When you start the free trial or pay for PRO, our server tells Meta about that purchase to measure our ads: the amount, the plan, your email and your account number scrambled (hash, which cannot be undone) and, when we have them, the network address and browser used for the payment. This happens even if you declined cookies. If you have not yet answered the cookie notice, the Meta ad click code (when you arrived from an ad) and, when it exists, a browser code (Meta's _fbp cookie; in Brazil it is saved at payment) go too, so Meta knows which ad the purchase came from. If you declined cookies, these two codes do not go. If you accepted, the pixel identifiers go too. Google only receives the purchase from people who accepted.
To change your mind later, clear the site data in your browser. The notice will appear again on your next visit.
If you create an account
The account lets you follow your teams, receive alerts and keep what you have lived in football. What we keep:
| What | Where it comes from |
|---|---|
| Your email | You type it, or it comes from Google or Apple login |
| A display name | You choose it, or we take the part before the @ |
| The teams and competitions you follow | You mark them on the site |
| Your alert preferences | You mark them on the site |
| If you have a paid plan, which one and since when | From the payment, when there is one |
| Which features you opened on the site | Use of the site, to understand what is worth building |
| Your result and score predictions (Predictor) | You mark them on the site |
| What you write in the chat of matches, Predictor and leagues | You write it on the site |
| Your profile: @, photo, city, favourite team, bio and social media link | You fill it in on the site, if you want |
| Your diary: matches you watched, ratings, reviews, top 5 and matches written from memory | You mark them on the site |
| Your passport: stadiums you have been to | You mark them on the site |
| Who you follow and who follows you | You mark them on the site |
| The Predictor leagues you joined and the messages in your inbox | Use of the site |
Public or private profile: you choose in your profile. When private, your diary, passport and stats aren't shown to anyone, and you leave the public leaderboards (predictions and Predictor). What you write in public places stays public: chat messages, match reviews and posts in a team's community appear with your display name even with a private profile.
Predictor leagues: a league's ranking and chat are only visible to its members.
Predictions ranking: it's public. Anyone who has predicted five or more matches appears in it with their display name, number of predictions and correct ones. If you never chose a name, you appear as Fan: the ranking never shows your email, nor the part before the @.
Match chat: what you write there is public. Anyone who opens the match sees the message, the time and your display name. If you never chose a name, you appear as Fan followed by a number: the chat never shows your email. To keep the chat free of links, scams and prejudice, messages go through an automatic filter, an artificial intelligence model that may hide them, reports from other users and our moderation. We also keep blocked attempts (messages with links or insults) and penalties (time without posting or a chat ban), because they are the basis of the rule that a second link means a ban.
Reviews and fan posts: get the same care as the chat. Links and insults are blocked right away; an artificial intelligence model may hide the text; three different people reporting it also hide it until moderation reviews it. We keep who reported what (so a single person can't hide anyone) and a record of each text hidden or shown again, with the reason. If your review is hidden, only you can still see it, with a notice.
Password: if you sign in with email and password, the password is stored by Supabase in one-way encrypted form. Neither we nor anyone on the team can see your password, and there is no screen in the system that shows it. If you sign in with Google or Apple, we never see any password.
Notifications: if you turn on alerts on your phone, the browser gives us a delivery address and two keys, which we store along with the browser's identification. That's the minimum the notification standard requires for the message to reach the right device. If you block the site's notifications in your browser, the record is deleted automatically the next time we try to send an alert, because the browser itself starts refusing.
In the iPhone app: alerts are delivered by Apple. We store, with your account, the identifier Apple gives the device for Bravoscores notifications. It is deleted when you turn off alerts, when you sign out or when Apple reports that the app was removed. Inside the app we don't load the Google AdSense code or any ad pixel.
Who else touches the data
| Who | What for |
|---|---|
| Supabase | Database and login. The data is kept on a server in the São Paulo region. |
| Square Cloud | Site hosting |
| Login with a Google account, if you choose that route | |
| Apple | Login with an Apple account, if you choose that route. If you use "Hide My Email", we receive a forwarding address from Apple and never your real email. |
| Meta and Google Analytics | Ad measurement: in Brazil and Europe, only after you accept cookies; in other countries, until you decline |
| Meta (purchase) | Purchase confirmation from our server (amount, plan, email and account as hash; unless you declined cookies, also the ad click code and browser code), to measure ads |
| Meta (Android app) | In the Android app, the Meta kit records when the app is installed and opened and reads the device advertising ID (you can delete or limit it in Settings > Google > Ads). Account sign-up, opening checkout and purchases in the app go through our server with that ID, plus your email and account as hash, to measure ads. |
| Google AdSense | Site verification code, loaded on every page. Google receives the page address and your network address. The site does not show ads yet. |
| Cloudflare | Site protection and the anti-robot check on the login screen |
| Sentry | Receives the alert when the site errors on your device: the error message, the page and the browser. It does not receive name, email or account. |
| Resend | Sending account emails: confirmation, login link, password change and welcome |
| Open-Meteo | Weather forecast at the stadium. It receives the stadium location, nothing about you. |
| API-Sports | Provides the football data. It receives nothing about you. |
| Anthropic | Artificial intelligence model that writes the match analyses and reviews chat messages. It receives only the message text, with no name, email or any identification of who wrote it. |
None of them receives your data to use on their own beyond what is written above, and we do not sell or trade user data with anyone.
Ads
The site has advertising spaces. Some are ours, for products from the same group; others may be from partners. Ads marked AD are paid or promotional content, and the label exists precisely so you can tell information from advertising.
For how long
- Visit counts: kept while useful to understand how the site is used. Since they don't identify anyone, there's nothing to return or delete for a specific person.
- Account data: while the account exists. Delete the account and we delete the data.
- Chat messages: in match chat, 30 days after the match; in Predictor and league chats, 30 days after the message. After that, they are deleted. Blocked attempts are kept for 180 days. A penalty lasts until it expires; a ban lasts until moderation lifts it.
- Diary, reviews, passport and profile: while the account exists. They're yours and don't expire.
- Notifications: until you block them in your browser (the record is removed on the next send) or delete your account.
What you can ask for
Under the LGPD in Brazil and the GDPR in Europe, you can ask to see which data we have about you, correct what is wrong, delete everything, take your data away in a file, and withdraw the consent you gave for cookies.
Ask by [email protected]. Respondemos em até 15 dias.
To delete your account yourself, sign in and go to Your account › Delete my account. For security, the site asks for a recent sign-in.
Deleting the account also deletes your match diary, ratings, reviews, predictions, followed teams, preferences, profile photo, devices registered for alerts and the leagues you created. Removal of the profile photo from storage is requested immediately and carried out by our server; if storage fails, it retries at growing intervals until it succeeds, and the team can see what's pending. The aggregate visit count remains, because it was never linked to you.
Children
The site is not made for children under 13 and we do not ask anyone's age. If we learn that an account belongs to a child under 13, we delete it.
When this changes
If what the site collects changes, this page changes, with the date at the top updated. If the change is big, the notice appears again for you to decide again.