Privacy policy

Who is responsible

Dictumus is run by Özgün Özsoy, an individual based in Türkiye, at PO Box 10, Kağıthane PTT, 34407 Kağıthane, Istanbul, Türkiye. Özgün Özsoy decides how your personal data are used and is responsible for it (the controller).

For privacy questions and requests, write to privacy@dictumus.com. For help with the game, write to support@dictumus.com.

This policy covers dictumus.com and the Dictumus apps for iPhone and Android. If you are in Türkiye, the Turkish notice under the Personal Data Protection Law (KVKK) at dictumus.com/kvkk sets out the same in Turkish, with your rights under that law.

What we keep

Your account: the name you choose, your email address, your password (stored only as a one-way hash, never readable), your language and time zone. You confirm your email address before you can sign in.

Signing in: when you sign in we keep the session, with the IP address and the browser it came from, so a stolen session can be told apart from yours. A session ends after 60 days without use; using it starts the 60 days again.

What you play: the tournaments you are in, the name you use in each, every score you predict and when it was saved, and what the game works out from them: points, standings, honours, signatures, your calibration and your season report card.

Reactions: the emoji you put on someone else's pick once its match has closed, and when.

Notifications: your choices in Settings, the notices in your in-app inbox, and a log of what was sent so nothing is sent twice. If you turn on push notifications: in a browser, the address it gives us to reach it, and whether it is on an Android phone (so that once you have the Dictumus app there, you are not notified twice); in the Dictumus app, the token your phone gives us, from Apple or Google; and the language to write them in.

In the iPhone app, the home-screen widget holds a key of its own, which reads your next match and your place; signing out removes it. We also keep which of the app's first-time guide cards you have seen or closed, so each shows once.

Cards you share: when you share a card, its text is stored as it was sent, under a link anyone with it can open.

Agreements: the version of the terms you accepted and when.

What you write to us: your message and our reply, when you contact support or make a request about your data. Please do not send passwords, or information about other people that we do not need.

Who sees what

The people in your tournament see the name you use there, your picks once their match has closed (never before), your points, honours, signature and reactions. Your calibration and your report card are seen by you alone, unless you share them yourself.

When you join a tournament, its creator is told that you joined, with the name you use there: in the app and, unless they turned it off, by email. Nobody else in the game ever sees your email address.

A card you share is seen by whoever has its link. It carries your name and nobody else's. People can copy or forward it; deleting the original does not remove copies others have made.

We may publish anonymous shares drawn from the predictions of everyone playing a competition, such as the share who backed the home side. They never carry a name, and are never published for a match with few predictions.

Why we use it, and on what basis

To create and secure your account, run the tournaments you join, share what you choose to share and answer your requests: this is needed to provide the game you signed up for (under the EU and UK GDPR, Article 6(1)(b)).

To keep accounts secure, stop abuse, find faults and keep recovery copies of the database: our legitimate interest in a safe and reliable service, weighed against your rights (Article 6(1)(f)). You may object to this on grounds relating to your situation.

To send the weekly email and push notifications: your consent, which you give by turning them on and withdraw by turning them off, at any time, without losing anything else (Article 6(1)(a)).

To answer requests about your data and meet other legal duties: a legal obligation (Article 6(1)(c)).

The game works out points, standings and honours automatically from picks and results. That is the game itself; it decides nothing about your legal rights.

Emails and notifications

We always send the emails the service needs: confirming your address, resetting your password, a notice if the creator of a tournament removes you from it, and a one-time notice if the creator of a tournament you are in deletes it before its first match closes.

The weekly email (your picks to make and last week's results) is sent only if you ask for it, at sign-up or in Settings. Accounts opened before 27 October 2026 kept the setting they had. Every weekly email has a link to stop it.

If you create a tournament, we tell you when someone joins it, in the app and by email; you can turn the email off in Settings.

Push notifications are sent only after you turn them on, and you choose which kinds in Settings. Your phone may show them on its lock screen, depending on its settings.

Visit counts and error reports

We count visits to our public pages ourselves, with no cookie and no third party: the page, its language, the day, and the site or campaign a link came from. No IP address and nothing that tells one visitor from another is kept.

When something breaks, Sentry (Functional Software, Inc.) receives a report of the error, stored in Germany: what failed, where in our code, and the browser or phone and its language. Our setup leaves out your name, email address, IP address, cookies and picks. We do not measure performance through it. Reports are deleted by Sentry within 90 days.

We show no advertising, use no advertising trackers, and do not sell or buy personal data.

Services that work for us

Railway (Railway Corp.) runs the app and the database, in its EU West region (Amsterdam, the Netherlands), and keeps its own backups of it.

Resend (Resend, Inc.) sends our emails, from its region in Ireland: it receives your email address, your name where the email uses it, and the email.

Hostinger hosts our support and privacy mailboxes, and with them what you write to us and a second recovery copy, in France or Germany.

Sentry receives the error reports described above.

Push notifications, if you turn them on, are carried by your browser's push service (Apple, Google or Mozilla, encrypted) or, in the app, by Apple's Push Notification service or Google's Firebase Cloud Messaging.

Each of these works only on our instructions, under its data processing agreement with us.

Apple and Google also handle your store account and the app's download under their own privacy policies. Dictumus is free today and takes no payments.

Fixtures and results come from Highlightly, checked against football-data.org. We send them nothing about you.

We build and run Dictumus with the help of an AI assistant (Claude, by Anthropic). It works on our code, and reads only counts (such as how many people signed up on a day) and public football data. It is not given your account, your picks or anything else that identifies you.

Our fonts are served from our own address; your browser does not ask a third party for them.

Where your data is

The database is in the Netherlands, emails are sent from Ireland, our mailboxes are in France or Germany, and error reports are stored in Germany. Some of our providers are based in the United States, and their support staff or push services may reach data from there or from other countries.

We also keep a daily recovery copy of the database outside Railway, encrypted, on the operator's computer in Türkiye, and a second encrypted copy in our own mailbox at Hostinger (France or Germany). Without the key, kept apart from them, these copies cannot be read.

Where data leaves the EU, our providers' data processing agreements include the European Commission's standard contractual clauses. Transfers from Türkiye are covered in the Turkish notice. To ask which safeguards apply to your data, or for a copy of them, write to privacy@dictumus.com.

How long we keep it

Your account and what you play are kept while you have an account, so your group's history stays whole.

Sessions end after 60 days without use. Links we email you to confirm your address work once and expire after two days; links to reset your password work once and expire after an hour. A push address is removed when you turn notifications off, and is no longer used once it stops working.

If you leave a tournament, you stay in its table with the points you had, marked as gone; your picks on matches not yet closed are removed.

If the creator removes you from a tournament, your picks, points, honours, reactions and cards in it are deleted and its table is worked out again without you. The group keeps one line, "Alex removed Sam", with the names used there, and we keep that you were removed, so its link cannot bring you back in.

If you delete your account, everything that is yours goes at once: your profile, your picks, your reactions, your cards, your practice tournaments, your notifications and your sessions. The tables, honours and report cards you were part of are worked out again without you, finished seasons included. A tournament you created carries on under whoever joined it first; one with nobody else in it is deleted.

If you report someone, the report (its reason, your note and the name reported) is kept for two years after it is closed, even if you delete your account, so a decision can be explained or challenged. When a creator removes a player, the tournament's line "Alex removed Sam" keeps the names used that day.

Recovery copies of the database hold deleted data for at most 90 days, and are never used to bring a deleted account back.

A practice tournament is deleted with its season.

What you write to us is kept until your request is dealt with, and longer only if it is needed to establish or defend a legal claim.

Visit counts hold nothing about you and are kept.

Cookies

We set only the cookies the app needs to work, and none from anyone else: one that keeps you signed in; one that remembers your language; one that remembers your light or dark choice; one that remembers the tournament you last opened; for two days after you sign up, one that lets this device sign in once you confirm your address; and for 28 days after you open an invitation while signed out, one that keeps it, so you can look around first and still join. Your browser also keeps a few small notes on this device only: whether a one-time animation or offer has already been shown, whether we have asked about notifications, and your time zone for the visit; if you turn notifications on, what it needs to receive them; and one page shown when you are offline. You can clear them in your browser; you will then be signed out.

Your rights

In Settings, then Your account, then Data and privacy, you can correct your details, download everything kept about you in one file, and delete your account; deletion takes effect at once. Without the app: dictumus.com/delete-account.

You can also write to privacy@dictumus.com to see your data, have it corrected or deleted, restrict or object to how it is used, or take it elsewhere. We may ask you to confirm it is you, and never for more than that needs. We answer within one month (under the KVKK, within 30 days), free of charge.

You can complain to a data protection authority: in the EU, the one where you live or work; in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after first writing to us.

Age

Dictumus is for people aged 16 and over. If you believe someone younger has an account, write to privacy@dictumus.com and we will delete it.

Changes to this policy

If this policy changes in a way that matters, we tell you in the app before the change applies. A change never gives us your consent to something new; where consent is needed, we ask for it. The version is at the top of this page.