ScoreCover privacy policy

Updated 14 October 2026

ScoreCover is an app for following NHL, Liiga and SHL games and watching their recaps without the result being spoiled. This policy explains what information the ScoreCover app (iOS and Android) and its server process, why, and what you can do about it.

1. Controller

Anssi Tapani Kosunen (ScoreCover), Finland
Email: anssi.kosunen@gmail.com

Send questions and requests about your privacy to this address as well.

2. What we process

2.1 Install id and usage statistics

When the app fetches games from our server, each request carries

• an install id: a random id (UUID) the app creates on its first launch and stores on the phone. It contains nothing about you or your device, and it is not linked to advertising ids or other apps.
• the platform and version: iOS or Android and the app version
• the app's language, to show names and texts in it
• the country whose TV broadcasts are shown (from version 2.1.1), so a game shows where to watch it. You can change the country or hide broadcasts in Settings → Games → TV and streaming. The server doesn't store the country.

For each install id the server stores the platform, version and language, when the app was first and last used, and the days it was used. For requests about favorites and notifications (2.3 and 2.4) it stores the time of the latest one. If you have turned notifications on, this also shows when the app was last started, as the app sends the token every time it starts (2.4), even with usage statistics off. We also count the requests per day by platform and version, without the id. ScoreCover 1.x sends no install id; only its requests are counted.

We don't store the IP address of the app's requests in our database.

If you opt out of usage statistics in the app's settings, the app stops sending the install id when it fetches games and sends no usage events (2.2), so your use is not counted. Requests about favorites and notifications, and the request that deletes your data, still carry the id, because the server needs it to know whose favorites and notifications they are. No day of use is recorded for these requests.

2.2 Usage events

From version 2.2 the app also records what you do in it while usage statistics are on, and sends these usage events to the server in batches. The events are

• opening a video and watching it to the end
• revealing a score
• opening a game page
• opening a player or team card
• opening a notification.

For each event we store what it was and when, and also the league, the game, the video's type (such as a recap or a goal clip) and source (such as YouTube), where in the app it happened (such as a game card, a shared link or a notification), the type of card opened (player or team), and the platform and app version. The events are linked to the install id, so they show which games and videos the install has opened and watched. They contain nothing else about you, such as your name or location, and no scores. The events are processed only on our own server (section 5) and are not given to third parties.

If you opt out of usage statistics, the app records and sends no events, and those not yet sent are deleted from the phone.

2.3 Favorite teams

From version 2.2 you can choose favorite teams. They are stored on your phone and on the server, linked to the install id: the league, the team's id and when you chose it. The server uses the favorites for notifications (2.4). They are on the server even while notifications are off, so that notifications work as soon as you turn them on.

The app sends the favorites when you change them, and once a week even when unchanged, so that they stay on the server. They are sent even if you have opted out of usage statistics (2.1). For aggregated figures, such as the most popular teams, we use only the favorites of installs whose use is counted.

2.4 Notifications

From version 2.2 the app can tell you when a recap of your favorite team's game is out. Notifications are off by default. When you turn them on, the phone gets a notification token from Google's Firebase Cloud Messaging (FCM), and the app sends the server

• the token and the platform (iOS or Android)
• the app's language, your time zone and the home/away order, so that notifications are in your language, list the teams in your order and keep your quiet hours by your clock. Your time zone gives a rough idea of where in the world you are.
• your notification choices: whether notifications are on, whether you want the short or the long NHL recap or both, and quiet hours, which are off by default.

At the same time Firebase creates its own installation id for the phone (Firebase installation ID), which only Google gets. Before you turn notifications on, there is no token, and the app doesn't send the server your time zone, the home/away order or your notification choices. After that the app sends the token every time it starts and the settings whenever they change, even if you turn notifications off in the app or opt out of usage statistics (2.1). This stops when you turn notifications off in the phone's settings (and resumes if you allow them again) or choose Delete my data.

The server matches your favorites with the games and sends a notification when a new recap is out from a game of a team you follow. The notification contains the teams' abbreviations, the league, the game and the video's type, source and id, but not the score. Notifications go through FCM, and on iPhones also through Apple Push Notification service (APNs). Google and Apple therefore see the token and which teams' games your phone gets notifications about (section 5). If the phone is offline, they keep trying to deliver a notification for at most a day.

If quiet hours are on, a notification that comes during them waits in the server's queue until they end, for at most a day. The queue then holds the install's internal number (not the install id), the game and the video. A notification that fails to send is kept for a week so that we can look into the problem.

We count the notifications sent per day and league from all installs, without linking the counts to installs. Only notifications sent to installs whose use is counted go into the share of notifications opened. The server infers this when sending, from the install's latest day of use and request, and doesn't store it per install. The counts are not personal data.

2.5 Server logs

The server's technical logs record the time, address, IP address and app or browser identifier of requests. The logs are used only to fix problems and protect the service, and they are deleted within 14 days.

2.6 Information on your phone

Your settings, your favorites and the games you have revealed or watched are stored in the app's storage on your phone. Of these, only the language and the TV country (2.1), the favorites (2.3), and, for those who have turned notifications on, the time zone, home/away order and notification choices (2.4) are sent to the server. Other settings, such as the theme and default league, and the list of games you have revealed or watched never reach us. If usage statistics are on, however, revealing a score and watching a video are recorded as usage events (2.2). The data on your phone is deleted when you delete the app or choose Delete my data in the settings.

2.7 Contacting us

If you email us, for example with feedback, we process your message and email address to answer you.

3. Purposes and legal basis

• Providing the service: games and videos in your language, telling you about an update, and notifications of your favorite teams' recaps.
• Usage statistics and development: the number of active installs per day, week and month, retention, the split of versions and platforms, and from the usage events, for example, how many open recaps and watch them to the end, reveal scores or open notifications. They tell us what to develop and when support for old versions can end.
• Business planning: we use aggregated statistics, such as usage events and the most popular teams, to assess the app's future, such as a possible paid version, sponsorships or advertising. Partners only get aggregated figures that cannot identify an install.
• Security and fixing problems (server logs and failed notifications).
• Answering you when you contact us.

The legal basis for notifications is providing a service you have asked for (Article 6(1)(b) of the EU General Data Protection Regulation): once you have turned notifications on, the server needs your favorites, the token and the settings to notify you of your favorites' recaps.

The legal basis for other processing is our legitimate interest (Article 6(1)(f)): keeping a free app running and improving it requires knowing how many people use it and how, and with your favorites already on the server, notifications work as soon as you turn them on. Usage statistics and favorites contain no name or contact details and are not linked to you. You can opt out of usage statistics at any time, and your favorites leave the server when you remove them in the app or choose Delete my data.

We don't use the data for automated decision-making or profiling, and we don't sell it.

4. Videos and content from other services

When you open a recap or a goal clip, the video loads directly from its publisher, not from our server. The video service then gets your phone's IP address and technical details, and under its own terms it may store cookies or other data on your phone, collect viewing data and show ads. We get no information about you from these services.

• NHL videos play in the NHL's own player (Brightcove), which may show ads. The long highlights of NHL games are by Sportsnet (Canada) and play from YouTube (see below). NHL privacy policy · Brightcove privacy policy
• Liiga recaps and long NHL highlights play from YouTube. ScoreCover uses YouTube API Services to play them. By watching YouTube videos in the app you agree to the YouTube Terms of Service, and your data is processed under the Google Privacy Policy. ScoreCover doesn't ask for access to your Google account and gets no information about you from YouTube.
• Liiga goal clips load from Liiga's video service. Liiga privacy policy (in Finnish)
• SHL recaps and goal clips play in the SHL's own player, from the video service of StayLive AB (Sweden). SHL terms and privacy policy (in Swedish) · StayLive privacy policy
• Player photos and the teams' official logos load from the servers of the NHL, Liiga and the SHL, which see the request's IP address.

These services are responsible for their own processing, and they may transfer data outside the European Union, for example to the United States.

5. Who processes the data

Our server is in a data center of UpCloud Ltd (Finland) in the European Union. UpCloud processes the data on our behalf and doesn't use it for its own purposes. Usage events and the server's other data are processed only there. From notifications, however, Google and Apple see which teams' games your phone gets notifications about (below).

If you turn notifications on, they are delivered on our behalf by

• Google (Firebase Cloud Messaging) to all phones, under the Firebase Data Processing and Security Terms: Privacy and Security in Firebase
• Apple (Apple Push Notification service) to iPhones, under its own terms: Apple Privacy Policy

They process the token, the content of the notifications and your phone's IP address, and Google also the Firebase installation ID. The data may be transferred to the United States. Google and Apple are certified under the EU-U.S. Data Privacy Framework, and Google's terms also include the European Commission's standard contractual clauses. Our email address is on Google's Gmail, so emails may be transferred to the United States. We don't transfer other data outside the European Union and the European Economic Area.

6. How long we keep the data

• The install id and its data (days of use, favorites and notification settings): as long as the app is used. They are deleted automatically when the app has not sent the install id for 24 months. Individual days of use and usage events are deleted after 24 months.
• The notification token: deleted when the app has not sent it for 270 days, and when a notification to it fails because FCM no longer knows it (for example, the app was deleted from the phone).
• Waiting notifications: at most a day in the server's queue. Failed notifications are kept for a week.
• Counts of requests and sent notifications without the id are kept indefinitely. They are not personal data.
• Server logs: up to 14 days.
• Emails: until the matter is settled, at most two years.

7. Your rights

• Opt out of usage statistics: Settings → Privacy → Usage statistics. The app stops sending the install id when it fetches games and sends no usage events. Requests about favorites and notifications still carry the id (2.1). Days of use and usage events already stored stay until they expire (section 6) or you choose Delete my data.
• Turn notifications off: Settings → Notifications → Favorite teams' videos. The server then sends no notifications, but the token and notification settings are kept so that you can turn notifications back on. If you turn notifications off in the phone's settings, the app deletes the token from the server the next time you open the app.
• Delete your data: Settings → Privacy → Delete my data deletes the install id and everything linked to it from the server right away: days of use, usage events, favorites, the token and notification settings. The app also deletes the token from Firebase, and a waiting notification is not sent. Firebase's own installation id (2.4) stays with Google, however. On your phone the settings (except the usage statistics choice), favorites, and revealed and watched games are reset, and the app creates a new install id. The server remembers the deleted id for a day so that a late request about favorites or notifications doesn't store them again. Failed notifications are deleted within a week. If you only delete the app, the token is deleted when a notification to it fails, or after 270 days at the latest, and the rest of the data on the server after 24 months.
• Access your data, get it in a machine-readable form, have it corrected or its processing restricted, and object to the processing: email us your request with your install id (Settings → Privacy → Install id). Without the id we cannot tell which data is yours.
• Lodge a complaint with a supervisory authority if you think your data is processed unlawfully. In Finland it is the Office of the Data Protection Ombudsman.

8. Security

Traffic between the app and the server is encrypted (HTTPS). The API serves only the ScoreCover app, and only the administrator has access to the server and its database.

9. Changes

We update this policy when the app changes, and before we introduce features such as sign-in. The date of the latest update is at the top, and we tell you about significant changes in the app.