Privacy policy

The controller of personal data for Dobitka users is Mateusz Rutkowski Testy, Kraków, Poland, NIP: 7962790612, REGON: 381659867.

Privacy contact: rododobitka.pl.

• Account email for email-code or Google sign-in, optional nickname and favourite club.
• Adult confirmation timestamp and terms acceptance audit.
• Match setups: lineup, formation, playing style and changes.
• Simulation results, points, rankings and tournament picks.
• Subscription and payment data (if we enable payments) handled through Stripe; card data is not stored by Dobitka. Voluntary support (“buy us a coffee”) runs through an external Stripe payment link.
• Transactional email through Resend (welcome, result notifications, match reminders and a single reminder about a first result you have not opened yet) and its delivery, open and click events. We use them to deliver notifications, to stop sending to addresses that do not accept mail and to limit reminders: the first-result reminder goes out at most once and only when the result email was not opened.
• Optional post-result feedback: one selected reason, question version and the time it was shown, answered or skipped, linked to your account. The feedback record contains no free text or IP; the survey adds no browser storage. Responses stay within Dobitka and are read as aggregate counts; they are not sent to AI providers.
• Technical data such as hashed IP, user agent, CSRF/session data and security logs.
• Internal gameplay measurement linked to your account: mounting the next-match CTA, clicking it, opening the club setup form or encountering a setup barrier, and separately the plan editor becoming ready in a visible tab. A random journey identifier links a click from your own club result to that ready editor, preserving the source result and target match. We record server timestamps. These records add no cookies or browser storage and contain no email, IP or lineup contents. They stay within Dobitka; reports contain aggregate counts. Plan saves and manual confirmations are measured from database changes.

• GDPR art. 6(1)(b): account, simulation and digital service delivery.
• GDPR art. 6(1)(a): optional consent and 18+ declaration.
• GDPR art. 6(1)(c): accounting, tax and legal obligations.
• GDPR art. 6(1)(f): security, abuse prevention, rate limiting and fraud prevention, measuring how the service works and improving gameplay using optional post-result feedback.

• Account data: until account deletion.
• Post-result feedback: until account deletion, so we do not ask the same question again.
• Internal gameplay event history: until account deletion. Deleting a plan alone does not remove an event already recorded.
• Setups and simulation results: through the relevant football season, then aggregated where possible.
• Payments and invoices: for the required accounting retention period.
• Hashed IP and request metadata: up to 30 days.
• Server logs: according to provider retention policies.

Dobitka uses Vercel, Supabase, Stripe (including the voluntary “buy us a coffee” payment link), Resend, Anthropic, a model service host, Upstash, Google Tag Manager (Google Ireland Limited), Meta Pixel, Meta Conversions API, TikTok Pixel and API-Sports/API-Football. Google Tag Manager loads only after consent on selected anonymous public pages. This includes informational and campaign pages and the canonical, pre-authentication login landing without account input fields. Its bootstrap receives standard HTTP request metadata for delivery and diagnostics; measurement tags require a separate review before publication. The remaining services process only the data needed for hosting, authentication, simulation, email, payments, security, campaign measurement or football data.

Under GDPR you may request access, correction, deletion, restriction, portability, objection and withdrawal of consent where applicable. You may also lodge a complaint with the Polish data protection authority.

Dobitka is intended for adults, 18+. If we learn that an account belongs to a minor, the account and related personal data will be removed.

We use strictly necessary cookies and local storage for login, CSRF protection, session state and interface preferences. The session cookie dobitka_marketing_auth_fence, per-attempt cookies with the dobitka_marketing_auth_fence_flow_prefix and their matching local/session storage state prevent Google Tag Manager from loading during sign-in transitions between browser tabs. They hold only random generations and a pending/clear status, not account data.

Analytics and marketing tools, including Vercel Analytics, Google Tag Manager, Meta Pixel and TikTok Pixel, are loaded only after optional consent. Google Tag Manager is limited to selected anonymous public pages. On the canonical login landing it runs only without a query or hash and never shares a document with the e-mail/OTP form. The login form and the free-text feedback fields on the scoring, FAQ and model accuracy pages open in a fresh, untracked document. It does not run on account, payment, setup or admin pages. As remotely supplied first-party code, an active container can technically access the browser context of that public page. We do not start it while the tab stores an e-mail awaiting an OTP code, and container versions require access and data-scope review. These tools help us measure traffic, campaign performance and registration events. Refusing consent does not block access to Dobitka.

After optional consent, per-attempt cookies with the prefix dobitka-meta-registration-consent- link a Google sign-in attempt to registration measurement through Meta Conversions API. They contain a random attempt identifier and its creation time, expire after 10 minutes and are removed on a matching sign-in return or when consent is withdrawn. They contain no e-mail or login token. The registration event can include a SHA-256 hash of the verified e-mail, IP address, browser information and Meta cookie identifiers if available. Google registration measurement runs in the background after the sign-in response and is disabled in explicit privacy mode.

We may update this policy. Material changes are communicated by email to active users or by an in-product banner in advance.