Privacy Policy

World Cup 2026 Sticker Collector · Last updated: 10 June 2026

This Privacy Policy explains how the World Cup 2026 Sticker Collector web application (the “App”), available at https://wc26.bgoktugozdemir.net (also reachable at https://world-cup-26-sticker-collector.web.app), collects, uses, and protects your personal data. The App is an independent, fan-made sticker-collection tracker. It is not affiliated with, endorsed by, or sponsored by FIFA, Panini, or any official body.

1. Who we are (Data Controller)

The App is operated by bgoktugozdemir (“we”, “us”), an independent developer, acting as the data controller for the purposes of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”).

Contact for any privacy request: sticker-collector-support@googlegroups.com

2. What data we collect

Account data

• Google Sign-In: your name, email address, profile photo URL, and Google account identifier.
• Email / Password sign-up: your email address and email-verification status. Your password is handled and stored by Google Firebase Authentication in hashed form; we never see or store your raw password.

Your collection content

• The stickers you mark as owned and their counts, stored against your account identifier in Google Cloud Firestore. This is the core data the App exists to store for you.

Usage and analytics data

• Via Google Firebase Analytics: app events (e.g. screens viewed, actions taken), session information, device/browser type, operating system, language, a coarse/approximate location derived from your IP address, and analytics/installation identifiers.

Diagnostic data

• Via Sentry (error monitoring): when an error occurs, technical context such as browser type, operating system, IP address, and a stack trace may be collected to help us diagnose and fix the problem.

Security data

• Via Google Firebase App Check / reCAPTCHA: signals used to verify that requests originate from the genuine App and to prevent abuse. reCAPTCHA may collect device and usage information as described in Google’s policy.

Local preferences

• Your theme and language choices are stored locally on your device (browser local storage). They are not personal data and are not transmitted to us.

3. How we use your data and our legal bases

• To provide the App and your account (authentication, storing and syncing your collection) — GDPR Art. 6(1)(b) performance of a contract; KVKK Art. 5 (processing necessary for a contract).
• To keep the App secure and prevent abuse (App Check) — GDPR Art. 6(1)(f) legitimate interests; KVKK Art. 5/2 legitimate interest.
• To understand usage and improve the App (Analytics) — GDPR Art. 6(1)(a) consent or 6(1)(f) legitimate interests, depending on your jurisdiction; KVKK explicit consent where required.
• To diagnose and fix errors (Sentry) — GDPR Art. 6(1)(f) legitimate interests; KVKK Art. 5/2.

We do not sell your personal data, and we do not use it for advertising.

4. Third-party services and international transfers

We rely on the following processors, which may store and process data on servers located outside Türkiye and the EU (including the United States):

• Google LLC — Firebase Authentication, Cloud Firestore, Firebase Analytics, App Check / reCAPTCHA, and Hosting. See the Google Privacy Policy.
• Functional Software, Inc. (Sentry) — error monitoring. See the Sentry Privacy Policy.

Where data is transferred internationally, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses offered by these providers.

5. Data retention

• Account and collection data: kept until you delete your account (see Section 7).
• Analytics data: retained according to Google Firebase Analytics’ default retention settings.
• Diagnostic logs: retained for a limited period under Sentry’s retention settings, then deleted.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority.

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information about it, request correction or deletion, and apply to the data controller; you may also complain to the Turkish Personal Data Protection Authority (KVKK Kurulu).

To exercise any of these rights, email sticker-collector-support@googlegroups.com.

7. Account deletion

To delete your account and the collection data associated with it, send a request from your account email address to sticker-collector-support@googlegroups.com. We will delete your account and associated Firestore data. Some diagnostic logs that do not identify you directly may persist for a limited retention period before automatic deletion.

8. Children

The App is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

9. Security

We protect your data with HTTPS in transit, Firebase App Check, and Firestore security rules that restrict each user to reading and writing only their own data. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

10. Cookies and local storage

The App uses browser local storage and similar technologies to keep you signed in and to remember your preferences. Firebase Analytics may set identifiers for analytics purposes. The App does not use advertising cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be reflected here before they take effect.

12. Contact

Data controller: bgoktugozdemir
Email: sticker-collector-support@googlegroups.com