Privacy Policy

ZavitSports is an independent companion app for the 2026 international football tournament. It is not affiliated with any official tournament body, broadcaster, or sportsbook. ZavitSports is a product of Zavit.

Contact us: Email: privacy@zavit.ai Postal: [Physical postal address — TODO before public launch]

We collect only what we need to run the service:

• Email address — to send match alerts and product updates you sign up for. • Locale / language preference — to deliver content in English or Spanish. • Fan persona — optional label you choose (Casual fan, Die-hard, Stats nerd, Markets-curious); used to personalise communications. • Notification preferences — which channels (email, Telegram, Discord) you opted into. • IP address — retained briefly as part of your consent record and to enforce rate-limits on form submissions; not used for profiling. • Analytics events — we use PostHog to understand how features are used (page views, clicks, feature usage). PostHog is configured to anonymise IPs before storage. • Error data — we use Sentry to capture application errors so we can fix them. Sentry may capture browser type, OS, and a stack trace; it does not capture passwords or payment data.

We do not collect payment data at this stage of the product.

• Consent — we rely on your explicit, unbundled consent when you sign up for match alerts and marketing emails. You may withdraw consent at any time by clicking "Unsubscribe" in any email or emailing privacy@zavit.ai. • Legitimate interest — we rely on legitimate interest for security measures (rate-limiting, abuse prevention) and aggregate analytics that help us improve the service. We've assessed that these uses do not override your rights.

For users in the European Economic Area (EEA) and United Kingdom: consent is the legal basis for all marketing communications. Legitimate interest applies to security and analytics as described above.

We share your data only with the following processors, each under a data-processing agreement or equivalent safeguards:

• Supabase (supabase.com) — database and authentication. • Resend (resend.com) — transactional and marketing email delivery. • Vercel (vercel.com) — application hosting and edge network. • Upstash (upstash.com) — rate-limit cache and background job queues. • Cloudflare / Turnstile (cloudflare.com) — bot-protection on forms; processes IP and browser signals. • Sentry (sentry.io) — error monitoring. • PostHog (posthog.com) — product analytics. • Telegram / Discord — only if you opt into alerts on those channels; your handle is stored and messages are sent via their respective APIs.

We do not sell your data. We do not share it with advertisers.

• Unconfirmed signups (double-opt-in not completed) are purged after 30 days. • Confirmed subscriber data is retained until you request deletion. • We archive rather than hard-delete records — except when we receive a verified erasure request under applicable law, in which case we delete personal data within 30 days and confirm in writing. • Anonymised or aggregated analytics data may be retained indefinitely.

Depending on where you live, you may have the right to:

• Access a copy of your personal data. • Correct inaccurate data. • Delete your data ("right to be forgotten"). • Receive your data in a portable format. • Object to or restrict certain processing. • Withdraw consent at any time (for consent-based processing).

To exercise any right, email privacy@zavit.ai with your request. We will respond within 30 days (or the statutory window in your jurisdiction). We may ask you to verify your identity before fulfilling the request.

ZavitSports uses two categories of cookies and local storage:

• Functional — language preference, theme preference, and session state. These are necessary for the app to work as you expect. • Analytics — PostHog sets a first-party cookie to count unique visitors and track feature usage. No cross-site tracking. You can opt out of analytics by emailing privacy@zavit.ai or using your browser's "Do Not Track" setting (which we honour).

We do not use advertising cookies or third-party tracking pixels.

ZavitSports is operated from the United States. If you are in the EEA or UK, your data may be transferred to and processed in the US by our processors. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved under applicable data-protection law.

ZavitSports is not directed at children. In the US, we do not knowingly collect data from users under 13. In the EEA and UK, we do not knowingly collect data from users under 16. If you believe we have collected data from a child, please contact us and we will delete it promptly.

If we make material changes, we will notify confirmed subscribers by email at least 14 days before the change takes effect, and update the effective date at the top of this page. Continued use of the service after the change constitutes acceptance.