In one paragraph. Novaku is a Spanish independent developer. We collect the minimum data required to run our apps and never sell it. For Fan Mosaic — which displays your photo in your team's public mosaic — your explicit consent is the legal basis (GDPR Art. 6(1)(a)). Your photo is reviewed by a human moderator over Telegram before publication; by submitting, you consent to that international transfer under GDPR Art. 49(1)(a). We may also publish the rendered mosaic on our official social media accounts (Instagram and TikTok, both @novakuapp) for promotional purposes — see §B.9 for scope, opt-out and your rights. We do not use facial recognition or any automated decision-making. You can delete your account from inside the app at any time.
v3.0.0 transition notice. This English version reflects v3.0.0 (social media distribution scope added on 31 May 2026). Spanish, French, German, Portuguese and Arabic translations are still at v2.0.0 and will be updated within 14 days. For the specific provisions added in v3.0.0 (§4.6, §5.3 and §B.9), the English text prevails over any other language version until that language version reaches v3.0.0. This temporary override is limited to those three sections; for all other content, the prevailing-language rule in the footer continues to apply.
1. Data Controller
Novaku (the "Controller", "we", "us", "our") operates a suite of mobile applications under the NOVAKU brand, including NOVAKU: History and Fan Mosaic. We are the Data Controller of personal data collected through our applications under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Controller: Novaku — independent developer established in Spain.
Contact for privacy matters: novakuapp@gmail.com
Data Protection Officer: Not appointed. Under GDPR Art. 37 we are not required to designate a DPO — we do not process Special Category data (Art. 9) and our processing is not large-scale systematic monitoring.
EU representative (Art. 27): Not applicable. The Controller is established in the European Union.
This Privacy Policy applies to all NOVAKU apps. Common sections (§1–§16) apply to every app. App-specific details are in Section A (NOVAKU: History) and Section B (Fan Mosaic).
2. Categories of Personal Data
We collect the categories below. "Optional" means you can use the apps without providing it; "required" means the feature cannot work without it.
| Category | Source | Required / Optional |
|---|---|---|
| Email address | Google Sign-In | Required for sign-in |
| Display name (Google profile name) | Google Sign-In | Optional |
| Avatar URL | Google Sign-In | Optional |
| Unique user ID | Supabase Auth | Required for sign-in |
| Selected team + your custom display name | You | Required (Fan Mosaic) |
| Photograph (selfie or chosen image) | You | Required (Fan Mosaic only) |
| Submission timestamp + approval status | Generated server-side | Automatic |
| Proof-of-consent record (timestamp + version + hash + locale) | App, on Privacy screen accept | Required (GDPR Art. 7.1) |
| Android Advertising ID (AAID) | Device | Required for free-tier ads |
| Crash + diagnostic events | Sentry SDK | Automatic |
| Purchase receipts (Pro subscribers) | Google Play Billing → RevenueCat | Optional |
We do not collect: location, contacts, microphone, browsing history, biometric templates, or any Special Category data (GDPR Art. 9).
3. Purposes and Legal Basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create + maintain your account | Email, user ID, display name, avatar | Art. 6(1)(b) — contract |
| Display your photo in the public mosaic | Photo, team, name | Art. 6(1)(a) — explicit consent |
| Human moderation of submitted photos | Photo + signed URL | Art. 6(1)(a) + Art. 6(1)(f) legitimate interest (community safety) |
| International transfer to Telegram FZ-LLC (UAE) for moderation | Photo (signed URL, 120s TTL) | Art. 49(1)(a) — explicit consent to the transfer |
| Validate Pro subscription entitlement | Purchase receipt, user ID | Art. 6(1)(b) — contract |
| Show personalised or non-personalised ads (free tier) | AAID | Art. 6(1)(a) — consent gathered via Google UMP |
| Detect crashes + fix bugs | Stack traces, breadcrumbs, device model, OS version | Art. 6(1)(f) — legitimate interest in service stability |
| Defend against fraud / abuse / TOS violation | As relevant | Art. 6(1)(f) — legitimate interest |
| Comply with legal obligations (court orders, AEPD requests) | As required | Art. 6(1)(c) |
4. Recipients (Processors and Other Controllers)
We share data only with the processors below. Each is bound by a Data Processing Agreement aligned with GDPR Art. 28.
| Recipient | Role | Country | Privacy policy |
|---|---|---|---|
| Supabase Inc. | Backend (Postgres + Storage + Edge Functions) | EU (Frankfurt, eu-central-1) | link |
| Google Ireland Ltd. | Sign-in (auth) + AdMob ad serving | EU + global | link |
| RevenueCat Inc. | Pro subscription validation | USA | link |
| Functional Software Inc. (Sentry) | Crash + performance telemetry | USA | link |
| Telegram FZ-LLC | Private moderation channel (signed-URL preview only) | UAE | link |
For ad personalisation, Google Ireland Ltd. acts as an independent controller on the data it collects via the AdMob SDK — see Google's own policy. We do not sell personal data to anyone.
4.6 Social media platforms (independent / joint controllers)
For promotional purposes, we publish selected visual content generated by the Service — country flag mosaics composed of user-submitted photos (per §B.3), milestone announcements, matchday cards and other aggregated content — together with captions, to our official social media accounts. Each platform processes the published content under its own privacy policy:
| Platform | EEA legal entity | Registered address | Our account | Privacy policy |
|---|---|---|---|---|
| Meta Platforms Ireland Limited | 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | @novakuapp |
link | |
| TikTok | TikTok Technology Limited (joint with TikTok Information Technologies UK Limited) | 10 Earlsfort Terrace, Dublin, D02 T380, Ireland | @novakuapp |
link |
The relationship with each platform is as follows:
- For posts we publish on our own account — the platform acts as an independent controller for the content once it is on the platform (display in user feeds, recommendation systems, on-platform analytics, etc.). We remain the controller for the decision to publish and for the content selection.
- For "Page Insights" or business-account engagement metrics aggregated by Meta about our Instagram account — Meta and Novaku are joint controllers under GDPR Art. 26, governed by Meta's Page Controller Addendum which auto-applies to business pages.
We do not transmit personally identifying metadata (your account name, email, user ID, IP address, location) alongside the visual content. Your photo may, however, be visually recognisable within the rendered mosaic.
5. International Transfers
5.1 Transfers covered by adequacy / DPF
Transfers to Google, RevenueCat and Sentry (USA) are protected by the EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023) and complemented by the EU Standard Contractual Clauses (SCCs) 2021/914 for any data falling outside DPF scope.
5.2 Transfer to Telegram FZ-LLC (UAE) — explicit consent (Art. 49)
The UAE has no EU adequacy decision and Telegram has not signed the EU SCCs with us. Therefore, any transfer of your photograph to Telegram for moderation relies on GDPR Art. 49(1)(a) — explicit consent, which you provide on the Fan Mosaic privacy screen before any photo is uploaded. We make the following disclosures so your consent is informed:
- The recipient is Telegram FZ-LLC, established in Dubai, United Arab Emirates.
- UAE law may grant local authorities access rights broader than the EU's, without equivalent judicial redress in some scenarios.
- What we transfer: a single signed URL (120 seconds TTL) pointing to your photo. The link expires automatically and is not embedded or re-shared.
- What we do not transfer: your email, real name, team selection, or any other personal data.
- You can withdraw consent at any time by deleting your account; future submissions will be impossible without this consent.
5.3 Transfers via social media platforms
Although the EEA controller for Instagram (Meta Platforms Ireland Limited) and TikTok (TikTok Technology Limited) are both Irish entities, content we publish to those platforms is replicated to their global infrastructure, including locations outside the EEA. The platforms describe these transfers in their own policies; for transparency we summarise the position below:
- Instagram (Meta). Meta operates a global infrastructure with primary hubs in the EU (Ireland, Sweden, Denmark), the United States and Asia. Transfers from the EU are protected by the EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023) for US transfers, and by the EU Standard Contractual Clauses (SCCs) 2021/914 for any other transfers.
- TikTok. TikTok's privacy policy (as of 2026) states that EEA user data is stored "in servers located in the United States, Malaysia and Singapore" and that TikTok relies on a combination of adequacy decisions, SCCs and GDPR Art. 49 derogations to lawfully transfer data outside the EEA. TikTok has also announced "Project Clover", a European data-localisation initiative with data centres in Norway, Ireland and (under construction) Finland.
Material transparency disclosure. On 2 May 2025 the Irish Data Protection Commission fined TikTok €530 million for failing to adequately protect EEA user data from access by personnel in the People's Republic of China (Decision IN-21-9-1). TikTok has stated it disagrees with the decision and is appealing. We mention this here so that, before consenting to social media distribution under §B.9, you can make an informed choice taking into account this regulatory finding. You may opt out of social media inclusion specifically (see §B.9.5) while remaining a participant in the in-app mosaic.
By accepting this Privacy Policy at v3.0.0, you acknowledge these transfers occur for content you have previously consented to make public via §B.3, and to publish externally via §B.9.
6. Retention Periods
| Data | Retention | Rationale |
|---|---|---|
Account row (wc_fans) + auth | Lifetime of the account, deleted within 30 days of a deletion request | Service delivery + Art. 17 erasure |
| Photograph (storage) | Immediately on account deletion | Art. 17 |
| Composite mosaic images already rendered | Until next 02:00 UTC regeneration cycle (≤ 24 h) | Technical: pre-rendered JPEGs cannot be retroactively edited |
| Telegram moderation message preview | Persists in the private moderation channel until manually purged (max 90 days) | Audit trail for rejected content |
Proof-of-consent record (privacy_* columns) | 6 years after account deletion | Spanish civil claim limitation (5 y, Art. 1964 CC) + 1 y buffer |
| Sentry crash events | 90 days | Bug-fix horizon; Sentry default |
| RevenueCat purchase receipts | 10 years (tax / accounting law) | LGT 58/2003 + Royal Decree 1619/2012 |
| AdMob AAID linkage | Until you reset AAID in Android settings or revoke consent in Privacy options | Google's own policy |
7. Your Rights
Under GDPR Arts. 15–22 + LOPDGDD you may exercise the following rights free of charge:
- Access (Art. 15) — request a copy of your data.
- Rectification (Art. 16) — fix inaccurate or incomplete data.
- Erasure (Art. 17) — delete your account directly from Profile → Delete Account, or email us.
- Restriction (Art. 18) — temporarily freeze processing while a complaint is reviewed.
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interest (Sentry, fraud prevention).
- Withdraw consent (Art. 7(3)) — at any time, without affecting prior lawful processing.
- No automated decision-making (Art. 22) — we do not make automated decisions with legal or similarly significant effects.
To exercise any right, email novakuapp@gmail.com. We respond within 30 days (extendable by 60 days for complex requests, Art. 12(3)).
8. Right to Lodge a Complaint with a Supervisory Authority
If you believe your data has been processed unlawfully you may file a complaint with:
- Spain — Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — aepd.es.
- Or the supervisory authority of your EU/EEA country of residence.
9. Automated Decision-Making and Profiling
We do not use automated decision-making with legal or similarly significant effects (GDPR Art. 22). Photo moderation is performed by human reviewers; no algorithm rejects or approves photographs.
We do not perform facial recognition, biometric matching, or any unique identification of natural persons via your photo (per Recital 51 GDPR and EDPB Guidelines 3/2019 + 05/2022: an ordinary photograph is not biometric data unless processed for the specific purpose of unique identification, which we do not).
10. Source of Data
All personal data we hold about you is provided by you (account creation, photo submission, choice of team and name) or generated as a side effect of you using the service (timestamps, status flags, crash reports). We do not buy or enrich your data from third-party brokers.
11. Is Providing Data a Statutory or Contractual Obligation?
Providing personal data is voluntary — you can choose not to install or sign in. However, certain features (publishing a photo, restoring a Pro subscription) require the relevant data to function; refusal means the feature is unavailable.
12. Children and Minimum Age
Fan Mosaic requires users to be at least 16 years old in line with GDPR Art. 8 and Spanish LOPDGDD Art. 7.1 (which lowers the age to 14 inside Spain but we apply the stricter 16-year standard across our user base). NOVAKU: History is suitable for users aged 13+. If you believe a minor has submitted data without parental consent, contact us and we will act within 7 days.
13. Security Measures
- Transport: TLS 1.2+ for all client-server traffic.
- Storage: AES-256 at rest (Supabase Storage + Postgres).
- Authentication: Google OAuth 2.0 + Supabase JWTs with rotating refresh tokens.
- Access control: Row-Level Security (RLS) on every table; the client cannot read or modify other users' rows.
- Server-side immutability of consent record: the four
privacy_*columns are protected by a database trigger that rejects any attempt to overwrite a stamped value. - Moderation surface: moderators see only a 120-second signed URL — no email, no full name, no IP.
- Logging: all destructive endpoints (delete-account, photo replacement) are audit-logged server-side.
14. Cookies and On-Device Storage
Our apps do not use HTTP cookies (no web context). On-device, we use:
- Android Keystore + flutter_secure_storage for sensitive identifiers (user ID, email, Pro entitlement cache).
- SharedPreferences for non-sensitive UI state and the pre-auth consent record awaiting sync.
- Google AdMob + UMP SDKs, which store consent tokens locally to suppress re-prompts on every launch.
- Sentry SDK, which buffers crash events offline until the next online session.
15. Changes to This Policy
This policy is versioned using semantic versioning (MAJOR.MINOR.PATCH) with a date. The current version is shown at the top.
- MAJOR bumps (e.g. 2.0.0 → 3.0.0) reflect material changes (new processor, new purpose, change of legal basis). We will surface an in-app re-consent dialog before the change takes effect for existing users.
- MINOR bumps (e.g. 2.0.0 → 2.1.0) add clarifications without changing scope. We notify within the app and via a banner on this page.
- PATCH bumps (e.g. 2.0.0 → 2.0.1) are typographical or formatting only.
Past versions are archived at /v/{version}/privacy-policy-en.html so you can audit any version you previously accepted.
15.1 Version history
| Version | Effective | Type | Summary |
|---|---|---|---|
| v3.0.0 | 31 May 2026 | MAJOR | Added §4.6 (Instagram + TikTok as recipients), §5.3 (transfers via social media platforms incl. transparency disclosure on the May 2025 Irish DPC TikTok decision), and §B.9 (public distribution on social media — scope, frequency, legitimate interest 3-part test per EDPB 1/2024, opt-out, re-consent flow). Triggers in-app re-consent for existing users. |
| v2.0.0 | 26 May 2026 | MAJOR | Initial Fan Mosaic hardening — Section B, Art. 49(1)(a) consent for Telegram moderation, proof-of-consent columns, SHA-256 hash sealing. |
16. Contact
Novaku
Privacy contact: novakuapp@gmail.com · Subject prefix: "Privacy"
Response window: 30 days (extendable to 90 for complex requests, GDPR Art. 12(3)).
Section A. NOVAKU: History
The following details supplement the common sections above for the History app.
A.1 Additional data collected
- Quiz scores, attempts, incorrect answers per lesson.
- XP and study streak (consecutive days).
- Lessons completed, badges, achievements.
A.2 Permissions requested
Only INTERNET + the Google Play AdMob runtime permission. No camera, microphone, location, or contacts.
A.3 Deletion
Profile → Reset progress clears the local device. Cloud data is removed via the deletion guide.
Section B. Fan Mosaic
B.1 Why Fan Mosaic has extra privacy considerations
Fan Mosaic publishes your photograph in your team's public mosaic. A photograph of an identifiable person is personal data under GDPR. It is NOT biometric data in our context — we do not perform any "specific technical processing" for unique identification (Recital 51 + EDPB 3/2019), so no Art. 9 special-category regime applies. The legal basis is your explicit consent under Art. 6(1)(a), recorded on the privacy screen.
B.2 Additional data collected
- The photograph itself (stored in Supabase Storage, Frankfurt).
- The team you chose + your custom display name.
- Approval status (
pending,approved,rejected) and rejection reason if any. - Submission timestamp + first approval timestamp (for sports-fair tiebreaker in ranking).
- Proof-of-consent (Art. 7.1): the four
privacy_*columns described below.
B.3 Public visibility
Once approved, your photo is part of a publicly visible mosaic inside the app and may appear in any screenshot or share generated by any user. By accepting the privacy screen you acknowledge this public visibility.
B.4 Photo moderation (Telegram, UAE)
Before publication, every photo is reviewed by a human moderator over a private Telegram channel operated by Novaku.
- The moderator receives only a 120-second signed URL — not the file itself.
- The moderator sees no account-identifying data alongside the photo.
- Telegram is operated by Telegram FZ-LLC, Dubai, United Arab Emirates. The transfer relies on GDPR Art. 49(1)(a) — explicit consent — described in §5.2 above.
- The moderation message persists in the private channel for at most 90 days, after which it is purged.
B.5 Proof of consent — the four privacy_* columns
When you accept the privacy screen, your client stamps the following onto your wc_fans row at first sign-in. These columns are immutable by database trigger and constitute our Art. 7.1 evidence that you consented.
privacy_accepted_at— UTC timestamp of acceptance.privacy_policy_version— the semantic version of this document.privacy_policy_hash— SHA-256 of the canonical English text shown.privacy_consent_locale— the language you actually read (en, es, fr, de, pt, ar).
B.6 Permissions requested
INTERNET— always.CAMERA— only when you tap "Take photo".READ_MEDIA_IMAGES(Android 13+) /READ_EXTERNAL_STORAGE— only when you tap "Choose from gallery".com.google.android.gms.permission.AD_ID— auto-granted, required by AdMob ≥ 21.
B.7 Ads (AdMob + UMP)
The free tier displays Google AdMob ads. On first launch in the EEA/UK/CH, the Google User Messaging Platform (UMP) shows you a consent dialog that lets you choose between personalised and non-personalised ads. You can re-open this dialog at any time from Profile → Privacy options. If you upgrade to Pro, no ads are shown.
B.8 Mosaic regeneration after deletion
When you delete your account, your photo is removed from storage immediately. However, composite mosaic JPEGs already rendered cannot be retroactively edited; they are replaced at the next 02:00 UTC daily regeneration. Within 24 hours of deletion your photo no longer appears in any new mosaic.
B.9 Public distribution on social media (Instagram & TikTok)
Beyond the in-app public visibility of your photo as part of the mosaic (§B.3), we publish rendered mosaic content and related promotional materials on our official social media accounts — Instagram and TikTok, both @novakuapp. The processing is detailed below.
B.9.1 What we publish
- Rendered country flag mosaics — your photo may appear as one tile within a mosaic.
- Milestone announcement cards (e.g., "Spain just completed its mosaic — 100 real fans").
- Matchday preview cards listing two competing countries with their aggregate fan counts.
- Country leaderboards and other aggregate-data promotional images.
- Accompanying captions and hashtags — these do not include your account name, real name, email or any other personal identifier we hold about you.
We do not publish: individual user photos as standalone posts, your name, your account, your email, your IP, your location, or any other personal identifier outside the visual mosaic context.
B.9.2 Frequency
Automated daily posts orchestrated by our publishing system, typically 1 to 3 posts per day during active tournament windows (e.g., the FIFA World Cup 2026, 11 June – 19 July 2026) and lower cadence outside tournament windows. All posts are scheduled and reviewed by a human before publication.
B.9.3 Legal basis & balancing test (Art. 6(1)(f) + EDPB Guidelines 1/2024)
Our legal basis is legitimate interest pursuant to GDPR Article 6(1)(f), assessed against the three-part test reaffirmed by the EDPB Guidelines 1/2024:
- Purpose test. Promotion of the Service and engagement with the football fan community is a clearly identified, lawful and present commercial interest of Novaku as an independent developer.
- Necessity test. Publication of the rendered mosaic is necessary to demonstrate the social proof element of the product ("a flag built from real fans"). A redacted or synthetic alternative would fail to communicate the product value proposition and would mislead potential users.
- Balancing test. We weigh our interest against your rights and reasonable expectations:
- You have already given explicit consent (Art. 6(1)(a)) to the photo being a publicly visible component of the mosaic inside the app (§B.3) — your reasonable expectation already includes public visibility.
- We transmit no personally identifying metadata alongside the visual content (no name, email, account, IP).
- You retain an unconditional right to object (Art. 21) that we honour without requiring you to leave the in-app mosaic (see §B.9.5).
- The impact on you is limited to additional channels of distribution of content you already consented to publish.
B.9.4 Withdrawing your photo from the mosaic
If you delete your photo via the Service (Profile → Delete Account, see §7), your photo will be removed from the in-app mosaic and excluded from all future social media publications within the next regeneration cycle.
Past posts cannot be retracted by us. Once a mosaic image has been published to Instagram or TikTok, those platforms process it as independent controllers and we have no technical ability to unilaterally remove the post in a way that retroactively removes your specific tile from a composite image already in circulation. We commit to the following on takedown requests:
- We will delete or hide the entire social media post containing your photo within 7 days of receiving a written takedown request at novakuapp@gmail.com.
- We will forward your request to the relevant platform's privacy team where applicable and provide you with reference numbers.
- Once deleted by us, the platform may still retain a copy in backups for a limited period (typically 30–90 days) per its own policies. The post will no longer be visible to the public.
B.9.5 Right to object — opt-out specifically from social media
You have an absolute right to object (Art. 21 GDPR) to your photo being included in social media publications, even while remaining a participant in the in-app mosaic. To exercise this right:
- Email novakuapp@gmail.com with subject prefix "Social opt-out" and your registered email address.
- We will set an
excluded_from_socialflag on yourwc_fansrow within 7 days. From that moment your photo is excluded from all future renders intended for social media distribution; your photo remains in the in-app mosaic. - We will confirm in writing within the same 7-day window.
- You may reverse this at any time by writing again.
Exercising this opt-out does not require you to delete your account or leave the in-app mosaic, and incurs no consequence on your access to the Service.
B.9.6 Re-consent for v3.0.0
v3.0.0 introduces social media distribution as a new processing scope not contemplated by v2.0.0. All users who accepted v2.0.0 will be presented with an in-app re-consent dialog on next launch. You have three options:
- Accept v3.0.0 — your participation continues with social media distribution included.
- Accept v3.0.0 with social opt-out — your participation continues without your photo being used in social media publications (§B.9.5 flag is set automatically).
- Decline v3.0.0 — your account remains valid but your photo is removed from the next mosaic regeneration (effectively the same as §7 erasure for the photo). Other data is retained under the v2.0.0 terms you previously accepted.
Your choice is recorded in an immutable database column (privacy_v3_choice) alongside the existing privacy_* proof-of-consent columns described in §B.5.