Privacy Policy

This Privacy Policy applies to Nutmegly (说球哥, nutmegly.com), developed and operated by Enum-X Ltd.

1. Information We Collect

• Account information: email, password (stored as scrypt hash; the platform cannot view your plaintext password), optional display name, phone number, Google / Apple sign-in identifier.
• Usage records: teams you follow, matches you subscribe to, your Q&A interactions with the AI, archive, subscription and renewal records.
• Technical information: access IP (used for risk control and aggregate statistics, not permanently linked to personal identity), device / browser UA, cookies.
• App push identifiers: to deliver match alerts to you, we collect device push identifiers (JPush Registration ID / Firebase token), device model, OS version, language and time zone. This is collected only after you agree to this policy and sign in.
• Voice content (optional): when you use "hold to talk" in the app to send a voice message, we collect that recording and upload it for speech-to-text so the AI can respond. We never open the microphone in the background or when you are not actively recording, and we do not record ambient audio.
• Payment information: payment amount, order number, payment channel; payment credentials are handled directly by PayPal / Alipay / WeChat Pay / Apple In-App Purchase. The Service does NOT store credit card numbers, payment passwords, or card CVV codes.

2. How We Use This Information

• To provide subscription, AI commentary, Q&A and paid billing services
• To deliver match alerts and reports for the matches you follow
• To protect account security (anomaly login detection, credential-stuffing detection)
• To analyze overall usage patterns for product improvement (aggregated statistics, not individual targeting)
• To comply with applicable laws and regulations

3. Cookies & Session

The Service uses the following cookies:

• sa_session: session cookie, valid for 30 days, HttpOnly, used to maintain login state.
• sa_locale: language preference cookie, valid for 1 year, readable by frontend JavaScript, used to remember your Chinese / English language selection.
• sa_theme: theme preference (stored in localStorage rather than as a cookie), used to remember your dark / light mode selection.

The Service does NOT use any cross-site tracking cookies and does NOT participate in any advertising network. We use Umami (a privacy-respecting open-source analytics tool) for anonymous page-view statistics; we do not collect personally identifiable information for analytics purposes.

4. Data Storage & Security

• Data is stored on cloud servers we lease, using industry-standard security measures (TLS in transit, database access control, password hashing).
• Passwords are stored using scrypt hashing; platform staff cannot read your original passwords.
• The Service does not proactively sell or exchange your personal data with third parties. If data must be processed by a partner, this will be disclosed before sharing.

5. Third-Party Services & SDKs

• JPush (Aurora Mobile / Shenzhen Hexun Huagu Information Technology Co., Ltd.): used to deliver push notifications to devices in mainland China. To deliver pushes, its SDK collects device identifiers (such as OAID, Android ID, and on some systems IMEI), device model and network state. See the JPush Privacy Policy.
• Firebase Cloud Messaging (Google LLC): used to deliver push notifications to devices outside mainland China; collects the FCM token and basic device information. See the Firebase privacy notice.
• Sign in with Apple / Google OAuth: provide third-party sign-in in the app / on the site; we receive only the sign-in identifier and basic profile you authorize (such as email, name). Sign in with Apple supports hiding your real email; we do not access your contacts or email content.
• Speech-to-text service (an ASR model invoked via OpenRouter): only when you send a voice message, that recording is uploaded for transcription and is not used for any other purpose afterward.
• api-football: used to fetch publicly available match data; no user personal information is uploaded.
• PayPal / Alipay / WeChat Pay / Apple In-App Purchase: when processing payment orders, only the necessary amount and order number are transmitted; your email or password is not transmitted.
• LLM Services (OpenAI / Gemini-compatible API gateways): only factual evidence related to the specific match is transmitted when generating commentary and Q&A; your account information is not transmitted.
• Cloudflare: provides CDN and Tunnel for network requests; see Cloudflare's Privacy Policy for details.

6. App Permissions (Mobile Client)

• Notifications: used to push match alerts and reports for the matches you follow; you can turn this off anytime in system settings.
• Microphone: invoked only when you use "hold to talk" to send a voice message; we never record in the background or when you are not actively recording, and you can turn it off anytime in system settings.
• Network access: used to load fixtures, hold AI conversations, and receive push notifications.

We follow the principle of "minimum necessary" and do NOT request location, camera, photo library, contacts, or any permission unrelated to core functionality. Furthermore, before you read and agree to this Privacy Policy, the app does NOT initialize any third-party SDK that collects personal information (including the push SDKs above).

7. Your Rights

• Access and correct your account information: directly editable in Account Settings.
• Delete your account: request via email at [email protected]; typically processed within 7 days.
• Export your account data: request via the email above; we will provide JSON-formatted data within 30 days.
• For any questions or complaints regarding data usage, please contact us via the email above.

8. International Users

If you are located in the European Union, the United Kingdom, or California, you have rights under the GDPR / UK GDPR / CCPA — including access, deletion, restriction of processing, and data portability. You may exercise these rights through the email address listed in Section 7. We will respond within a reasonable time.

9. Policy Updates

When this policy undergoes material changes, the Service will publish a prominent notice on the site. Material changes will be announced at least 7 days before they take effect.

Last updated: 2026-06-09