Privacy Policy

1. Who we are

Magicano ("Magicano", "we", "us", "our") is a free PL match-prediction game available as a mobile application and at https://magicanopl.com.

Magicano is operated by Abdelrahman Elkaliby, an individual sole trader based in the Arab Republic of Egypt, operating under the name Magicano. We are the data controller for the personal data described in this policy.

For any privacy question, request or complaint, write to abdelrahman.elkaliby@gmail.com. We answer privacy requests within 30 days.

Magicano is an independent fan-made game. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to the PL, the Football Association PL Limited, Fantasy PL, any PL club, Apple Inc., or Google LLC. All club names, competition names and trademarks are the property of their respective owners and are used for identification purposes only.

2. What this policy covers

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to the Magicano mobile app (iOS and Android), the Magicano website, and the Magicano API.

It does not cover third-party services you reach from Magicano — for example our YouTube or Facebook pages, or an advertiser's website you open by tapping an ad. Those are governed by their own policies.

3. Information you give us

We collect only what the game needs to work:

• Account details — your name, username, email address and password. Passwords are stored only as a one-way cryptographic hash; we never store or see your plain-text password.
• Profile picture — optional. If you do not upload one, we show a placeholder.
• Verification codes — a temporary 4-digit code sent to your email to confirm your address or reset your password. It is stored hashed and expires after 15 minutes.
• Your predictions — the scorelines, goalscorers and assisters you pick for each fixture, and the points and cards they earn.
• Leagues — leagues you create or join, and their names and invite codes.
• League chat messages — anything you post in a private league chat is stored and shown to the other members of that league.
• Support messages — the content of any message you send us, and the email address you send it from.

4. Information collected automatically

We do not collect your precise location, your contacts, your photos (beyond the single avatar you choose to upload), your microphone or your camera.

We do not collect a phone number.

• Device and app information — device model, operating system, app version and platform (iOS/Android). We use the app version to enforce a minimum supported build.
• Log data — IP address, request time and endpoint, recorded by our server for security, abuse prevention and debugging.
• Push notification token — a Firebase Cloud Messaging token, so we can send you gameweek deadline reminders. You can turn notifications off at any time in your device settings.
• Advertising identifiers — collected by Google AdMob, not by us. See section 5.

5. Advertising

Magicano is free and is funded by advertising. We show banner and occasional full-screen (interstitial) ads through Google AdMob.

Google AdMob may collect and process your device's advertising identifier and related data to select and measure ads. This processing is carried out by Google as an independent controller under its own policies, not by us. You can read how Google uses this data at policies.google.com/technologies/partner-sites.

• On iOS, we ask for your permission before any tracking identifier is used. If you decline, you will still see ads, but they will not be personalised.
• In the EEA, the UK and Switzerland, a consent dialog is shown before personalised ads are served, and you can change your choice at any time.
• On Android, you can reset or delete your advertising ID from Settings › Google › Ads.
• We do not give advertisers your name, email address, predictions or chat messages.

6. What is visible to other users

Magicano is a competitive game, so parts of your account are public inside the app by design. Please read this section carefully before choosing a username or avatar.

• Your name, username, avatar and total points appear on the global leaderboard and in every league you join.
• Your gameweek points and the cards you have won appear on the Gameweek Winners board.
• Your predictions for a fixture become visible to other users after that fixture has kicked off. They are never visible before kickoff.
• Messages you post in a league chat are visible to every member of that league.

7. Why we use your data, and our legal basis

• To create and run your account, score your predictions and rank you — necessary to perform our contract with you.
• To verify your email address and let you recover your password — necessary to perform our contract with you, and required for security.
• To send gameweek deadline reminders — based on your consent, given when you allow notifications. You can withdraw it at any time.
• To show ads and measure them — based on your consent where consent is required, otherwise on our legitimate interest in funding a free service.
• To detect cheating, duplicate accounts, abuse and attacks — based on our legitimate interest in keeping the game fair and safe.
• To answer your support messages — necessary to perform our contract with you.
• To comply with a legal obligation, or to establish, exercise or defend a legal claim.

8. Who we share it with

We do not sell, rent or trade your personal data. We share it only with the service providers we need to run the game, and only to the extent they need it:

• Our hosting provider, which stores the database and files behind api.magicanopl.com.
• Google (Firebase Cloud Messaging) — to deliver push notifications to your device.
• Google (AdMob) — to serve and measure ads, as described in section 5.
• Our email provider — to send verification and password-reset emails.
• A competent authority, where we are legally required to disclose, or where disclosure is necessary to protect the rights, safety or property of Magicano or its users.

If Magicano is ever transferred to another owner, your data may be transferred with it. We will tell you before that happens and this policy will continue to apply until you are given a new one.

9. The Fantasy PL data we use

Fixtures, live scores, player lists and match statistics come from the publicly available Fantasy PL API. We only read from it. We never send your personal data, your predictions or any account information to the PL, to Fantasy PL, or to any club.

10. International transfers

Our service providers may process data on servers outside your country, including outside the Arab Republic of Egypt and outside the European Economic Area. Where that happens we rely on the recipient's own safeguards — for Google, its Standard Contractual Clauses and Data Processing Terms. You can ask us for details at any time.

11. How long we keep it

• Account data — for as long as your account exists.
• Predictions, points, league memberships and chat messages — for as long as your account exists, because they form the season's competitive record.
• Verification and password-reset codes — 15 minutes, then discarded.
• Server logs — a short rolling window for security and debugging, then overwritten.
• Support correspondence — up to 24 months, so we can follow up on repeat issues.

12. Deleting your account

You can delete your account permanently, at any time, from inside the app: More › Settings › Delete Account. You can also request deletion by emailing us from your registered address.

Deletion removes your account, profile, avatar, predictions, league memberships and chat messages. It cannot be undone. Aggregated, anonymous statistics that can no longer identify you (for example the total number of predictions made on a fixture) may remain. We may also keep the minimum records we are legally obliged to keep.

Full instructions, including the web request route, are at https://magicanopl.com/delete-account.

13. Your rights

Under the Egyptian Personal Data Protection Law (Law No. 151 of 2020) — and, if you are in the EEA or the UK, under the GDPR — you have the right to:

• know what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it, including objecting to processing based on legitimate interest;
• withdraw a consent you previously gave, at any time, without affecting what we did before you withdrew it;
• receive the data you gave us in a portable, machine-readable format;
• complain to your data protection authority. In Egypt this is the Personal Data Protection Centre; in the EEA/UK it is your national supervisory authority.

To use any of these rights, email abdelrahman.elkaliby@gmail.com from the address on your account. We will not charge you, and we will not treat you differently for asking.

14. Security

All traffic between the apps and our servers is encrypted in transit with HTTPS. Passwords are stored only as salted one-way hashes. Access to the production database is restricted to the operator. Authentication uses bearer tokens that are revoked on sign-out and on account deletion.

No online service can promise perfect security. If a breach ever affects your personal data, we will notify you and the competent authority as the law requires.

15. Children

Magicano is not intended for, and may not be used by, anyone under 16 years of age. We do not knowingly collect personal data from anyone under 16.

If you believe a child under 16 has given us personal data, email abdelrahman.elkaliby@gmail.com and we will delete the account and its data promptly.

16. Changes to this policy

We may update this policy as the app changes or the law changes. The date at the top always shows the current version. If a change materially affects your rights, we will tell you in the app or by email before it takes effect.

17. Contact us

Questions, requests or complaints about privacy: abdelrahman.elkaliby@gmail.com.

Operator: Abdelrahman Elkaliby, Arab Republic of Egypt.