Privacy Policy
1. Controller
The controller for the processing of data on this website and in the "What's the Score, Bro?" apps for iPhone and Apple Watch (App Store: "Soccer Referee Timer by WTSB") is:
Thilo Specht, Ginnheimer Straße 24, 60487 Frankfurt am Main, Germany, email: thilo@whatsthescorebro.com.
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Principles
The app is designed so that your match, fitness and health data is stored and processed only on your iPhone and Apple Watch. There is no user account, no tracking, no advertising, and we do not sell data. Data only leaves your device in the cases described below, mostly only when you actively use a feature.
3. Visiting this website
When you visit the website, our host Host-On (Frankfurt am Main, Germany) processes technically necessary data: IP address, date and time, requested page, amount of data transferred, browser and operating system. This is required to deliver the site and keep it secure. The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). Server log files are deleted after 14 days at the latest. A data processing agreement is in place with the host. The website sets no cookies and uses no analytics or tracking tools.
To display fonts, the website loads font files from Adobe Fonts (Adobe Inc., 345 Park Avenue, San Jose, CA 95110, USA; in Europe Adobe Systems Software Ireland Ltd.). Your browser transmits your IP address and technical information to Adobe, possibly also to the USA. According to Adobe, Adobe Fonts does not set cookies. The legal basis is our legitimate interest in a consistent presentation (Art. 6(1)(f) GDPR). Adobe is certified under the EU-US Data Privacy Framework. More at adobe.com/privacy/policies/adobe-fonts.html.
Links to the App Store and LinkedIn are plain links; data is only transferred when you click them, in which case the privacy policies of Apple or LinkedIn apply.
4. Data that stays on your device
- Match data (score, events, cards, times, notes, voice notes, line-ups, team names) is stored on your iPhone and Apple Watch and transferred directly between them via Apple's device connection, not via our servers.
- Location: During a match, the Apple Watch records your running track via GPS with your permission (running analysis, heatmap, sprints). The app also stores the address of the venue. This data stays on your devices except in the cases below.
- Apple Health: With your permission the app saves workouts to Apple Health and reads workout data (including heart rate, distance, pace, power, energy) and, on iOS 27 and later, your heart rate zones. Data from Apple Health is not used for advertising or marketing, not sold and not stored in iCloud; it only leaves the device as the summary described in 5.1 or when you upload a match to Strava yourself (5.6).
- Evaluations such as ratings, roles, venue names, country codes and daily temperatures are calculated and stored locally.
The legal basis for on-device processing is the use of the app (Art. 6(1)(b) GDPR); for health and location data your consent via the iOS permission prompts (Art. 6(1)(a), Art. 9(2)(a) GDPR), which you can withdraw at any time in iOS Settings or the Health app.
5. Data that leaves your device
5.1 AI analysis of your matches
When you open the AI analysis of a match, the app calculates a summary of your performance on your iPhone: ratings (work rate, explosiveness, stamina, overall), distance and pace per period, average heart rate per period, a comparison of both halves, your role (referee or assistant referee), match format, number of goals, cards, substitutions and interruptions, the temperature, your iPhone's language and the country of the venue as a country code (e.g. "DE"). This summary is sent via our server (Hetzner Online GmbH, data centre Nuremberg, Germany) to OpenAI (OpenAI Ireland Ltd., Dublin, or OpenAI, L.L.C., San Francisco, USA), which generates a short text via its application programming interface (API). Your name, team names, the exact venue, your GPS track and any user identifier are not transmitted. Our server does not store the request; the text is stored only on your iPhone. OpenAI does not use API requests to train its models and retains them for up to 30 days to detect abuse, after which they are deleted. Data is not passed on to any other third parties. Matches as an observer are not analysed.
The legal basis is your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), given by opening the analysis; you can withdraw it at any time for the future by no longer opening analyses. A data processing agreement is in place with OpenAI; any transfer to the USA is based on the EU Standard Contractual Clauses included in it (Art. 46(2)(c) GDPR).
5.2 Comparison values of all users, country ranking and top values
After a successful AI analysis, our server anonymously adds the four ratings of the match (numbers from 0 to 99) to totals: overall, per country and in a distribution (how many matches reached which overall value), to calculate averages and the thresholds for "Top 1%" and "Top 10%". Only counts and sums are stored – no individual matches, no identifier, no IP address, no timestamp. Only matches as referee with at least 40 minutes of playing time and an average of at least 50 metres per minute are counted; the demo match never. A country is only shown once at least 30 matches have been counted there; the server never returns smaller countries. The app retrieves the values about once a week. Because the stored values are anonymous, they cannot be attributed to a person or deleted afterwards. The legal basis for the transfer is the consent under 5.1.
5.3 Help chat
When you use the help chat in the app, your messages are sent together with the app version, language, App Store country and the displayed subscription prices via our server to OpenAI to generate an answer (retention at OpenAI as in 5.1). Please do not enter personal information in the chat. Legal basis: Art. 6(1)(b) GDPR; for transfers to the USA see 5.1.
5.4 Apple services: Maps, Weather, purchases
- Apple Maps: The app sends the venue's coordinates to Apple to determine the address and country, to suggest nearby sports grounds and to display maps.
- Apple Weather (WeatherKit): For the match temperature and the day's low and high, the app sends coordinates and the date to Apple.
- In-app purchases are handled exclusively by Apple; we receive no payment data.
No information about you or the match is transmitted. Apple's privacy policy applies (apple.com/legal/privacy). Legal basis: Art. 6(1)(b) GDPR.
5.5 Satellite image for share cards (Mapbox)
When you create a heatmap card for sharing, the app sends the map area (coordinates of a rectangle around the venue) via our server to Mapbox Inc., USA, to retrieve a satellite image, which is cached on your iPhone. Legal basis: Art. 6(1)(b) GDPR; Mapbox is certified under the EU-US Data Privacy Framework.
5.6 Strava (optional)
If you connect your Strava account, you sign in at Strava; a token is exchanged via our server and stored in the keychain on your iPhone. When you upload a match, the app sends a GPX file with your running track, timestamps and heart rate directly to Strava Inc., USA – only at your explicit request. Legal basis: your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), withdrawable by disconnecting in the app or at Strava. Strava's privacy policy applies to the data held by Strava.
5.7 Vouchers
When you redeem a voucher, the app sends a device-related identifier (Identifier for Vendor) to our server so that a voucher can only be used once per device. Legal basis: Art. 6(1)(b) GDPR. The identifier is stored together with the redeemed voucher and deleted after 24 months. The identifier is random, only valid for our app and is reassigned by iOS if you delete and reinstall the app.
5.8 Line-up links
When you open a line-up link, the app downloads the line-up from our server: only shirt numbers with team, captain and goalkeeper, and the match format – no names or other information about persons. Legal basis: Art. 6(1)(b) GDPR. Line-ups are deleted from the server once the link has expired, after one year at the latest.
5.9 Videos
Tutorial videos are embedded via YouTube in privacy-enhanced mode (youtube-nocookie.com). When you play a video, your device transmits data such as your IP address to Google Ireland Ltd. or Google LLC, USA. Legal basis: Art. 6(1)(a) GDPR by starting the video.
5.10 Crash and error reports (Sentry)
To fix crashes and errors, the app sends technical reports to Sentry (Functional Software Inc.), processed in the EU (Frankfurt am Main). Reports contain device model, system version, app version, time and the technical error trace, but no match, health or location data and no name. The legal basis is our legitimate interest in a stable app (Art. 6(1)(f) GDPR). Reports are deleted automatically after 90 days at the latest. A data processing agreement is in place with Sentry.
6. Recipients
Data is only received by the parties named above: Host-On and Hetzner as hosts, OpenAI and Sentry (each as processors), Adobe (website fonts), Apple, Mapbox, Strava (only at your request) and Google/YouTube (only when playing videos). Data is not passed on for other purposes or sold.
7. Retention
Data on your device remains until you delete it in the app or delete the app. On our servers, AI and help requests are not stored, log files are deleted after 14 days at the latest, line-ups after one year at the latest and voucher identifiers after 24 months; the anonymous totals are stored permanently (no personal reference). Server backups are deleted after 30 days at the latest. At OpenAI for up to 30 days, at Sentry for up to 90 days.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). As we store no data about you apart from the technical data mentioned above, we can usually only answer requests for that data. Contact us at support@simplescoreapp.com.
You also have the right to lodge a complaint with a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.
9. Voluntary provision, no automated decisions
Providing your data is voluntary. Without location or Health permission, only the respective evaluations are unavailable; without AI analysis, the text and comparison values are not available. There is no automated decision-making with legal effect (Art. 22 GDPR); the app's ratings are assessments for your own information.
10. Children
The app is intended for referees. Persons under 16 should only use the AI analysis with parental consent.
11. Security and changes
All connections to our servers are encrypted (HTTPS). We update this policy when the app or the legal situation changes. Last updated: 11 November 2026.