Privacy Policy
1. Who we are and how to reach us
Youssef Serraj, an individual resident in Morocco, runs I Told You So ("ITYS", "we", "us") and is the controller responsible for the personal data described in this Policy. Privacy contact: support@itys.club.
This Policy covers the ITYS app on every device and the website itys.club. It tells you what we collect, why, who receives it, how long we keep it, and your rights. Read it with the Terms of Use at itys.club/terms.
We have not appointed a data protection officer, because the law does not require one for ITYS today. The person accountable for this Policy, to whom you may send any complaint or question, including as the contact (encarregado) for members in Brazil and the accountable person for members in Canada, is Youssef Serraj at support@itys.club.
2. ITYS in short
ITYS is a free social prediction game for adults. We collect what the game needs to run and keep your picks sealed until their questions close. Your Squad chats and your messages with friends stay with the people in them; Arena posts, your profile photo and the boards are visible more widely, as "Who sees what" explains. We make no sale of your personal data, show no advertising, and do not track you across other companies’ apps or websites. Usage statistics and crash reports from your phone stay off until you turn them on, and no picture you add goes to our screening service until you allow it.
3. What we collect
Account and sign-in. What we hold depends on how you opened your account. With Apple or Google, we read your email address in the sign-in token to check that the provider verified it. We do not keep the address. Your account is keyed on a one-way code made from the provider’s identifier for you. Beside it we keep a one-way keyed code of the address, so that signing in another way (the other provider, or a password) finds this same account. That code is deleted with your account. We use the address twice: once to confirm your account was created, and once to confirm it was deleted. Each time it leaves our systems as soon as the message is sent, or given up on after its retries. Backups never hold it. For the deletion message, the address from your last sign-in waits in the server’s memory for at most six minutes and is never stored. If you hide your address with Apple, the message goes to Apple’s relay address.
With an email address and a password, the address is kept for as long as the account exists, because it is how you sign in and the only way to recover the account. It is looked up by a one-way keyed code and kept as you wrote it, and deleted when you delete your account. We use it to confirm the address is yours, to send a reset link when you ask for one, to send the same two messages about your account, and to tell you when your password changes. Your password is never stored in any form it could be read back from: we keep an Argon2id hash. We also keep your sessions, the record of the Terms and Privacy versions you accepted with your confirmation of age and the time, your choice on the picture safety check with the version of its wording and the time, and your member number.
Profile. The display name and username you choose, an optional profile photo, an optional bio of one line, your language and your time zone.
Country. A two-letter country places you in your part of the world on the Region board that earlier versions of the app show. With your permission, the app reads your device’s approximate position and asks your phone’s own location service (Apple’s on an iPhone, Google’s on Android) to turn it into a two-letter country; only that country reaches our server, which never receives or stores coordinates. Without permission, the app uses the country your time zone names, and failing that the region in your phone’s language and format settings. While your account holds no country, the server places you by your stored time zone each time a board is read and stores nothing more.
The game and the people you play with. Your picks and their receipts, your Squad votes, point totals, settlements and corrections, board participation, badges, the sports and competitions you follow, friends and friend requests, Squads and invitations, blocks, and your likes, upvotes, posts and replies in Arenas.
What you send. Messages, pictures, voice notes and polls in a Squad chat; messages, pictures and voice notes between friends; comments and reactions on activity cards; and the files a Squad chat accepted before 4 October 2026. When you edit a message, we keep each earlier version with the message for moderation; only a moderator reads them, through a report. Every picture leaves your phone re-encoded, with its location and other metadata removed, and the app opens your camera or photo library only after you allow it in the request your phone shows.
Reading and typing in chats. While a Squad chat or a conversation with a friend is open on your screen with its newest message in view, the app tells our server the newest message you have had on screen. The server keeps that reading position, one per Squad or conversation, with the time it last moved, to show the author who has seen a message and to let the next notification reach you once you have caught up. While you type, the server holds that signal in memory for six seconds so the people with the chat open see you typing; it is never stored. Neither appears in analytics, a notification, the activity feed or a log line tied to you.
Notifications. Your phone’s push address (stored hashed and encrypted), your notification choices, and the record of each notification’s delivery.
Support, safety and leaving. Messages you send us from Settings, Help or by email, reports you file and reports about you, moderation decisions, suspensions and appeals, account-deletion requests and the optional answer to the question we ask when you leave.
Device, security and network. An installation identifier your phone sends with every sign-in and session request, which our database keeps only as a one-way hash; your IP address, which our server reads to limit abusive request rates and never stores in full; and the version and platform of the app, which it sends with each request so the server can tell an out-of-date version to update. Our proxy writes a line for each request with your network’s address cut to its first part (the first three of four numbers, or the first 48 bits for IPv6), never your full IP address; the address requested; the request’s identifier; the user agent, which names the app and the device type; the app’s version and platform; and, on sign-in and session requests, the installation identifier. Each service keeps at most 50 MB of these lines, the oldest overwritten first.
Usage statistics, only if you turn them on. The screens you open and for how long, and the features you use (a pick confirmed, a vote cast, an invitation shared, and, once subscriptions exist, a trial or a subscription started), with the sport and never what you picked, tied to your account identifier (before you sign in, to a random identifier for the installation), with the app’s version, your phone’s platform and a few facts about your account’s setup: how you signed up, how you first arrived, and whether you are in a Squad. They are off until you say yes to the question at first launch or turn on Settings, Privacy, "Share usage statistics".
Crash reports, only if you turn them on. When the app breaks, a report of the error with your account identifier, the screen’s route, the app’s version and your phone’s platform and system version, and performance timings from about one session in ten, never your picks, messages or contact details. When notifications cannot be set up on a phone, the report says why (the permission or the step that failed) without the push address. Crash reports are off until you turn on Settings, Privacy, "Send crash reports". Separately, our server reports its own errors to Sentry whatever you choose on your phone: those reports carry the route, the status and the error, with email addresses, IP addresses, tokens and long identifiers removed.
What we do not collect. Your precise location, contacts, health data, browsing history, advertising identifiers or payment card details. We collect no biometric data: if you lock ITYS with Face ID or Touch ID, your phone checks it and ITYS never receives it. When the app asks Apple whether you are 18 or over, an answer that you are under 18 is sent to our server, which closes the account; any other answer stays in memory on your phone. We never receive or store your age range.
4. What you must give us, and what is optional
To open an account you must sign in with Apple, Google or an email address and a password, choose a display name and a username, and confirm your age and accept the Terms and this Policy. Without these we cannot open an account for you. Everything else is optional: a photo, a bio, your country, the people you add, what you post, notifications, usage statistics and crash reports. Turning an optional item off never closes the game to you, except that without your permission for picture screening you cannot add pictures.
5. Why we use your data, and our legal bases
We use each kind of data only for the purposes below. The legal bases are those of the GDPR and the UK GDPR; Morocco’s Law 09-08, Brazil’s LGPD and the other laws that apply to ITYS recognise the same bases.
Running your account and the game (sign-in, profile, picks and receipts, points, boards, Squads, chats, messages between friends, Arenas, the notifications you choose, the data download): necessary to perform our contract with you (GDPR Article 6(1)(b)).
Placing you on the Personal board by default and showing your country’s part of the world: necessary to run the game you joined (Article 6(1)(b)) and our legitimate interest in boards that mean something; you can leave the board in Settings, Privacy at any time.
Keeping members safe: reports, moderation records, the copy a report keeps, blocks, rate limits and the suspension ladder. Basis: our legitimate interests (Article 6(1)(f)) in protecting members from abuse and illegal content and keeping ITYS within the law and app store rules.
Screening every picture you add with OpenAI’s moderation service: your consent (Article 6(1)(a)), which you give in the "Picture safety check" before your first picture, and which also covers sending the picture to OpenAI in the United States. You can withdraw it at any time in Settings, Privacy; you then cannot add pictures. The app asks for it only while the screening service is switched on on our server.
Keeping the game honest after you leave: keeping settled picks and points under a de-identified label, one account per address, the hashed installation identifier and the hashed address that links your sign-in methods. Basis: our legitimate interest, and other members’, in accurate results and boards that cannot be gamed (Article 6(1)(f)).
Security and reliability: logs, rate limits, session controls, the breached-password check and the error reports our server sends to Sentry. Basis: our legitimate interest in protecting accounts and keeping the service working (Article 6(1)(f)).
Measuring how ITYS is used without usage statistics: counting which competitions members follow (shown without names or numbers), counting active Squads from the record that a member looked at their Squad’s day, month or board (kept 8 days and shown to nobody), notification delivery counts, and, to count in totals how members arrive and come back, for each account when it joined its first Squad and how (by an invitation link, a code, the Squad directory or by creating it; never who invited it), when it first made a pick and a Squad vote, in which of its first thirty days it played, and, for each of its Squad votes, when it first opened its Squad after the call was settled (shown to nobody, deleted with the account). Basis: our legitimate interest in improving the game (Article 6(1)(f)).
Usage statistics and crash reports from your phone: your consent (Article 6(1)(a)), which also covers reading and storing identifiers on your device. Location: your consent, given in your phone’s permission request.
Account emails (account created, address confirmation, password reset, password changed, account deleted): necessary for the contract (Article 6(1)(b)) and, for the security messages, our legitimate interest in warning you of changes you did not make (Article 6(1)(f)).
Complying with the law and defending claims: answering lawful requests from authorities, notifying threats to life or safety, reporting child sexual abuse material and preserving it, keeping the record that you accepted the Terms, and, once subscriptions exist, tax and consumer-law records. Basis: legal obligations (Article 6(1)(c)) and our legitimate interest in establishing or defending legal claims (Article 6(1)(f)).
We do not use your data for any purpose incompatible with these, and we ask your consent before any new purpose that needs it.
6. Your right to object
Where we rely on our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. Write to support@itys.club or use Settings, Help. We then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. Some objections are one tap away: leave the Personal board in Settings, Privacy; block a member; or delete your account. In Morocco, Law 09-08 gives you the same right to object for legitimate reasons.
7. Consent, and how to withdraw it
Withdrawing consent is as easy as giving it and does not affect what was done before. Usage statistics: Settings, Privacy, "Share usage statistics". Crash reports: Settings, Privacy, "Send crash reports". Picture screening: Settings, Privacy, "Picture safety check". Location: your phone’s settings for ITYS. Camera and photo library: your phone’s settings. Push notifications: your phone’s settings, or the categories in Settings, Notification preferences.
8. Automated tools
Two kinds of automated processing touch your data. OpenAI’s moderation service scores each picture you add, and a flagged picture is refused or held as the Terms of Use describe in "How we moderate". Rate limits refuse requests that come too fast. On an iPhone where Apple shares an age answer, an answer that you are under 18 closes your account automatically, because ITYS cannot hold a contract with a minor; if you think it is wrong, write to support@itys.club and a person reviews it. Apart from that, no account is suspended or closed by an automated tool, and a person reviews every held profile photo and decides every report. The "Hide offensive language" filter runs on your device alone and tells us nothing. We do not profile you for advertising or for any decision about you.
9. Who sees what
Other members. Your display name, username, photo and badges are visible to members who meet you in the app. Your profile, with your bio, opens for your accepted friends and for any member your choice in Settings, Discoverability lets find you by username, and never for an account on either side of a block. Your bio stays off boards, Squad tables, activity cards, chats, notifications and shared images.
Picks and votes. Your open picks stay sealed until their questions close. The members of a Squad see the votes you cast in it as you cast them. A post you write in a match Arena shows your confirmed Markets pick on that match, with the question’s number, to every member. A post in an Arena is readable by every signed-in member.
Boards. On the Personal board, every signed-in member sees your display name, username, photo, number of scored picks and total, unless you leave it in Settings, Privacy. The Friends board shows only you and your accepted friends. The Squads board names Squads, their competition, member count and points, and never a member or a vote.
Private spaces. A Squad’s chat, its table and its votes are for its members. A conversation with a friend is for the two of you; a moderator reads a message only when one of you reports it, through that report. A notification about a new message names who wrote and never quotes the message.
Without an account. Anyone holding an invitation link you shared sees a short public preview: your display name, username and photo, and your number of picks this month; for a Squad invitation, also the Squad’s name, competition, language and member count. Your profile photo is served from a hard-to-guess address that does not require sign-in. Shared result cards and match pages carry no name, username or photo.
10. Service providers and other recipients
We share personal data with the service providers below, who process it on our behalf, only what each needs. Each of them processes it under terms that give it the same or equal protection as this Policy states and as Apple’s App Review Guidelines require. Our current service providers:
Hetzner Online GmbH (Germany) hosts our server, its database, and the photos and voice notes members send, in Nuremberg, Germany.
Cloudflare, Inc. (United States) carries every request between the app and our server through its network, where the connection is decrypted and encrypted again on its way; serves the itys.club website and invitation links; routes email sent to our itys.club addresses to our mailbox; and stores our nightly backups, which are encrypted before they leave our server.
Resend, Inc. (United States) sends the emails about your account, the copies of the support messages you send from the app to our mailbox (your words and the app’s language, not your username), and our moderator’s report alerts, which name no member and quote nothing.
Expo, run by 650 Industries, Inc. (United States), receives your phone’s push address and each notification’s title, short text and link inside the app, and passes it to Apple’s push notification service (or Google’s, on Android), which delivers it to your phone.
OpenAI (United States) receives each picture you add, with its metadata removed and nothing that names you, and returns a safety score. OpenAI states, on its page "Your data" (developers.openai.com/api/docs/guides/your-data), that data sent to its API is not used to train or improve its models, and lists its moderation endpoint with no abuse-monitoring retention and no application-state retention.
Sentry, run by Functional Software, Inc. (United States), stores crash reports and performance timings in Germany. It receives reports from your phone only while crash reports are on, and our server’s own error reports at all times, as described above.
PostHog, Inc. (United States) stores usage statistics in the European Union, receives them only while usage statistics are on, and is set to discard your IP address. Our server also sends PostHog a record of each notification sent, which names no member.
Other recipients. Our mailbox is hosted by Google LLC (United States) under Google’s own terms: it holds the emails you send to our itys.club addresses and the copies of support messages described above. Apple and Google confirm who you are when you sign in with them, their location services turn your phone’s approximate position into a country when you allow it, and their push services deliver notifications, each under its own terms. Have I Been Pwned receives from our server, never from your phone, the first five characters of a one-way fingerprint (SHA-1) of a new password, and nothing that identifies you.
When subscriptions are offered, Apple processes payments, and RevenueCat, Inc. (United States) receives from Apple and from the app your subscription’s product, period, price, currency, trial and renewal status and transaction identifiers, linked to an app user identifier, to tell our server whether your subscription is active. We never receive your card details.
We also disclose data when the law requires it, for example to answer a valid order of a court or an authority; to notify authorities of a threat to someone’s life or safety; to report child sexual abuse material to NCMEC and other competent authorities; to protect members, ITYS or the public from harm or fraud; to a person who takes over running ITYS, who must keep this Policy’s protections, after telling you in advance; or when you ask us to.
11. International transfers
ITYS is available worldwide, so your data is processed outside the country you live in. It is processed in these countries: Germany and other countries of the European Union (our server, database, backups, crash reports and usage statistics); Morocco, where the controller lives and administers ITYS, including by remote access to the server; and the United States (Cloudflare, Google, Resend, Expo, OpenAI, and RevenueCat when subscriptions are offered). Apple and Google may process sign-in, location and notification data in the United States and other countries under their own terms.
When you use ITYS, the app sends your data to us directly. Morocco is where the operator lives and from where he accesses the data held in Germany. Morocco is not covered by an adequacy decision of the European Commission. For providers in the United States, we rely on the safeguards in each provider’s data processing terms: the European Commission’s standard contractual clauses, with their UK and Swiss versions, or the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Consent covers the pictures sent to OpenAI. You can ask for a copy of these safeguards at support@itys.club.
For members in Japan, we rely on our providers’ data processing terms to keep measures equivalent to those Japanese law requires. For transfers from Morocco, we follow Law 09-08 and the CNDP’s rules on transfers abroad.
12. How long we keep data
Account and profile, friends, Squads and follows: for as long as the account exists, and deleted with it.
Picks, receipts, votes, settlements, corrections and point history: for as long as ITYS runs, because boards and other members’ results depend on them; once your account is deleted they stay under the de-identified label "Deleted player".
Messages: a Squad chat message stays until it is deleted from the chat, its Squad is deleted, or its author’s account is deleted. A message between friends stays until its author deletes it, and the whole conversation, with its pictures and voice notes, is deleted for both people when either deletes their account or blocks the other. A picture or voice note uploaded and never sent is removed the next time its author uploads one, or with the account. Earlier versions of an edited message go with the message or the account.
Arena posts: posts in a topic Arena lose their text when you delete your account. Posts in a match Arena stay in place under "Deleted player"; delete them yourself before you delete your account if you want them gone, or ask us to.
Reports and moderation: a report keeps its copy of the reported text until the author of that content deletes their account. Moderation decisions and strikes have no fixed end: we keep them for as long as ITYS runs, to apply the suspension ladder and to answer a complaint or claim about a decision. A support request loses its message and its link to you when you delete your account.
Records we keep after deletion, for as long as ITYS runs: the record of the Terms and Privacy versions you accepted, with the time, as proof of what was agreed; your member number, with no personal data beside it, so it is never reused; and the deletion request with the optional answer you gave when you left, to understand why members leave. None of these carries your name, username or email address.
Working records: a confirmation link lasts 24 hours and a password reset link 15 minutes; the stored answer to a request lasts 48 hours, so a retry is not applied twice; an email address waiting to be sent is removed once the message is sent or given up on, and the delivery record goes after 7 days; a notification’s delivery record goes 2 to 14 days after it finishes, depending on its kind; rate-limit records go within 7 days; the record that you looked at your Squad’s day, month or board goes after 8 days; the record of when you first opened your Squad after a call was settled goes after 42 days; a phone’s push address is removed when you sign out on that phone or delete your account.
Providers: Sentry keeps crash reports for at most 90 days and PostHog keeps usage statistics for at most one year. Server and proxy logs keep at most 50 MB per service, the oldest overwritten first.
Backups are encrypted; the copies on our server are deleted after 14 days and the copies off it after 30 days.
Legal holds: where the law requires us to keep data, for example content and account data tied to a report of child sexual abuse material, which United States law requires us to preserve for one year after the report, or data an authority has validly asked us to preserve, we keep it for that period despite a deletion request, and only for that purpose.
When subscriptions are offered: subscription and transaction records for as long as the subscription runs and then for as long as tax law and the time limits for claims require, and at least three years where California law requires it.
13. Deleting your account, and your other choices
You can delete your account in Settings, Account, "Delete account". It takes effect as soon as you confirm, and its copies in our encrypted backups are gone within 30 days, subject to what the section "How long we keep data" says we keep. If you signed in with Apple, we revoke ITYS’s access to your Apple sign-in at deletion. If you signed in with Google, you can remove ITYS from the third-party connections in your Google Account. Uninstalling the app does not delete your account, and once subscriptions exist, deleting your account does not cancel an Apple subscription.
You can also: pause your account in Settings, Account, "Temporarily disable account", which hides your profile from search, boards, invitations and conversations until you sign in again; leave the Personal board in Settings, Privacy; choose who can find you in Settings, Discoverability; block members; remove your photo or bio; choose your notifications; and download your data.
14. Your rights
Depending on where you live, you have the right to access your data and receive a copy, to correct it, to delete it, to restrict its use, to object (see "Your right to object"), to receive the data you gave us in a portable format and have it sent to another service where that is technically feasible, to withdraw consent, and not to be subject to a decision based solely on automated processing with legal or similarly significant effects. Every member can use these rights, wherever they live.
How. Settings, Your data, "Download your data" prepares a file (JSON) of your profile, picks, friends, blocks, follows, settings, support requests, comments and topic Arena activity, once a day. For anything the file leaves out, such as your messages, pictures and voice notes, and for every other right, write to support@itys.club or use Settings, Help. You can correct your name, username, bio and photo yourself in Settings, Account. We answer within one month, which we may extend by two further months for complex requests after telling you why. We may ask you to confirm the request from your signed-in app or your account’s address to make sure it is yours. Using your rights is free, and we will never treat you differently for using them.
Complaints. You can complain to us first at support@itys.club or through Settings, Help; we acknowledge a complaint within 30 days and answer without undue delay. You also have the right to complain to a data protection authority: in the European Union, the authority of the country where you live, work or where the infringement took place; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner; in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in Morocco, the CNDP; and elsewhere, the authority of your country.
Brazil. Under Article 18 of the LGPD you may ask us to confirm that we process your data; access it; correct incomplete, inaccurate or out-of-date data; anonymise, block or delete unnecessary or excessive data or data processed against the law; port it to another provider; delete data processed with your consent; know the public and private entities we share it with; know that you may refuse consent and what follows; and revoke consent.
Morocco. Under Law 09-08 you may access your data, have it corrected or deleted, and object for legitimate reasons, including to its use for prospecting, which we do not do.
United States. Wherever you live in the United States, you can use the rights above. We make no sale of personal information and do not share it for cross-context behavioural advertising, as California law defines those terms, and we do not use it for targeted advertising or profiling. We do not use or disclose sensitive personal information except to run the service. An authorised agent may make a request for you with your signed permission, and we may ask you to confirm it. If we refuse a request, you may ask us to reconsider by replying to our answer.
15. Adults only
ITYS is for people aged 18 or older, or the age of majority where they live if it is higher. It is not directed at children, and we do not knowingly collect data from anyone under 18. If Apple’s age answer, or anything else we learn, shows that an account belongs to someone under 18, we close it and delete its data, except what the law requires us to keep. If you believe a child is using ITYS, write to support@itys.club.
16. Security
We protect your data with access controls, encrypted connections, encrypted backups, restricted storage, audit logging and security monitoring. A password is held only as an Argon2id hash, confirmation and reset links are held only as one-way digests, and push addresses are held hashed and encrypted. When you choose or change a password, our server checks it against Have I Been Pwned’s list of passwords exposed in known breaches, as described above, and refuses a breached one. No system is completely secure. If a breach puts your rights at risk, we tell you and the authorities the law requires us to tell. Report a security problem to support@itys.club.
17. Cookies, device storage and tracking
The itys.club website sets no cookies of its own and loads no analytics or advertising scripts. The app stores on your phone what it needs to work: your session in the phone’s secure storage, your settings, muted words, and copies of screens so they open quickly. It reads and sends usage statistics and crash reports only after you turn them on.
ITYS does not track you across other companies’ apps or websites, does not use advertising identifiers, and lets no third party collect data about your activity across other sites or services through ITYS. Because we do no such tracking, we treat everyone as if a "Do Not Track" or Global Privacy Control signal were on, and those signals change nothing in what we do.
18. Emails
We send only emails about your account: that it was created, the confirmation of your address, a password reset link you asked for, a notice that your password changed, and that your account was deleted. We send no marketing emails. If we ever do, we will ask first where the law requires it, and every such email will carry a way to stop them and our postal address.
19. Changes to this Policy
We may update this Policy when ITYS or the law changes. We show the new version and its effective date at itys.club/privacy and in the app. We tell you in the app, and by email where we hold your address. For a material change we give at least 30 days’ notice, except where the law or security requires a faster change, and we ask your consent again where the law requires it. A change never widens, without your new choice, who can see your picks, your votes or your place on a board, and it never applies to data collected before it in a way you were not told about.
20. Contact
Privacy questions, rights requests and complaints: support@itys.club, or Settings, Help in the app.