GolArena
Sign inGet started

Privacy Policy

Last updated 2026-08-26. This policy explains what GolArena collects, why, and the choices and rights you have.

Who we are

GolArena is the data controller for your account data. Who operates it, in what legal form and where, is set out on our company details page. For privacy questions, contact privacy@golarena.io or open a ticket in the app.

We are established in Albania, outside the EU. Where the GDPR applies to our processing we are required to designate a representative inside the Union; that appointment is being made and the representative’s name and address will be published on the company details page. This does not change any of your rights or how quickly we answer — you can always reach us directly at privacy@golarena.io, and you can complain to your local data-protection authority whether or not a representative is named.

What we collect

Account data — email, username, display name, and (optionally) phone and country. Age — we store only an 18+ age-verified flag and your country/region for the age gate. On Android we ask for your date of birth to run that check and discard it immediately — it is never stored. Everywhere else you simply confirm you are of legal age at sign-up. Your content — betslips you upload, predictions, messages, and favourites. Usage & device — app interactions, device identifiers, and push tokens to deliver notifications. Security context — when you do something security-relevant (sign in, register, request a code, upload a betslip, buy credits, contact support) we record the action together with a shortened IP address and the family of browser or app you used, without version numbers; see Security & audit records below for exactly what that means. We do not collect payment card details; payments are handled by Apple, Google, or our payment providers.

Analytics — and what is not analytics. The one record we keep purely to count usage is a marker that your account was active on a given day, and we only write it if you have turned Analytics on in Settings → Privacy & data. It is off unless you switch it on. Two other records look like analytics and are not, so we would rather name them than leave you to assume: when you watch a rewarded ad we log it in order to grant the reward and to stop the same ad being claimed twice, and when you click a partner link we log the click so the commission can be attributed. Both are necessary to run the service and to prevent fraud, both happen whatever your Analytics setting says, and neither is used to build a profile of you or shared with advertisers.

How & why we use it (legal bases)

To provide the service and perform our contract with you: run your account, track your bets, deliver alerts, and power AI features. For our legitimate interests: security, fraud prevention, and improving the product. With your consent: marketing email, analytics, and personalised ads. To meet legal obligations: age assurance, responsible-gambling controls, and record-keeping. You can withdraw consent at any time in Settings.

Sharing & processors

We share data only with service providers that process it on our behalf under contract: they may use what they receive to perform that service for us, and not for their own purposes. We do not sell your personal information. We may disclose data where required by law. These are the providers we use today, what each receives, and where it is processed:

  • Cloud hosting and database — Microsoft Azure (EU, West Europe) — your account and activity data.
  • Website hosting and delivery — Vercel — the requests your browser makes to golarena.io.
  • Image and file storage — Cloudflare R2 — the images you upload: profile photo, betslip uploads, and your data-export archives.
  • AI providers (USA) — Google Gemini and Anthropic Claude — Gemini reads the betslip images and text you upload in order to extract the selections on them; Claude powers the Bet Builder, the Pick Packs and the written analysis, using match data and a summary of what you asked for. Gemini also screens posts in the public match threads for abusive content shortly after they are posted. Your private messages are never sent to it — direct messages and group chats are checked only by a word filter that runs on our own servers. We send only what the feature needs to produce its answer — never your email, phone number or password.
  • SMS — Twilio (USA) — your phone number, to send sign-in and verification codes.
  • Email — Amazon SES, with SendGrid as a backup (USA) — your email address and the message we send you.
  • Push notifications — Firebase Cloud Messaging (Google) and the Apple Push Notification service — your device push token and the alert text.
  • Error and crash monitoring — Sentry (EU) — technical diagnostics. It is configured not to attach your account, your authorization headers or request bodies to a report.
  • Purchases — RevenueCat (USA) with Apple and Google in the app, and NOWPayments for the crypto payment option on the website — they handle the payment itself and tell us what was bought and whether it succeeded; we never receive your card details.
  • Advertising — Google AdSense on this website and Google AdMob in the mobile app — in both cases only after you allow it in the consent prompt. What Google receives is described in "Cookies & ads" below. Paid ad-free plans show no ads.
  • Affiliate link monetization — Skimlinks on this website, plus the affiliate network behind each individual partner link (USA/EU) — when you click an outbound link to a shop, ticket seller or travel site, that network receives the click and, if you buy something, the fact that the sale came from us. It never receives your name, email or account id: where we pass an identifier at all it is a salted, one-way hash that we cannot reverse and the partner cannot link to you.
  • Sports data — API-Football — it receives match and fixture requests only, never your identity and never your betslips.

Advertising is the one exception to "processor only": Google also uses ad-request data for its own purposes, so we treat serving ads as a share under the CCPA rather than as a service-provider disclosure — which is why the "Do Not Sell or Share My Personal Information" toggle in Settings stops our ad units for you. We will update the list above here when a provider changes; if anything on it is unclear, ask us at privacy@golarena.io.

International transfers

Some providers process data outside your country. Where they do, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.

Security & audit records

Signing in, registering, requesting a verification code, uploading a betslip, a payment event, an admin action and a support contact each write an audit record: what happened, to which account, and when. Two pieces of technical context are kept with it, and both are deliberately blunted before they are stored:

  • A shortened IP address. We drop the part that points at you and keep only the part that points at a network: 203.0.113.42 is stored as 203.0.113.0, and an IPv6 address is cut down in the same way. Your full address does reach our servers with every request — that is how the internet works — and it is used in the moment to rate-limit requests and block abuse, but it is never written to our database in that form.
  • A browser or app family, without a version. Your browser sends a long "User-Agent" description that is detailed enough to help fingerprint your device. We reduce it to a plain family — Safari on iOS, Chrome on Windows, GolArena app (Android) — and store only that.

We hold this to keep accounts secure and to investigate fraud and abuse — for example spotting an account being brute-forced, credits being farmed from one place, or a support request that does not come from the account owner. That is our legitimate interest, and it is also what lets us meet our legal duties on age assurance and record-keeping. This data is not used for advertising, not sold, not shared with advertisers, and not used to build a profile of you. Your data export shows you these records exactly as we hold them, in the coarse form above.

We keep them for a limited period — long enough to investigate a security or fraud problem, and no longer — after which they are deleted automatically. If you delete your account, the network and device context is erased from these records straight away, while the bare record that the action happened remains for the security and financial trail.

Retention

We keep personal data for as long as your account is active. On deletion, your identifying data is erased promptly and the files that carry it — your profile photo, your data-export archives and the betslip screenshots you uploaded — are deleted from storage.

Transactional records (betslip entries, predictions, messages, support tickets, the credit ledger) may be retained for up to 7 years where the law requires it, for example tax and anti-fraud record-keeping. Those rows keep an internal account reference, so they are pseudonymised rather than fully anonymous: nothing in them names you, and the account they point to no longer holds your email, phone, name or photo, but they remain linked to one another. We prefer to say that precisely rather than claim nothing retained identifies you. Security and audit records follow the shorter, limited window described above. Long-inactive accounts may be anonymised under our retention policy. Deleting a single betslip also deletes the screenshot you uploaded with it, straight away — you do not have to delete your whole account to remove an image.

Your rights

GDPR (EEA/UK): access, rectification, erasure, restriction, portability, and objection. Export your data as a JSON archive and delete your account in Settings → Privacy & data. You may also complain to your local data-protection authority. CCPA and US state privacy laws (California, Colorado, Connecticut, Texas and others): you can know, access, and delete your data, and opt out of any sharing via the "Do Not Sell or Share My Personal Information" toggle in Settings. We also honour the Global Privacy Control signal: if your browser sends one we treat it as an opt-out straight away, we do not show you the cookie banner, and no advertising cookie is set — you do not have to find our toggle. We do not discriminate against you for exercising these rights.

Cookies & ads

Essential cookies keep you signed in and secure; they are always on. We also count page views: when you open a page, your browser sends us the first part of its address (for example /home) and nothing else. That count carries no cookie, no account id and no device identifier, so it cannot be traced back to you, and we use it only to see which parts of the site get used.

Advertising. This website shows ads through Google AdSense, using Google's Consent Mode. Until you consent, no advertising cookie is written or read: ads are requested in a non-personalised, storage-free form, based only on the page you are on and coarse information such as your approximate region. If you choose "Accept", third-party vendors — including Google — may then use cookies (such as Google's advertising cookies) to personalise ads and to measure and limit how often you see them, which may be based on your prior visits to this or other websites. How Google uses data from sites that show its ads is described at policies.google.com/technologies/partner-sites. You can opt out of personalised advertising at Google Ads Settings or www.aboutads.info/choices.

You can change or withdraw your choice at any time via "Cookie preferences" in the page footer or in Settings → Privacy & data — withdrawing returns ads to the non-personalised, cookie-free form described above. If you use the "Do Not Sell or Share My Personal Information" toggle in Settings, we stop showing you our ad units. On this website, ads appear only on general sports pages — live scores, news, and our team, league and player pages — and never on the bet tracker, the Bet Builder, or a match page showing odds; paid ad-free plans show no ads anywhere. In the mobile app, Google's consent prompt asks you before any ad loads, ads are requested in non-personalised form, and you can change that choice at any time in your device settings. We run no other third-party analytics or tracking on this website.

Affiliate links. Some outbound links on this site — to ticket sellers, travel sites and official club shops — earn us a commission if you buy something, at no extra cost to you. Some of those links are created automatically: with your advertising consent, a link-monetization service may rewrite a merchant link at the moment you click it so that the visit is attributed to us, which sets a cookie on the merchant's or the network's own domain. Decline advertising consent and no such rewriting happens. We never let this apply to gambling operators, and a commission never changes what we show you or what our analysis says.

Security

We use encryption in transit, hashed credentials, access controls, and audit logging. No system is perfectly secure, but we work to protect your data and will notify you and regulators of a qualifying breach as the law requires.

Children

GolArena is strictly 18+ and not directed to children. We do not knowingly collect data from minors.

Changes & contact

We will post updates here and give notice of material changes. Privacy questions: open a ticket in the app (Support) or email privacy@golarena.io.