Tope keeps only what a bet between friends needs: an account id, the first name you pick, a colour, your language, and your topes.

No advertising, no trackers, no audience measurement. The app ships with no analytics library at all.

An account id. It is anonymous by default: you can use the app without giving any address.

An email address, only if you choose to sign in by email link. It is used to sign you back in, nothing else.

The first name or nickname you type, your avatar colour, and your device language.

What you create: your circles, your topes, their questions and forfeits, your stakes and your points.

A notification token, only if you allow notifications. It identifies the device, not you.

A count of invitations: how many were sent, how many links were opened, how many people joined. It is the only measurement in the app, and it exists to know whether inviting works — the product depends on it.

These counters are attached to a CIRCLE, never to a person: no identifier, no IP address, no browser fingerprint. Someone opening an invite link is not a user yet and has asked us for nothing; identifying them to compute a rate would be exactly what this page promises not to do.

No phone number. No address book. No photo. No location. No date of birth.

That is not a marketing promise, it is a design constraint: the app is built not to need any of it. The only Android permission requested is sending notifications.

Members of a circle see that circle’s topes, who staked what, and the forfeits. Nothing is public: there is no feed, no browsable profile, no search for strangers.

Your data is not sold, rented, or passed to an advertiser.

The developer has technical access to the database, like anyone who hosts a service. He does not read bets out of curiosity, and limits himself to three cases: acting on a report, fixing a fault someone describes, and reading the questions people write in order to improve the ones the app suggests.

In that last case, questions are read DETACHED: no first name, no circle name, no knowing who bet what. What matters is the wording, not the person.

On Supabase, in the European Union (Frankfurt). Traffic goes over HTTPS.

Emails — the sign-in link, and the alert that flags a report — go out through Resend, in the United States. Your address and the link travel that way; for a report, the question concerned and the reason written. Nothing else.

Notifications pass through Expo’s service, which hands them to Apple or Google. Only the title, the text and the device token travel that way.

Football results come from football-data.org. That call is made by the server and carries nothing about you.

In the app: Profile tab, right at the bottom, “Delete my account”. It is immediate and final.

Gone: the account, the name, the stakes, the points and the forfeits owed. Kept: the topes you started, without their author — so other people keep their night.

If you cannot reach the app, write to ries.guillaume@gmail.com: deletion is done within thirty days.

You can also ask for a copy of what Tope holds about you, or have it corrected — GDPR, articles 15 to 17.

Tope is built by Guillaume Ries, as an individual. Questions or complaints: ries.guillaume@gmail.com.

Any change to this policy will be dated at the top of the page.