Privacy Policy

This Privacy Notice for 1TOUCH FOOTBALL LLC, a limited liability company formed in the State of New York, United States ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Download and use our mobile application (1touch), or any other application of ours that links to this Privacy Notice
Use football statistics, performance analytics, and fan community platform. 1touch provides organized information and statistics on football teams and players, along with proprietary performance evaluation metrics developed by 1touch to help users analyze and compare team and player performance. 1touch also offers community features, including a discussion forum where users can create and comment on football-related posts, and live chat rooms that open during live matches so users can discuss games in real time. Content is provided for informational and entertainment purposes only.
Contact us for support or other service-related matters
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. This notice explains our practices; reading it is not a substitute for a separate consent where one is required. If you still have any questions or concerns, please contact us at support@1touch.football.

Operator update: From the first publication of this version, 1TOUCH FOOTBALL LLC is responsible for the personal information processed to operate 1touch, previously operated by June Jung individually. June Jung remains the Company's contact person for privacy requests. The change of operator does not by itself change the purposes of processing or reduce your privacy rights. Any notice or consent required for the transition under the previous terms or applicable law will be provided or obtained.

SUMMARY OF KEY POINTS
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not request racial or ethnic origin, religious beliefs, or sexual-orientation information as account fields. Authentication credentials and information that users choose to include in public content still require protection; do not publish sensitive information about yourself or others.

Do we collect any information from third parties? Optional social sign-in and Google Calendar connections provide authentication or connection information. We do not obtain user information from data brokers, public databases, or marketing partners for marketing.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? Contact support@1touch.football to request access, correction, deletion, or another applicable privacy right. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

1. WHAT INFORMATION DO WE COLLECT?

Account information. Email registration uses an email address, username, nickname, and password. We store a password hash rather than the original password. We also process verification challenges, hashed verification codes, login-session token hashes, and expiry times. Optional social sign-in uses the provider and provider-issued account identifier, as explained below.

Community and points. We process profile photographs, posts, comments, live-match chat messages, uploaded images or videos, reports, blocks, favorites, followed teams and players, likes, match-prediction selections, points committed to predictions, results, balances, and points history. We also store the country code provided by the device's region setting for the daily community-points period. This setting is not proof of nationality, residence, or physical location. Published profile and community information can be visible to others.

Optional connections and notifications. Google Calendar connections use a Google account identifier, encrypted refresh token, app-created calendar identifier, and team subscriptions. Push delivery uses a generated installation identifier, FCM token, platform, locale, notification preferences, and delivery records. In-app notification records include relevant activity and read status.

Support and moderation. If you contact us, we process the contact details and information you include. Reports include the reported content reference, reason, reporter account reference, and moderation outcome. Please avoid sending information that is unnecessary for resolving your request.

Device access. The app requests access to the photo/video library for media selection and permission to display notifications. Google Calendar access is granted through Google authorization and is limited to calendars created by the app. The app does not request access to the device address book or precise GPS location. Device region settings also help choose sign-in suggestions on the device.

Network and technical data. Our API receives IP addresses and request information, such as the requested route, time, and response status. Security rate limiting uses hashed request scopes. This is separate from Google's Mobile Ads SDK, which may process IP addresses, approximate location inferred from IP addresses, device identifiers, advertising interactions, and diagnostic information. We do not claim that non-personalized ads involve no personal information. See the advertising section below.

App usage records. While you are signed in, updated versions of the app send your account reference, app launches and returns from the background, viewed screen and tab identifiers, instrumented button actions, event times, and active screen durations to our API. We use these records to understand feature use and improve the service, and authorized administrators can review them by account. The usage records do not include typed search queries, passwords, post or chat text, or screen recordings. They are stored with account data and removed when the account is deleted; backup retention is described in section 20. These records are separate from advertising measurement.

Sensitive information. Account login information combined with access credentials may be treated as sensitive personal information under California law. We use credentials for authentication and account security. We do not ask for race, religion, health information, or sexual orientation in account fields. Public posts and uploaded media can contain information chosen by their authors; do not publish sensitive information about yourself or others.

Google API data. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order. (Retention period: For as long as your account remains open. Account deletion removes the active account record and related authentication records. Backup copies are handled separately as described in the Hosting and operational retention section.)
To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service. (Retention period: Retention depends on the feature and data involved. Unpublished community drafts and unattached uploads are subject to a seven-day retention period. Account records and optional calendar connections are retained for the life of the account or connection. Published community content and operational copies are handled as described in the Account deletion and community content and Hosting and operational retention sections.)
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.

To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user. (Retention period: Published posts, comments, live match chat messages, and files attached to published posts have no fixed automatic expiry in the current service. After account deletion, this content may remain without its association to the deleted account. You may request review or removal by contacting support@1touch.football and identifying the content.)

To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
Diagnose problems and/or prevent fraudulent activities
Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.

Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work.

The third parties we may share personal information with are as follows:
Non-personalized advertising
Google AdMob
Social sign-in and authentication
Google Sign-In, Sign in with Apple, Kakao Login, and LINE Login
Profile and community media storage
Cloudflare R2
Account verification and recovery emails
Amazon Simple Email Service (SES)
Push notification delivery
Google Firebase Cloud Messaging (FCM)
Optional match calendar synchronization
Google Calendar API
Application server, account database, and database backups
Amazon Web Services (AWS Lightsail), Seoul, South Korea
Support email handling
Porkbun email services

We also may need to share your personal information in the following situations:
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Other Users. Your public profile and content you publish, including posts, comments, live match chat messages, and attached media, may be visible to other users. We do not import a social provider's friends list or notify your social-network contacts of your 1touch activity. Account deletion and retained community content are explained below. Information you publish can also be copied by other users.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

External links, social sign-in, calendar services, and advertisements can take you to services operated by other organizations. Their own privacy notices govern their independent processing. Our responsibility for our own processing and any non-waivable legal obligation remains unchanged. Review the provider information below before using an optional connection or leaving 1touch.

Embedded social posts. Community posts can include X and Instagram previews displayed inside 1touch. Preparing or loading a preview connects your device directly to X or Instagram/Meta, including before you tap the preview. These connections disclose the requested post reference, IP address, and browser/device information. The embedded code also sends viewing and performance events; Instagram events can include session and device identifiers generated by the embedded service. This processing takes place separately from Google AdMob and does not require you to sign in to X or Instagram through 1touch. The providers may use cookies, subject to the web view's privacy protections.

The collected events support viewing measurement and performance analysis. Read X's embedded-content privacy information and the Meta Privacy Policy for their processing practices, retention, and privacy choices. Non-personalized AdMob settings do not control these separate providers.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

The app uses local storage and secure device storage for settings and authentication. Google's Mobile Ads SDK may use device identifiers and other technologies to deliver non-personalized ads, measure performance, and prevent fraud. Non-personalized ads can still involve personal information. Required consent and device permissions apply separately; see the Non-personalized advertising and notifications section. You can manage relevant permissions in your device settings and contact support@1touch.football about your privacy rights.

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

1touch uses statistical and machine-learning methods for football analytics and match-related information. Our football analytics use football data as model inputs, not 1touch account details or community messages. These outputs are informational and may contain errors; they do not guarantee future results.

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

1touch supports Google, Apple, Kakao, and LINE sign-in. The authentication response may contain provider-specific claims needed to validate your sign-in. Our account database stores the provider name and account identifier, and does not import social-media friends lists or use the provider's email address as your stored 1touch contact email. Email-and-password registration is a separate option. See the Social sign-in section for details.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

9. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

Our application server, database, backups, and Amazon SES account emails use the Seoul region in South Korea. 1TOUCH FOOTBALL LLC administers the service and handles support through June Jung from New York, United States. Information is transmitted over network connections when you use a feature, upload content, sign in, or contact us.

Recipient and purpose	Information and timing	Location information
1TOUCH FOOTBALL LLC, 1touch operator Contact person: June Jung support@1touch.football	Account, community, security, and inquiry records as needed to operate the service and respond to requests.	United States; application records are hosted in South Korea.
Amazon Web Services: Lightsail and SES Provider privacy information	Account and community data, database backups, and account-email addresses, codes, and delivery information; during service use and requested account-email delivery.	Configured hosting and email region: Seoul, South Korea. A service region is not a promise that every support or administrative record is processed only in that region.
Cloudflare, Inc.: R2 storage Data processing terms · legal@cloudflare.com	Profile photographs and community media, when uploaded or accessed; retained as described in section 20.	Our current bucket is labelled Asia-Pacific (APAC). This does not identify a country or guarantee country-only storage. We have not obtained a complete country list for this bucket. See R2 location rules and Cloudflare's service-provider locations; that general list is not a record of where each of our files is stored.
Google: AdMob and Firebase Cloud Messaging Google privacy information · Firebase privacy information	Advertising identifiers, IP and interaction/diagnostic information when ads are requested; installation identifiers, push tokens and delivery data for messaging. See section 19.	International processing, including the United States. FCM runs on global infrastructure and has no country selection in our app. Google describes potential facilities in its data center list and Cloud locations. We do not represent those lists as this device's actual processing location.
Porkbun LLC: support mailbox Provider privacy information · privacy@porkbun.com	Your sender address, message, attachments, and correspondence metadata when you email support@1touch.football.	Porkbun is a US provider and describes US and international processing. Our mail connection endpoints are in the US; this does not establish every mailbox, backup, or support-access country. A complete hosted-mail country list has not been made available to us.
Google, Apple, Kakao, and LINE: optional sign-in; Google Calendar: optional calendar connection	Authentication tokens and provider identifiers to verify a connection you select; calendar connection and match-event data if enabled. Provider account activity is also handled under that provider's notice.	Processing depends on the provider and account. See Google, Apple, Kakao, and LINE. We do not claim that choosing a sign-in provider confines processing to a particular country.
X and Instagram/Meta: embedded community previews X privacy information · Meta Privacy Policy	Post references, IP and browser/device information, viewing and performance events, and provider-generated identifiers when previews are prepared or loaded. See section 5.	Provider-operated infrastructure. 1touch does not select a processing region for these embeds; refer to each provider's privacy information for its international processing and retention practices.

Countries can have different privacy protections. Cloudflare and Firebase publish data processing terms that include international-transfer provisions; the safeguards that apply depend on the service and the particular transfer. Contact us for information about a transfer, applicable safeguards, or your rights.

You can decline optional social sign-in, calendar connection, notifications, or media uploads, or change available advertising choices. The corresponding optional feature may then be unavailable. Email registration remains a separate sign-in option. Account hosting is necessary to provide an account; you can stop using the service or request deletion. Accepting the Terms of Service is not blanket consent to international transfers or advertising processing. We will seek separate consent when the applicable law requires it.

10. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). See Section 20 for our retention periods and deletion schedules by record type.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

11. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Please protect your login information and device. These security limitations do not waive your legal rights or our legal responsibilities.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Switzerland, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:
Email: support@1touch.football

Post: See "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

What happens after you complain

We will acknowledge your complaint within 30 days of receiving it.

We will investigate without unjustifiable or excessive delay.

We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority.

Website: ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:
Log in to your account settings and update your user account.
Contact us using the contact information provided.
Use the Delete Account option in the app's account settings. Published community content may remain without its association to your account, as explained in the account deletion section below.
Account deletion removes active account and authentication records as described in the Account deletion and community content section. Published content can remain after its association with your account is removed. Backup copies are retained under the separate fourteen-day and thirty-day schedules described below. Removing the account association does not remove personal information contained in the content itself.

Device storage and advertising choices: You can manage permissions through your device settings and contact support@1touch.football to exercise applicable privacy rights. Non-personalized advertising may still process device identifiers and diagnostic information. Required consent for advertising technologies is separate from agreeing to the Terms of Service.

If you have questions or comments about your privacy rights, you may email us at support@1touch.football.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Our informational website and legal pages do not include advertising or analytics trackers. The mobile app's advertising processing and privacy choices are described in sections 6 and 19. Browser Do-Not-Track settings do not change an app's advertising permission or consent setting. Where an applicable law requires us to honor an opt-out preference signal, we will do so; this notice does not waive that requirement.

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Your rights depend on the law that applies to you and to our processing. Where applicable, these may include access, correction, deletion, portability, non-discrimination, and opting out of sale, sharing, targeted advertising, or certain profiling. A law's inclusion in this notice does not establish that every threshold or provision applies to 1touch.

Collection and disclosure inventory

Development testing has involved personal information. The following inventory describes confirmed account and community records. Advertising and notification information is additionally described in section 19. The inventory is not a claim that every example within a statutory category is collected.

Category	Confirmed examples	Recipients and retention
Identifiers and contact/account records (A/B)	Email addresses, usernames, nicknames, account and social-provider identifiers	AWS hosting and account email delivery; relevant sign-in providers when used. Active account records until account deletion; backup and technical records follow their separate schedules.
Internet or network activity (F)	Community interactions, follows, prediction/points activity, notification and request records	AWS hosting and, for push delivery, Firebase Cloud Messaging. Retention depends on the record, as described below.
Visual/electronic information (H)	Uploaded profile and community images	Cloudflare R2; published media can also be seen by users. Unattached media: seven-day schedule; published media: until removed; profile photo: until replaced or account deletion, followed by queued file deletion.
Authentication credentials (L, where the statutory definition applies)	Account login credentials; stored password and session-token hashes	AWS hosting processes stored authentication records. Passwords are stored as hashes. Account records are removed on deletion; sessions have a thirty-day validity period and are separately cleaned up.

Sources are your entries and activity, device settings and requests, and the optional providers described in this notice. We also process videos and optional calendar information when those features are used. We do not sell account information or community content to data brokers for money. Advertising data disclosures are described separately and are not treated as absent merely because ads are non-personalized. Contact us to exercise any sale, sharing, or targeted-advertising opt-out right that applies to you.

Requests and appeals

Contact support@1touch.football to exercise applicable rights or appeal a decision. We may verify identity or an authorized agent's authority using information proportionate to the request. Do not send passwords or authentication codes. We will explain any refusal and applicable appeal route and respond within the period required by the law that applies.

15. ACCOUNT DELETION AND COMMUNITY CONTENT

You can request account deletion from the account settings in the 1touch app. Account deletion removes your account record and associated login credentials, social login links, sessions, and related account records. Your profile photograph, unpublished drafts, and unattached uploads are scheduled for removal. Published posts, comments, live match chat messages, and files attached to published posts may remain without their association to your deleted account. Removing that association does not remove personal information you included in the content itself. If you want that content reviewed or removed, contact support@1touch.football and identify the content concerned. Unpublished drafts and unattached uploads are subject to a seven-day retention period.

16. SOCIAL SIGN-IN

1touch supports sign-in through Google, Apple, Kakao, and LINE. Our authentication server validates the provider's authentication response and uses the provider-issued account identifier to associate the sign-in with your 1touch account. Our account database stores the provider name and account identifier; it does not import your social-media friends list or use a social provider's email address as your account's stored contact email. Email-and-password registration separately requires an email address, username, nickname, and password. Passwords for email accounts are stored as password hashes.

17. OPTIONAL CALENDAR CONNECTIONS

If you choose to connect Google Calendar, we process your Google account identifier, an encrypted refresh token, the calendar identifier, and your selected team subscriptions to create and update a 1Touch calendar with match schedules. The Google Calendar permission used by this feature is limited to calendars created by the application. Calendar connections and team calendar subscriptions are optional. Disconnecting removes the stored connection and team subscriptions. Calendar events already written to your Google account remain there until you remove them in Google Calendar. Contact support@1touch.football if you need help disconnecting or requesting removal of stored connection data.

We use Google API information only for the sign-in and calendar features you select, necessary security, and legally required purposes. We do not use that information to target ads, sell it to data brokers, or train general-purpose AI models. Our use and transfer of Google API information will follow the Google API Services User Data Policy, including applicable Limited Use requirements.

18. MINIMUM AGE

1touch is intended for users aged 13 and older, or aged 14 and older if they live in South Korea. Children below the applicable minimum age are not permitted to create an account or use the Services, including with parental permission. Users who are minors under the law where they live must have the permission of their parent or legal guardian as required by our Terms of Service and applicable law. Where applicable law requires parental consent to process a child's personal information, that consent must be obtained and verified before the processing begins. If you believe that a child below the applicable minimum age has provided personal information to us, contact support@1touch.football so that we can investigate and take appropriate action, including deleting the child's account and personal information where required.

19. NON-PERSONALIZED ADVERTISING AND NOTIFICATIONS

1touch's advertising model uses non-personalized advertisements through Google AdMob. Non-personalized advertising does not mean that no data is processed: Google's Mobile Ads SDK may process IP addresses, approximate location inferred from IP addresses, device identifiers, advertising interactions, and diagnostic information to deliver ads, measure performance, and prevent fraud. Non-personalized ads use contextual information rather than your past behavior for ad selection. Identifiers can still be used for frequency limits and aggregate reporting. Required advertising consent and device permissions apply separately. 1touch does not request access to your device's precise GPS location. For push notifications, we process a generated installation identifier, notification token, device platform, language setting, and notification preferences using Firebase Cloud Messaging. You can manage notification permissions in your device settings.

Where provided, open Settings → About → Ad privacy choices to revisit the Google consent form. Your device settings also control notification permissions and supported advertising identifier controls. If a choice is unavailable or you need help, contact us. Refusing an advertising consent is separate from account deletion. Provider explanations: AdMob Android data, AdMob iOS data, and Google partner-service information.

20. HOSTING AND OPERATIONAL RETENTION

Our application server and account database are hosted using Amazon Web Services Lightsail in Seoul, South Korea. Account verification and recovery emails use Amazon Simple Email Service in the Seoul region. Profile photographs and community media are stored using Cloudflare R2. Cloudflare identifies our R2 bucket location as Asia-Pacific (APAC); this regional designation does not identify a specific storage country. Daily database backup files are subject to a fourteen-day retention schedule. Manual and deployment database backups are subject to a thirty-day retention schedule. Expired backups are removed during scheduled backup processing after a new backup has been successfully created and verified. Information associated with a deleted account may remain in backup copies until they are removed under the applicable retention schedule. Container service logs are rotated according to storage size rather than a fixed number of days. Account deletion and the treatment of published community content are described in the account deletion section of this policy. Contact support@1touch.football for a request concerning your personal information in retained copies.

Record-specific retention and deletion

Record	Current behavior
Verification codes and sessions	Verification codes expire after ten minutes and are removed when consumed. Sessions expire after thirty days and are removed on logout. The hourly maintenance job removes expired codes and sessions; expiration and physical deletion are separate events.
Abuse-prevention rate limits	Hashed scopes whose window began more than one hour ago are eligible for the hourly cleanup.
Unpublished drafts and unattached files	Seven days from the last draft save or file upload, followed by scheduled cleanup. Failed object deletions remain queued for another attempt.
Published posts and comments	Deleting a post clears its title/body and queues attached files for deletion; deleting a comment clears its body. Structural records can remain for thread relationships. Deleting an account instead removes its author association and may leave published content in place.
Points, predictions, follows, blocks and notification preferences	Account-associated records are removed on account deletion. An expired notification's delivery window does not mean its database record has been deleted.
Push registration	Removed on unregistering, logout/session deletion, or account deletion. Revoking OS notification permission alone is not a promise that all server notification records are erased immediately.
Moderation reports	Resolved reports become eligible for deletion by the hourly maintenance job 180 days after resolution (approximately six months). The job processes records in limited batches, so eligibility and physical deletion are separate events. Unresolved reports remain pending review. Account deletion clears reporter/reviewer account associations but may leave the report itself. Deleting a report does not delete the underlying post, comment, or chat message.
Social-provider deletion callbacks	Provider and hashed event identifier are retained to detect duplicate callbacks. The receipt does not store the original callback token or deleted account identifier. No automatic expiry is implemented.

Support correspondence. Our retention policy is to delete ordinary support correspondence 180 days after the inquiry is resolved. An unresolved inquiry remains open. We may retain only the records necessary for a specific legal duty, dispute, or privacy-rights request for the applicable period. This is our mailbox handling rule, not a claim that Porkbun erases every backup at the same time.

Provider copies. Removing a push registration from our database does not automatically erase Google's Firebase installation ID. Google's published FCM rule retains that ID until an installation-deletion API request; after such a request, removal from live and backup systems can take up to 180 days. Account deletion in 1touch does not currently initiate that separate installation-deletion request. Contact us for help with provider-held information. Cloudflare's data processing terms address deletion or return when the relevant service ends, with legal exceptions; they do not give us a verified fixed time for physical erasure of every copy after an individual file is deleted.

21. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

22. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at support@1touch.football.

1TOUCH FOOTBALL LLC
Contact person: June Jung
New York, United States

23. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please email support@1touch.football and describe your request.

24. REGIONAL NOTICES

The following regional notices supplement the full notice above. Your mandatory local rights prevail over any inconsistent wording. Our contact for privacy requests is June Jung, acting for 1TOUCH FOOTBALL LLC, at support@1touch.football; this is the operator's contact and is not a representation that a local representative has been appointed.

한국 이용자 안내

외부 게시글 미리보기: 커뮤니티의 X·Instagram 미리보기를 준비하거나 불러오면, 미리보기를 누르기 전에도 기기에서 해당 업체로 직접 연결합니다. 게시글 식별정보·IP·브라우저와 기기 정보·조회 및 성능 이벤트가 전달되며, Instagram 이벤트에는 해당 서비스가 만든 세션·기기 식별자가 포함될 수 있습니다. Google 비맞춤형 광고 설정과는 별개입니다. 업체별 개인정보처리방침과 자세한 내용은 5번을 확인해 주세요.

운영자·개인정보처리자: 1TOUCH FOOTBALL LLC, 미국 뉴욕주 설립 유한책임회사. 개인정보 문의 담당: June Jung, support@1touch.football. 이 버전의 최초 웹 게시일부터 기존 개인 운영자 June Jung을 대신해 회사가 1touch를 운영하고 개인정보를 처리합니다. 기존 이용자의 권리와 법령상 필요한 고지·동의 절차는 유지됩니다.

처리하는 정보와 목적: 이메일 가입 시 이메일·아이디·닉네임·비밀번호를 받아 계정 생성·인증·복구에 사용하며, 비밀번호는 해시로 저장합니다. 소셜 로그인은 선택한 제공자의 인증정보와 계정 식별자로 연결을 확인합니다. 프로필 사진·게시글·댓글·채팅·첨부, 팔로우·차단·신고·경기 예측·포인트 기록은 해당 기능과 안전한 운영을 위해 처리합니다. 기기 지역 설정의 국가 코드는 커뮤니티 포인트의 일일 기준에 사용하며 실제 위치나 국적을 증명하지 않습니다. API 요청의 IP·접속 기록과 보안용 정보를 처리합니다. 문의 시 발신 주소·내용·첨부를 문의 처리에 사용합니다.

앱 이용 분석: 로그인 상태의 업데이트된 앱에서 회원번호, 앱 실행·백그라운드 복귀, 조회한 화면·탭 식별자, 계측한 버튼 동작, 발생 시각, 활성 화면 체류시간을 API로 전송합니다. 기능 이용 현황 파악과 서비스 개선에 사용하며 권한이 있는 관리자가 회원별로 조회할 수 있습니다. 검색어·비밀번호·게시글·채팅 입력 내용이나 화면 녹화는 이용 분석 기록에 포함하지 않습니다. 계정 정보와 함께 보관하고 탈퇴 시 삭제하며 백업 보관 기준은 20번을 따릅니다. 광고 측정과는 별도입니다.

선택 기능: 소셜 로그인, 사진·동영상 업로드, Google Calendar 연결, 알림은 선택할 수 있습니다. 캘린더는 앱이 만든 캘린더에 경기 일정을 추가·갱신하며, 연결 해제 후 이미 추가한 일정은 Google Calendar에서 직접 삭제할 수 있습니다. 광고는 비맞춤형으로 요청하지만 Google이 IP 기반 대략적 위치·식별자·광고 반응·진단정보를 처리할 수 있습니다. 정확한 GPS·주소록·개인 기기 캘린더 접근 권한은 요청하지 않습니다. 선택 기능을 거부하면 그 기능이 제한될 수 있으며, 계정에 필요한 정보를 제공하지 않으면 계정 생성·관리가 어려울 수 있습니다.

위탁과 국외 처리: AWS Lightsail·SES는 서버·DB·백업과 인증 이메일을 위해 서울 리전을 사용합니다. 미국에 있는 운영자가 서비스 관리와 문의 응대를 위해 필요한 정보를 조회합니다. Cloudflare R2는 프로필·게시 첨부 저장, Google AdMob은 광고, Firebase Cloud Messaging은 알림, Porkbun은 문의 메일 보관·전달에 사용합니다. 선택한 로그인·캘린더 제공자는 연결 시 인증·연결정보를 처리합니다. 이용·업로드·로그인·문의 등 해당 기능을 사용하는 시점에 네트워크로 전송합니다. 업체별 항목·목적·연락 경로·확인된 위치는 9번 표, 보관 기준은 20번을 확인해 주세요.

현재 R2 표시는 APAC이며, 특정 저장 국가 목록은 확보하지 못했습니다. Porkbun의 미국 메일 접점은 확인됐지만 모든 메일함·백업·지원 접근 국가를 확인한 것은 아닙니다. Google 서비스도 미국을 포함한 여러 국가에서 처리될 수 있습니다. 이 설명을 국가가 확정됐거나 국외 이전에 필요한 별도 동의를 받은 것으로 간주하지 않습니다. 선택 기능을 사용하지 않거나 연결·권한을 해제할 수 있으며, 국외 처리에 관한 문의·거부·삭제 요청은 위 이메일로 접수합니다. 요청에 따른 영향은 해당 기능과 적용 법에 따라 안내합니다.

보관·파기: 계정 관련 정보는 계정 유지 중 보관하며 탈퇴 시 관련 기록을 삭제합니다. 인증코드 유효기간은 10분, 세션은 30일이며 만료된 기록은 시간별 작업으로 정리합니다. 미게시 초안·미사용 첨부는 7일 정리 기준, 처리 완료 신고와 일반 문의는 해결 후 180일 기준을 적용합니다. 일반 문의는 메일함에서 별도로 관리합니다. 일일 DB 백업은 14일, 수동·배포 백업은 30일이며 새 백업 검증 후 만료분을 정리합니다. 삭제 예약·보관 기간 만료와 모든 사본의 실제 삭제가 같은 순간에 이루어지는 것은 아닙니다. 보존이 필요한 법적 사유가 있으면 해당 정보만 목적과 기간을 제한해 보관합니다.

공개 글·댓글·채팅·첨부는 탈퇴 후 작성자 연결이 해제된 채 남을 수 있고, 본문에 쓴 개인정보까지 자동으로 지워지지는 않습니다. 공개 콘텐츠 삭제는 앱의 해당 기능을 이용하거나 대상을 적어 문의해 주세요. Google Calendar의 기존 일정과 외부 업체 기록은 별도 보관 기준을 따릅니다.

권리 행사: 본인 또는 적법한 대리인은 열람·정정·삭제·처리정지·동의 철회 등 적용되는 권리를 이메일로 요청할 수 있습니다. 요청 처리에 필요한 범위에서 본인 여부를 확인하고, 제한 사유가 있으면 설명합니다. 기본 최소 이용 연령은 만 13세이며, 한국 거주자는 만 14세 이상이어야 합니다. 해당 최소 연령 미만은 보호자 허락이 있어도 가입하거나 이용할 수 없습니다. 미성년자의 보호자 허락에 관한 이용약관도 적용됩니다. 개인정보 분쟁·침해 관련 안내는 개인정보보호위원회에서 확인할 수 있습니다.

日本の利用者へのお知らせ

外部投稿のプレビュー：コミュニティの X・Instagram プレビューを準備・読み込みすると、タップする前でも端末から提供元に直接接続します。投稿の識別情報、IP アドレス、ブラウザ・端末情報、閲覧・性能イベントが送信され、Instagram のイベントには同サービスが生成するセッション・端末識別子が含まれる場合があります。Google の非パーソナライズ広告設定とは別の処理です。提供元のプライバシーポリシーと詳細は 第5節をご確認ください。

運営者および個人情報の取扱主体は、米国ニューヨーク州で設立された 1TOUCH FOOTBALL LLC です。問い合わせ担当者は June Jung、連絡先は support@1touch.football です。本版のウェブサイト初回掲載日から、従来の個人運営者 June Jung に代わり当社が運営します。既存利用者の権利と、必要な通知・同意の手続きは維持されます。利用目的はアカウントの作成・認証・復旧、サッカー情報とコミュニティ機能の提供、予想・ポイントの管理、不正防止、問い合わせ対応です。広告はパーソナライズなしでリクエストしますが、Google は IP アドレス、識別子、広告への反応、診断情報などを処理する場合があります。

アカウントとコミュニティのデータは AWS のソウルリージョンで処理し、米国の運営者が必要な範囲で管理します。画像等は Cloudflare R2、通知は Firebase Cloud Messaging、広告は AdMob、問い合わせメールは Porkbun を使用します。任意のソーシャルログインや Google Calendar では選択した提供元にも接続情報を送ります。対象情報、利用目的、連絡先、所在地に関する情報は 第9節を参照してください。

R2 の表示は APAC で、個別の保管国は当社が利用できる資料では特定できません。Porkbun のメール接続先は米国ですが、すべてのバックアップやサポートアクセスの国を示すものではありません。Google の一部サービスも複数の国で処理します。一般的なデータセンター一覧を当社データの実際の所在国とみなすことはできません。これらの理由、提供元の公開情報、追加の保護措置についてはお問い合わせください。この説明だけで、法令上必要な同意を得たものとは扱いません。

開示、訂正、利用停止、消去、第三者提供の停止など、適用法上の権利は上記メールへ請求できます。必要な本人確認を行い、法令に従って対応します。任意機能の接続や通知権限は解除できます。退会時はアカウント関連情報を削除しますが、公開投稿等は関連付けを解除して残る場合があります。本文中の個人情報の削除も希望する場合は対象をお知らせください。バックアップは日次14日・手動等30日、解決済みの通報・通常の問い合わせは解決後180日の基準です。その他の詳細は 第20節を参照してください。原則として13歳以上、韓国に居住する場合は14歳以上が対象です。適用される最低年齢に満たない場合は、保護者の許可があっても登録・利用できません。未成年者は保護者の許可が必要です。適用法で子どもの個人情報の処理に保護者の同意が必要な場合は、処理の前に同意の取得と確認が必要です。

中国大陆用户说明

外部帖子预览：准备或加载社区中的 X、Instagram 预览时，即使尚未点击预览，设备也会直接连接相应服务商。连接会传送帖子标识、IP 地址、浏览器和设备信息，以及浏览和性能事件；Instagram 事件还可能包含该服务生成的会话和设备标识。这与 Google 非个性化广告设置是不同的处理。服务商隐私政策及详情请参阅第5节。

个人信息处理者为在美国纽约州设立的有限责任公司 1TOUCH FOOTBALL LLC。联系人：June Jung。联系方式：support@1touch.football。自本版本首次在网站发布之日起，公司接替此前的个人运营者 June Jung 运营 1touch。现有用户的权利及所需的告知、同意程序不受影响。

我们为账号注册、登录验证与找回、足球资讯与社区功能、预测积分记录、安全和客服处理账号及联系信息、认证信息、您发布的资料与内容、互动记录、设备与网络信息。选择第三方登录、上传媒体、推送通知或 Google Calendar 时，会处理相应的标识符、令牌、媒体或日历连接信息。我们请求非个性化广告，但 Google 仍可能处理 IP 推断的大致位置、设备标识符、广告互动和诊断信息。不请求精确 GPS、通讯录或设备个人日历权限，不从数据经纪商购买用户资料用于营销。

信息通过网络在使用相应功能时传输。账号、社区数据库和备份使用韩国首尔的 AWS 服务，美国的运营者按必要范围访问。Cloudflare R2 保存头像和社区媒体，Google AdMob 提供广告，Firebase Cloud Messaging 提供通知，Porkbun 处理客服邮件。选择的登录或日历提供方处理连接所需数据。境外接收方、处理目的、信息类型、联系方式和已知地点见 第9节。R2 的 APAC 标记未确定具体国家；Porkbun 的美国连接地点不证明全部存储和备份国家；Google 的相关服务可能在美国等多个国家处理。我们未把未确认的地点写成确定事实。

您可以请求查阅、复制、更正、补充、删除个人信息，撤回同意、注销账号，或要求解释处理规则。请联系上述邮箱；我们会在必要范围核实身份并按适用法律处理。可拒绝可选连接、上传或通知，或解除相关授权，但对应功能可能无法使用。对境外处理有异议或需行使权利，也可联系上述邮箱。本隐私政策和服务条款本身不替代法律要求的单独同意。

账号相关记录在注销时删除；已发布的帖子、评论、聊天和附件可能在解除账号关联后保留，内容内的个人信息不会因此自动消失。请使用应用内删除功能，或告知需要删除的具体内容。每日数据库备份按14天、手动及部署备份按30天周期保留；已解决的举报和普通咨询按解决后180天的规则处理。其他记录及外部服务商副本见 第20节。一般最低使用年龄为13周岁，居住在韩国的用户须年满14周岁。未达到适用最低年龄者，即使取得监护人许可，也不得注册或使用服务。未成年人须取得监护人许可。适用法律要求处理儿童个人信息须取得监护人同意时，应在处理前取得并核实该同意。

This notice was prepared using Termly and adapted to 1touch.