Privacy Policy for BELGRAND ScoreMaster

Effective date: 11 August 2026 · Applies to the ScoreMaster mobile app, desktop app and online service

1. Who we are

BELGRAND ScoreMaster ("ScoreMaster", the "Service") is a sports score and competition management platform operated by ANTENA NET d.o.o. Teslić, Bosnia and Herzegovina, doing business under the brand BELGRAND (belgrand.net). ANTENA NET d.o.o. Teslić is the data controller for the personal data described in this policy.

For any privacy question or request, contact us at [email protected].

2. What this policy covers

This policy applies to all parts of the ScoreMaster platform:

• the ScoreMaster mobile app for Android and iOS (viewing live results, match details and receiving notifications; competition management for authorised staff);
• the ScoreMaster desktop app for scorekeepers and venue operators (match control, scoreboards, live data entry);
• the ScoreMaster online service (API and websites at scoremaster.belgrand.net and media served from cdn.belgrand.net).

3. Data we collect

3.1 Account data

ScoreMaster accounts are created for competition staff (organisers, coaches, referees and administrators) by their sports organisation or by BELGRAND. There is no public self-registration. For account holders we process: username, password (stored only as a salted bcrypt hash, never in plain text), first and last name, date of birth, e-mail address (optional, used for password reset) and an optional profile photo.

3.2 Competition content

Authorised staff enter data needed to run competitions. This may include personal data of participants: player first and last name, date of birth, jersey number, licence number and optional photo; coach, referee and responsible-person names; team, league and tournament details (including club logos and venue locations); match events, scores, penalties, comments and official match reports (PDF). This data is provided by clubs and organisers, who are responsible for having the right to submit it (see section 10).

3.3 Collected automatically: mobile app

• Push notification identifiers. The app uses Google Firebase Cloud Messaging to deliver match notifications. Firebase generates a device registration token and installation ID and processes them on Google's servers. Notifications are delivered through subscription topics; we do not store your push token on our servers.
• Usage analytics. The mobile app includes Google Analytics for Firebase, which automatically collects an app-instance ID, the device advertising identifier, coarse device information (model, operating system, app version, country) and app-interaction events such as first open, sessions and screen views. We use this solely to understand how the app is used and to improve it. We do not use this data for advertising and the app contains no ads.

3.4 Collected automatically: desktop app

• Device identifier (licensing). The desktop app is licensed per device. At start-up it reads the operating system's machine identifier (machine UUID) and sends it to our licence server to verify that the device holds a valid licence. This identifier is linked to the licensed customer account, and the service records the time of the device's last activity to prevent simultaneous use of one licence on multiple devices.
• Match data. Scores, match events and line-ups entered at the venue are transmitted to the Service in real time.
• Software updates. At start-up the app checks a public update server for a newer version. This is an anonymous request; like any web request, the hosting provider's standard server logs record IP address, user agent and the requested file.
• Fonts. The desktop app loads its display font from Google Fonts, which involves a standard web request (IP address, user agent) to Google's font servers.
• Local data. Match state backups (kept locally for 30 days), cached team and player images, layouts and diagnostic logs are stored only on the device and are not transmitted by the app.

3.5 Server infrastructure logs

Our servers run on Cloudflare's edge network. Cloudflare processes standard request metadata (such as IP address, user agent and timestamps) for security, abuse prevention and operational monitoring, as any web infrastructure does. We do not build user profiles from these logs.

4. Why we process data

5. Public information

ScoreMaster publishes sports competition information. Match results, schedules, team rosters, player names and jersey numbers, coach and referee assignments and match events are visible to anyone using the app or the Service, in the same way results are published in any public sports competition. If you believe specific information about you should not be public, contact us or your sports organisation.

6. Who we share data with

We do not sell personal data and we do not share it with advertisers. Data is shared only with service providers (processors) that we use to run ScoreMaster:

We may also disclose data where required by law or to protect the rights, safety or property of BELGRAND, our users or the public.

7. International transfers

The Service runs on Cloudflare's global network and Google processes Firebase data on its own infrastructure, so data may be processed outside your country, including outside the EU/EEA. Our providers rely on recognised transfer safeguards (such as EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, where applicable). Update distribution and legacy licence records are hosted in Germany.

8. How long we keep data

• Accounts and competition content are kept while the organisation uses ScoreMaster. When an administrator deletes an account, player or other record, it is permanently removed from the database.
• Login sessions: access tokens are valid for 15 minutes, refresh tokens for 30 days.
• Password reset links expire after 60 minutes and are deleted once used.
• Push notification tokens are not stored on our servers; they live only on your device and with Google Firebase.
• Local desktop backups of match state are deleted automatically after 30 days.
• Historical results (scores, match events) may be retained as part of the public sports record of the competition.

9. Security

All communication between the apps and the Service uses encrypted connections (HTTPS/TLS). Passwords are stored only as salted bcrypt hashes. Access to management functions is role-based, and sessions use short-lived tokens. No method of transmission or storage is 100% secure, but we apply commercially reasonable measures appropriate to the data we process and we review them continuously.

10. Children and player data

Competition rosters may include minors (youth players). This data is entered by the player's club or the competition organiser, not collected from children directly, and is limited to what is needed to run the competition (name, date of birth, jersey and licence number, optional photo). Clubs and organisers are responsible for informing players and, for minors, obtaining parental or guardian consent before submitting their data. The ScoreMaster apps themselves are not directed at children and do not knowingly collect personal data from children as users. If you are a parent or guardian and believe a child's data should be corrected or removed, contact us at [email protected] and we will act promptly.

11. Your rights

Subject to applicable data protection law (including the Law on Protection of Personal Data of Bosnia and Herzegovina and, where it applies, the EU GDPR), you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data ("right to be forgotten");
• object to or request restriction of certain processing;
• lodge a complaint with your data protection authority.

Because accounts are managed by sports organisations, some requests (for example deleting a staff account or a player record) are handled together with your club or organiser. To exercise any right, e-mail [email protected] from the address associated with your account, or contact your organisation, and we will respond without undue delay.

12. Notifications and your choices

• Push notifications are optional: decline or revoke the notification permission in your device settings, or unfollow matches in the app.
• You can limit or reset the advertising identifier used by analytics in your device's privacy settings (Android: "Delete advertising ID"; iOS: App Tracking settings).
• The mobile app can be used for viewing public results without creating an account.

13. Changes to this policy

We may update this policy as the Service evolves. The current version, with its effective date, is always available at this address. For significant changes we will additionally inform users through the apps or through their sports organisation.

14. Contact

ANTENA NET d.o.o. Teslić (BELGRAND)
Bosnia and Herzegovina
E-mail: [email protected]
Website: belgrand.net