Privacy policy

If you browse without an account: nothing that identifies you. Your 18+ confirmation and your card or table preference are stored in your own browser, not on our servers.

If you create an account: your email address, a display name if you set one, and a phone number if you choose to add one for SMS alerts.

If you buy a pass: a record that the pass exists, the day it covers, and a reference to the transaction with our payment processor. We never see or store your card details.

As you use the product: the slips you save and your notification preferences.

To give you access to what you paid for, to send the alerts you asked for, to show you your own saved slips, and to answer you when you get in touch. That is the whole list.

We do not sell personal data. We do not share it with advertisers. We do not build advertising profiles.

Our database and authentication run on Supabase. Payments are processed by Paystack. Fixture data comes from API-Football, which receives no information about you, we ask it about matches, not about people. Email and SMS alerts are delivered by a messaging provider that receives only the address needed to deliver them.

Account data stays until you ask us to delete it. Pass and payment records are kept for as long as accounting and tax obligations require, which is typically several years and is not something we can waive on request.

You can edit your profile and turn any alert off from your account page at any time. Two things you no longer need to ask us for: Download my data gives you everything we hold about you as a file, and Delete my account removes it. Both are on your profile page and neither needs our involvement.

Deleting removes your profile, slips, preferences and play limits immediately. Payment records are kept but unlinked from you: they are financial records we are required to retain, and they no longer identify you once the account is gone.

Clearing your browser storage removes the 18+ confirmation and view preference held on your device.

Where data-protection law applies to you, and it does under Ghana’s Data Protection Act and under the UK and EU GDPR, you have the right to be told what we hold, to get a copy of it, to have it corrected, to have it erased, to restrict or object to how we use it, and to take it elsewhere in a portable form.

The copy and the erasure are both self-service on your profile page, so exercising those two takes a click rather than a request. For anything else, write to hello@kicka.app and we will answer within 30 days, which is the outside limit the law allows rather than how long we intend to take.

We rely on two lawful bases. Running your account and taking payment for a pass is performance of a contract, you asked us for the service and we cannot provide it otherwise. Keeping the service secure and working is our legitimate interest. Where we ask for consent, for SMS alerts, you can withdraw it from your profile and it takes effect immediately.

If you think we have handled your data badly, tell us first so we can put it right. You are also entitled to complain to the Data Protection Commission in Ghana, or to the supervisory authority where you live.

Access to your data is enforced in the database itself through row-level security, not only in application code, so a bug in the interface cannot expose another user’s slips, passes or payments. If you believe you have found a way around that, please write to security@kicka.app before telling anyone else.

Kicka is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

If this policy changes materially we will say so in the product before the change takes effect. Questions go to hello@kicka.app.