1. Who operates ArenaBell
ArenaBell is operated by Kineto Soft (Ugur Akcelik), based in Turin, Italy. The operator's VAT identification number is IT12938420010. Kineto Soft is the data controller for personal data processed through ArenaBell. For privacy matters, contact info@kineto-soft.com or PEC ugurakcelik@pec.it. For app support, contact info@kineto-soft.com or use the Support page.
2. Information the app handles
Google sign-in and ArenaBell account
When you sign in with Google, ArenaBell's server verifies a Google ID token and receives the Google account's subject identifier, display name, and verified email address when Google supplies one. ArenaBell creates an internal account ID and stores the Google issuer and subject, display name, optional email address, and account creation time. ArenaBell does not store your Google password or keep the Google ID token as a permanent credential.
Sessions and authentication
ArenaBell issues its own short-lived access token and a rotating refresh token. The Android app keeps the access token in memory and stores the refresh token in Android SecureStore. The server stores a SHA-256 hash of the refresh token, its creation and expiry times, and any revocation time. The configured refresh lifetime is 30 days; signing out revokes that session. The access token includes ArenaBell user and session identifiers and expires after 15 minutes.
Favorites, calendar and reminders
If you use an account, ArenaBell stores the events you favorite and the reminder lead times you choose for eligible scheduled events. A reminder record includes the event, lead time, calculated reminder time and status. The calendar is a view of your favorites; it is not a separate calendar account or a calendar-provider connection. On Android, you can opt in to register this installation for event reminders. Delivery depends on notification permission, the configured delivery service, network availability and device behavior, and is not guaranteed.
Device, location and technical data
The app does not request location permission or send a hardware identifier, operating system version or app version to ArenaBell. If an Android user explicitly enables notifications, the app sends a random installation identifier and Expo push token to the authenticated ArenaBell API. Push tokens are not exposed by the API. Event times are displayed using the device's local timezone; that timezone is not sent to ArenaBell.
Search sends the entered text to the ArenaBell API to search canonical participants, competitions and upcoming events. ArenaBell does not persist search terms or forward them to sports providers.
The app has no analytics, advertising, crash-reporting or tracking SDK configured. The public website uses no analytics, advertising pixels or non-essential cookies. When you connect to our website or API, our servers and reverse proxy receive standard technical connection data such as your IP address and request headers. This connection data is processed strictly to transmit requests, detect malicious activity, and ensure service reliability; technical logs are automatically purged within 30 days.
3. How information is used
- To authenticate you and maintain ArenaBell sessions.
- To save and show your favorites, calendar view and reminder preferences across sessions.
- To protect account access, validate requests and operate the service.
- To show sports schedules and event details synchronized by ArenaBell.
4. Legal bases
For users in the European Economic Area (EEA), we process personal data under the following legal bases under GDPR Article 6:
- Performance of a contract (Art. 6(1)(b)): Processing account information, favorites, follows, and saved reminder preferences to provide the ArenaBell services you request.
- Consent (Art. 6(1)(a)): Delivering push notifications to your Android device when you explicitly grant notification permission and enable reminders. You can withdraw consent at any time by disabling notifications in app or system settings.
- Legitimate interests (Art. 6(1)(f)): Maintaining service security, preventing abuse, authenticating sessions, and operating our infrastructure securely.
6. Security
Protected API routes require a valid, active ArenaBell session. All API and web communications are encrypted in transit using HTTPS/TLS. Access tokens are short-lived (15 minutes), and the server stores SHA-256 hashes of refresh tokens rather than plaintext tokens. We implement technical and organizational measures to safeguard user data, but no electronic transmission or storage system can be guaranteed completely invulnerable.
7. International processing
ArenaBell servers and databases are hosted within the European Union (Germany / Italy). Google identity services may process authentication tokens internationally in accordance with Google's privacy policies and applicable data protection frameworks, including standard contractual clauses.
8. Retention
We retain personal data only for as long as necessary to provide the service and fulfill the purposes described in this policy:
- Account profile, favorites, follows and reminders: Retained while your account remains active. Permanently deleted immediately when you delete your account.
- Session credentials: Access tokens expire after 15 minutes. Refresh session credentials expire after 30 days or immediately upon sign-out or account deletion.
- Server and proxy logs: Retained for up to 30 days strictly for operational integrity, security, and abuse prevention, after which they are deleted.
- Database backups: Encrypted system backups are retained on a rolling cycle of up to 30 days before being overwritten.
9. Account and data deletion
While signed in, use Account → Delete account in the app to permanently and immediately delete your ArenaBell identity, sessions, favorites, reminders, follows, automatic reminder preferences, suppressions, registered devices, and notification delivery records. Shared sports events and canonical public sports data are not affected. Deleting your ArenaBell account does not delete your Google account.
If you have uninstalled the app or cannot sign in, you can request full account and data deletion by emailing info@kineto-soft.com from your registered Google account email. The Delete your ArenaBell account page explains what to include and provides a prefilled email link. Verified requests are processed within 7 business days.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete or restrict personal data, object to certain processing, and receive a portable copy. You may also have the right to complain to your data protection authority. Contact info@kineto-soft.com or PEC ugurakcelik@pec.it to make a request. In Italy, you may also lodge a complaint with the Garante per la protezione dei dati personali.
11. Children
ArenaBell is intended for general audiences aged 13 and older (or 16 and older in the European Economic Area). We do not knowingly collect, maintain, or solicit personal data from children under these ages. If you believe that a child has provided us with personal information, please contact us at info@kineto-soft.com so we can delete that data immediately.
12. Changes to this policy
We will update this page when ArenaBell's data practices change. The effective date at the top will show when the current version took effect.
13. Contact
For privacy matters, contact Kineto Soft at info@kineto-soft.com or PEC ugurakcelik@pec.it. For app and account support, contact info@kineto-soft.com or visit the ArenaBell Support page.