Privacy policy
Cover Esports — Version 1.0
In force as of 2 September 2026
1. Who is responsible for your data
LA2S Co., a simplified joint-stock company with a share capital of EUR 1,000, Créteil Trade and Companies Register 108 765 207, intra-EU VAT FR49108765207, registered office 110 Rue de Fontenay, CS 20010, 94300 Vincennes, is the controller of the personal data collected through Cover Esports, available on iOS, Android and on the cover-app.fr website.
Contact: privacy@cover-app.fr
LA2S Co. has not appointed a data protection officer, such an appointment not being mandatory in view of its activity.
This policy applies to all three channels. Where a processing operation concerns only one of them, this is specified.
2. What we collect and why
2.1 Use without an account
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address and browser header, in our server logs | Security, abuse prevention, diagnostics, legal obligations | Legitimate interest and legal obligation | 12 months |
| Technical data (device model, system version, browser, application version, language) | Compatibility, diagnostics, fixing defects | Legitimate interest | 12 months |
| Local preferences (interface language, spoiler-free mode, offline favourites, screens already seen) | Operating the service and remembering your settings | Legitimate interest (providing the service requested) | On your device, until uninstallation or erasure |
| Saved Data Studio queries (web) | Finding your analyses again from one session to the next | Legitimate interest | In your browser only, never transmitted to our servers |
| Anonymous billing identifier (web) | Avoiding the creation of a billing customer on every visit | Performance of the contract | Until the browser storage is cleared |
| Advertising identifier (IDFA on iOS, AAID on Android) and advertising trackers (web) | Personalised advertising, performance measurement | Consent | Until consent is withdrawn, and for no more than 6 months before being asked again |
| Consent preferences | Retaining and applying your choice, and providing evidence of it | Legal obligation | Until withdrawal, and for no more than 6 months |
2.2 Use with an account
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username, email address, password (stored as a hash) | Account creation and management | Performance of the contract | Lifetime of the account |
| Identity token issued by Apple or Google where those services are used to sign in | Authentication | Performance of the contract | For the duration of authentication |
| Age declaration | Verification of the minimum age, adaptation of advertising | Legal obligation and legitimate interest | Lifetime of the account |
| Favourites (teams, leagues, series) and notification preferences | Personalisation of the service and of alerts | Performance of the contract | Lifetime of the account |
| Your device's notification token (APNs on iOS, FCM on Android), device platform and time zone | Sending the notifications you have enabled, at the correct local time | Performance of the contract and consent (system permission) | Lifetime of the account, or until uninstallation |
| Widget installation identifier (iOS) | Feeding your device's widgets and Live Activities | Performance of the contract | Duration of installation |
| Dashboards created and published | Provision of community features | Performance of the contract | Lifetime of the account or until withdrawal |
| Subscription status and purchase identifier | Unlocking the features taken out across all your devices and removing advertising | Performance of the contract | Lifetime of the account + 5 years |
| Reports made and received, moderation decisions | Content moderation, DSA obligations | Legal obligation and legitimate interest | 3 years |
| Exchanges with support | Handling your requests | Legitimate interest | 3 years |
2.3 What we do not collect
We do not collect your geolocation. We access neither your camera, nor your microphone, nor your photos, nor your contacts, nor your calendar: the application requests none of these permissions.
We collect no sensitive data within the meaning of article 9 of the GDPR.
We have no access to any payment data. Your bank details are processed exclusively by Apple, Google or our payment provider, depending on your purchase channel.
3. Advertising
The free tier is funded by advertising, on all three channels.
| Channel | Ad network | Consent collection |
|---|---|---|
| iOS and Android | Google AdMob | Google User Messaging Platform (UMP) |
| Web | Google AdSense | Google Privacy & messaging |
Both of these consent collection tools are certified by Google and comply with the IAB Europe Transparency and Consent Framework (TCF v2.2).
No advertising tracker is activated and no advertising script or SDK is initialised before you have answered the consent dialog. If you refuse, you continue to see advertising, but it is not personalised and relies neither on your advertising identifier nor on tracking cookies.
Your choice is recorded per device and per browser, not per account. If you use Cover Esports on several devices, your consent will be requested on each of them. This is a requirement of the applicable regulations, consent relating to the terminal used.
On mobile, your choice is kept on the device. Uninstalling erases it and you will be asked again on reinstallation. On the web, it is kept for a maximum of six months.
You can change your choice at any time from Settings > Manage my consents in the application, or from the Cookie management link in the website footer.
No profiling-based advertising is served to underage users, on any channel.
The No Ad, Plus and Max subscriptions remove advertising display across all channels. For subscribers, no advertising script is loaded.
4. Storage on your device, cookies and trackers
4.1 What we store ourselves
On mobile, your sign-in tokens are kept in the system's secure store (Keychain on iOS, encrypted Keystore-backed storage on Android). Your display preferences and your favourites are kept locally to allow offline operation.
On the web, your sign-in tokens, your language, your anonymous billing identifier and your saved Data Studio queries are kept in your browser's local storage.
These items are necessary for the service to work and do not require your consent.
4.2 Cookies and trackers subject to consent
Advertising and audience measurement trackers are set or read only after your agreement, expressed through the consent dialog. You may change your choice at any time.
4.3 Resources loaded from third parties
Certain display elements are loaded from third-party servers. By technical design, those servers then receive your IP address and the information transmitted by your browser or your application. These resources are detailed in article 5.
4.4 Permissions and consent
We distinguish system permissions (notifications, advertising tracking on iOS) from consent to the processing of your data. Granting a permission does not amount to consent, and vice versa.
5. Recipients, processors and third-party resources
5.1 Providers processing data on our behalf
| Provider | Role | Channel | Location |
|---|---|---|---|
| OVH SAS | Hosting of our infrastructure and databases | All | France (Strasbourg) |
| RevenueCat, Inc. | Management of subscriptions and their status | All | United States |
| Apple (APNs) | Notification delivery | iOS | Ireland and outside the EU |
| Google (Firebase Cloud Messaging) | Notification delivery | Android | Ireland and outside the EU |
| Google Ireland Ltd. (AdMob and User Messaging Platform) | Advertising delivery and consent collection | iOS, Android | Ireland and outside the EU |
| Google Ireland Ltd. (AdSense and Privacy & messaging) | Advertising delivery and consent collection | Web | Ireland and outside the EU |
5.2 Third-party services acting on their own behalf
| Third party | Role | Channel | What it receives |
|---|---|---|---|
| Apple Distribution International Ltd. | Distribution and sale of subscriptions | iOS | Transaction data |
| Google Commerce Ltd. | Distribution and sale of subscriptions | Android | Transaction data |
| Stripe | Sale of subscriptions and payment processing on the web | Web | Transaction and payment data |
| Apple (Sign in with Apple) | Authentication | iOS, Web | Elements of the authentication session |
| Google (Sign in with Google) | Authentication | iOS, Android | Elements of the authentication session |
5.3 Resources loaded from third-party servers
These servers receive no data from your account. They do, however, receive your IP address and the information transmitted by your browser or your application, purely as a result of the connection.
| Resource | Provider | Channel |
|---|---|---|
| Team, league and competition logos, player and champion portraits | PandaScore SAS (image delivery network) | All |
| Player nationality flags | Flagpedia (flagcdn.com) | Web |
5.4 A note on PandaScore
PandaScore is our competition data supplier. We transmit no data relating to your account or to your use of the service to them. No request is sent from your device to their application programming interface: our servers alone query PandaScore, with our own credentials.
Images (logos, portraits), on the other hand, are loaded directly from their delivery network. That network therefore receives your IP address whenever one of those images is displayed, as would any third-party image server.
5.5
We do not sell your personal data.
6. Transfers outside the European Union
Certain providers are established in the United States or transfer data there. These transfers are governed by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework, depending on the provider.
You may obtain a copy of the applicable safeguards by writing to privacy@cover-app.fr.
7. Retention periods
The periods applicable to each category appear in the tables in article 2.
When your account is deleted, your data is erased or anonymised within 30 days, with the exception of:
- data necessary to comply with a legal obligation, in particular accounting and tax obligations;
- items strictly necessary to establish, exercise or defend a legal claim;
- moderation decisions and the associated reports, retained in accordance with the obligations of Regulation (EU) 2022/2065;
- published dashboards that you have chosen to leave online, dissociated from your identity.
An account inactive for 36 months is the subject of a reminder, then of deletion failing any response.
8. Your rights
You have the following rights:
- access to your data;
- rectification of inaccurate data;
- erasure in the cases provided for by law;
- restriction of processing;
- objection to processing based on our legitimate interest;
- portability of the data you have provided to us;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing;
- setting instructions as to the fate of your data after your death.
Several of these rights can be exercised directly from the service, on all three channels:
- viewing and changing your username, your email address and your password;
- exporting all of your data from your account settings;
- managing your consents;
- deleting your account.
For other requests: privacy@cover-app.fr. We respond within one month, extendable by two months for complex requests.
You may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
9. Minors
Creating an account is reserved for persons aged at least 15, on all three channels.
Schedules and results can be consulted without an account and without any collection of identifying data.
When the declared date of birth indicates an age under 18, advertising is never personalised: neither advertising consent nor tracking permission is requested.
If we become aware of the collection of data relating to a person under the age of 15 without the consent of the holder of parental authority, we delete it. Any alert to that effect may be sent to us at privacy@cover-app.fr.
10. Security
We implement appropriate technical and organisational measures: encrypted communications between the application and our servers, sign-in tokens kept in the system's secure store on mobile, passwords stored as hashes, environment partitioning, access management, logging and regular backups.
In the event of a data breach liable to result in a high risk to your rights and freedoms, you will be informed as soon as possible.
11. Automated decisions
We take no decision producing legal effects concerning you on the sole basis of automated processing.
12. Changes to this policy
We may amend this policy. Any substantial change is signalled to you in the application or by email at least fifteen days before it takes effect.
The date of last update appears at the top of the document.