Privacy Policy

1. Who we are

HKPL Fantasy / 港超 Fantasy (the “Service”) is operated by Kinoko Studio (“we”, “us”). This policy explains what personal data we collect and how we handle it, in accordance with the Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap. 486).

2. Data we collect

• Account data: your email address, display name, and (if you sign up with Google) your Google account name.
• Gameplay data: your team name, squad selection, lineups, transfers, and scores.
• Supporter Pass records: if you take out a Supporter Pass, we keep a record of it in our own database: whether it was paid for or is a complimentary pass we granted, when it started, which ticket it is (Season Ticket or Month Ticket), its status, the date access runs to, whether it is set to stop renewing, and the reference numbers Stripe issues for it — the customer, and then either the subscription (Month Ticket) or the payment (Season Ticket). For a complimentary pass we also store a short internal note saying why it was granted, which administrator granted it, and the same details in our internal administrator log. We do not store your card number, your billing address, or the amounts you were charged — those stay with Stripe (see Section 4). For a Month Ticket bought in the iPhone app, the reference we keep is the transaction number Apple issues for the subscription, with a note of whether it was bought in Apple’s store or in its test environment; we hold no Stripe reference for it, and what you were charged stays with Apple.
• Usage analytics: page views, in-game actions (such as saving a squad, making transfers, playing a chip, creating or joining a league, sharing a card, starting or completing a Supporter Pass purchase, and opting in to marketing emails), sponsor views and clicks, and taps on partner links. None of these events carries your name, email or account identifier. Some of this is collected in aggregate by Google Analytics on our website, after you accept analytics cookies. Google Analytics does not run in the iPhone app. We also record sponsor views and clicks in our own database. We do not store your IP address, but to stop the same visitor being counted twice we store a short one-way code derived from it. That code is not reversible by us in normal use and is never linked to your account.
• Advertising (on our website): Google may show ads on some of our web pages. To show and measure them, Google collects details about your device and browser, your IP address and the pages you view, through its own cookies and similar technologies. It does this only after you answer our cookie banner: ads are personalised if you choose “Accept all”, and not personalised if you choose “Essential only”. Visitors in the EEA, the UK and Switzerland are shown limited ads only. The iPhone app shows no Google ads.
• Technical data: error reports and basic device and browser information collected via our error monitoring service for diagnostic purposes.
• Marketing consent: whether you have opted in to marketing communications, and when.
• Supporters list: your choices about our public supporters list and your supporter badge, and when you made them. While your Supporter Pass is active, your name is listed by default: the name you have set for the supporters list, or your display name if you have not set one, or your username if you have set neither. It is published on our About page, visible to anyone who opens it, signed in or not, and on the signed-in app home page. Your supporter badge is also shown beside your team name on the standings, on your team page, on your gameweek share card, on your manager card, and on your Season Wrapped card. Only the name and the badge appear: not your email address and not what you paid. The badge itself says which ticket you hold, a Season Ticket or a Month Ticket. You can keep your support private at any time from your Account page, which removes all of these.
• Prize delivery details: if you win a prize, the name and Hong Kong delivery address you give us so that it can be sent to you — or that your parent or guardian gives us, if you are under 18 and they claim it for you. We ask for these only after you have won, and only for that delivery. The rules are on our Prizes page; a league that runs its own prize states its terms on that league's page.
• Push notifications: if you allow notifications in the iPhone app, we store the push token Apple issues for your device, the app's build number, the language you use the app in, and when the app last registered it. We also keep a record of each notification we send you: what it was about, which device it went to, and whether Apple accepted it. We use these only to send the notifications you have turned on in Account → Notifications: deadline reminders and gameweek results, which are on unless you turn them off, and app announcements, promotions and price alerts, which are off unless you turn them on. Apple's Push Notification service delivers them, so Apple receives the token and each message. We stop sending to a token when Apple tells us it is no longer valid, and we delete your tokens, notification choices and that record with your account. When you turn promotional notifications on or off, we keep a record of that choice, the wording you saw, and when you made it.
• Session cookie: an authentication cookie issued when you log in.

We do not collect payment card details or government identity documents. Apart from a prize winner's delivery address, we collect no home address and no other sensitive category of personal data.

3. How we use your data

• To create and maintain your account and run the fantasy game.
• To keep the Service secure and diagnose technical problems.
• To understand how the Service is used and improve it.
• To send you transactional emails (e.g. password reset). Marketing emails are sent only if you opt in.
• To send the notifications you have turned on in the iPhone app. Promotional notifications are sent only if you opt in.
• To send you a prize you have won.
• To comply with our legal obligations, including any lawful requests from Hong Kong authorities (see Section 8 below).

We do not sell your personal data. Any marketing emails or promotional notifications, including offers relating to our sponsors, are sent by us; we do not share your personal data with sponsors, with one exception. If you win a prize, we give the partner that supplies or sends it the name and delivery address provided, so that the prize can reach you. We give them nothing else, and they may use it for that delivery only.

We send Google no account data. An ad request carries the address of the page, and no page that shows an ad has your email or username in its address. Google collects the advertising data described in Section 2 directly from your browser (see Section 4).

4. Service providers

We use a small number of reputable third-party providers to run the Service on our behalf, covering:

• authentication and database hosting (account management and data storage);
• application hosting and content delivery;
• payment processing for the Supporter Pass;
• delivering notifications to the iPhone app;
• aggregate usage analytics; and
• error reporting and diagnostics.

Each provider may only process your data on our instructions, under its own terms and privacy policy. These providers operate internationally, so your data may be processed on servers outside Hong Kong.

Except for a Month Ticket bought in the iPhone app, payments for the Supporter Pass are handled by Stripe. You enter your card details on Stripe’s own checkout page, and manage or cancel the subscription in Stripe’s customer portal; we never receive or store your card details. To set the subscription up we pass Stripe your email address and a reference to your account, and Stripe returns the subscription facts listed in Section 2. Stripe holds the payment method, the billing address you give it, and the invoice history under its own privacy policy.

A Month Ticket bought in the iPhone app is paid for through Apple, with the payment method on your Apple Account; we never receive or store your payment details. The only identifier we give Apple is an opaque reference to your account, a random-looking code that carries no name and no email address, which Apple attaches to the purchase so that we can tell whose it is. Apple tells us the subscription facts listed in Section 2, and notifies us when the subscription renews, lapses or is refunded. In taking that payment Apple is not one of the providers listed above: it acts for itself rather than on our instructions, and it holds the payment method, the purchase history and that reference under its own privacy policy.

A prize partner is not one of these providers. If you win, the partner that supplies or sends your prize receives your name and delivery address, and nothing else, so that the prize can reach you (Section 3). It acts for itself rather than on our instructions: we ask it to use those details for that delivery only, and anything it keeps afterwards is governed by its own privacy policy.

Google’s advertising service is not one of these providers either. When our website shows a Google ad, Google collects the data described in Section 2 directly from your browser and uses it under its own privacy policy: see how Google uses information from sites that use its services. You can turn off ad personalisation in My Ad Center, or change your answer to our cookie banner with “Cookie settings”.

5. Cookies

We use the following cookies:

• Authentication cookie: required to keep you signed in. Cleared when you sign out or after your session expires.
• Analytics cookie (website only): aggregate usage measurement, set only after you accept analytics cookies. It does not store your name or email; see section 2 for how we handle IP addresses.
• Preference cookies: remember your language and light/dark theme.
• Advertising cookies (Google): set by Google on our website to show and measure ads, and only after you answer our cookie banner. With “Accept all” they may be used to personalise ads. With “Essential only” Google uses them only to limit how often an ad repeats, to prevent fraud and to count views.

The iPhone app uses cookies for sign-in, security, language and theme preferences. It does not load Google Analytics or Google advertising, and does not use cookies to track you across other companies' apps or websites for advertising. There is no cookie-consent prompt in the app.

You can control or clear cookies in your browser settings. Deleting the authentication cookie will sign you out. On our website, to change your answer to our cookie banner, use “Cookie settings” at the foot of our public pages or on your Account page.

6. Data security

We take reasonable technical and organisational steps to protect your personal data against loss, misuse, and unauthorised access, including encryption in transit and access controls that limit access to those who need it. Our service providers are required to handle your data confidentially and only on our instructions. No online service can be guaranteed completely secure, but if a serious data breach occurs we will take appropriate steps and notify affected users and the Privacy Commissioner where appropriate.

7. Links to other sites

The Service may contain links to third-party websites, including sponsor links. We do not control those sites and are not responsible for their content or privacy practices. When you follow such a link, that site's own privacy policy applies, so please review it.

8. Law enforcement and legal disclosure

We operate under the laws of the Hong Kong Special Administrative Region. We may be legally required to disclose user data and content to law enforcement or other relevant authorities, and will comply with lawful orders and requests.

We may also disclose data where necessary to protect the safety of users or the public, or to defend against legal claims.

9. Retention

We keep your account and gameplay data while your account is active. If you ask us to close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it by law.

Prize delivery details are kept only for the delivery they were given for. We delete them once the prize has been delivered or returned to us, and in any case within 90 days of it being sent.

You can permanently delete your account and all associated data yourself at any time from your Account page. This removes your profile, your fantasy data (team, squad, leagues, and scores) and your Supporter Pass record. If you have a Month Ticket paid through Stripe, we cancel the subscription with Stripe first; if that cancellation cannot be completed the deletion stops rather than leaving you subscribed with no account to manage it from. A Season Ticket is a single payment with no subscription behind it, so there is nothing to cancel and nothing to hold the deletion up. A Month Ticket bought in the iPhone app is billed by Apple, and we cannot cancel it for you: deleting your account does not cancel it, so cancel it in your Apple Account settings first. We say so again before you confirm the deletion. Apple keeps its own record of the purchase, including the account reference we gave it, under its own privacy policy, and deleting your account does not remove it. Until the subscription ends, Apple goes on sending us notices about it; with your account gone they match no one, and all we keep from them is a line in our error log carrying Apple’s transaction number. Limited information may remain briefly in backups, and we may retain data where the law requires.

10. Your rights under the PDPO

Under the Personal Data (Privacy) Ordinance you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate personal data.
• Withdraw consent to marketing communications at any time via your Account page or by contacting us.
• Withdraw consent to appearing on the public supporters list at any time from your Account page, which takes your name off it.

You can update your own account details (such as your display name) at any time from your Account page.

To exercise these rights, contact us at connect@kinokostudio.com.hk. We will respond within 40 days as required by the PDPO.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has registered, contact us and we will remove the account.

12. Changes to this policy

We may update this policy at any time. Material changes will be posted here with an updated date. Continued use of the Service after changes are posted means you accept the revised policy.

13. Contact

For privacy questions, data access requests, or complaints: connect@kinokostudio.com.hk

You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).