Skip to content
torcida.ai

Legal

Privacy Policy

How TORCIDA.ai collects, uses and shares information about people who use the app and this site with a United States account.

Draft for legal review. This English version was prepared on October 13, 2026 as a working draft, following common U.S. practice (CCPA/CPRA, other state privacy laws and COPPA), and has not yet been reviewed by our legal counsel. Items marked [PENDING] are open. It applies to accounts created with the United States option at sign-up; accounts created in Brazil are covered by the Portuguese Privacy Policy.

Version US-2026-10 · Effective [PENDING: publication date] · TORCIDA.AI TECNOLOGIA LTDA (CNPJ 69.028.300/0001-85)

In one minute

To let you play, we keep your sign-up details (first and last name, email, age range — never your date of birth — and, if you add them, phone number, gender, state and city), what you post and send in the app, your answers and points, and usage records that do not identify your device.

We use this to run the app, keep one account per person, measure use and report to sponsors in aggregate numbers only. We do not sell your personal information, do not share it for targeted advertising, do not use advertising trackers and do not read your conversations.

Your data is stored in Brazil (São Paulo), with account emails sent from the United States. You can see, correct and delete your account in the app or by email, and reach us at [PENDING: privacy@torcida.ai].

Controller: TORCIDA.AI TECNOLOGIA LTDA · CNPJ 69.028.300/0001-85 · contact: kaio@torcida.ai.

  1. 1.Who we are and what this policy covers

    TORCIDA.AI TECNOLOGIA LTDA, CNPJ 69.028.300/0001-85, [PENDING: full address], Brazil ("TORCIDA.ai", "we") is responsible for the personal information described here. Privacy contact: [PENDING: privacy@torcida.ai]. Support: [PENDING: support@torcida.ai].

    This policy covers the TORCIDA.ai app (iPhone and Android), the torcida.ai website (waitlist and contact form) and the Moments player that the app opens from our domain dashboard.torcida.ai, for people who use them with a United States account. Accounts created in Brazil are covered by the Portuguese Privacy Policy (https://torcida.ai/privacidade). This policy is written to meet the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the comprehensive privacy laws of other U.S. states and the Children's Online Privacy Protection Act ("COPPA"). [PENDING: counsel to confirm which state laws apply to us given our size and number of U.S. users.]

  2. 2.Information we collect

    Sign-up and account:

    • Email address and password (we store only a cryptographic hash of the password, never the password): to sign in, confirm the account, recover the password and send account notices.
    • First and last name: to identify the account holder and contact you.
    • Date of birth: to check the minimum age. We keep only your age range, not the date.
    • Phone number (optional, U.S. format): to contact you about a reward.
    • Gender, state and city (optional): to understand our fans and, in the future, personalize content; not used for anything today.
    • Who referred you (@username, optional): to measure where sign-ups come from and recognize the people who refer the most. Only our team sees who referred whom (each lookup is logged); the person who referred you is not told it was you.
    • Version and date of your acceptance of the Terms: as proof of acceptance.

    United States accounts do not provide a Social Security number, a Brazilian CPF or any government identification.

    Profile and content you create: display name, @username, profile photo, bio, favorite club and favorite teams; messages and photos sent in conversations and groups; posts, comments and photos in the Social tab; reactions; answers to Moments (predictions, trivia, polls, picks, brackets, scratch cards); points and statement; reward exchanges; reports, blocks, mutes and appeals you make. The app removes location and camera metadata from photos before uploading them.

    What other users can see:

    • Your display name, @username, photo, bio and favorite club on your profile (and, when the app shows them, the Rewards items you equip).
    • Your profile photo is stored at a public address: anyone with the link can see it, even without signing in.
    • Posts, comments and their photos, only to people you accepted as followers (every follow request needs your approval, with a public or private profile). A private profile also removes you from search by @ and closes your follower and following lists to people who do not follow you.
    • Messages and photos in conversations and groups, only to the participants.
    • The points balance on your Social profile follows the "Show my balance" preference. Leaderboards do not depend on it: if you are in the Top 10 of a period, your display name and score are visible to all signed-in users; your friends (people you follow who follow you back) see your score in the Friends leaderboard; all members of a conversation see yours in that conversation's leaderboard; ranked Moments show a Top 10 of correct answers.
    • If you win a ranked Moment, your display name and @username appear as the winner at the top of that Moment's leaderboard. In follow suggestions, a favorite team you have in common with another person may be shown.

    Usage information: sessions (when the app opened and closed, and that it is the mobile app), used to measure active users and retention in aggregate; usage events from a closed catalog (for example: answered a Moment, reacted in a channel, followed someone, saw a sponsored Moment), which store internal identifiers, never the text you typed, your location or device data; and Moment delivery (whether a Moment was sent to, seen, opened and answered by you).

    Technical information: the app does not collect advertising identifiers, device identifiers, device model, GPS location or your contacts. Like any internet service, our servers and providers record your IP address and browser or app identification (which includes the operating system and app version). We keep access records (date, time and IP of each app opening and each opening of the Moments player) for 6 months, for security and to respond to legal process, and then delete them.

    Rewards: United States accounts cannot redeem physical prizes at launch. If that changes, we will ask for the information needed to deliver a prize (name confirmation, address, size) under the Official Rules of that promotion and keep delivery records for the legally required period.

    Website: on the waitlist and contact form we keep the email and/or phone number, name, favorite club, organization and message you provide, the page you came from and the version of the consent text you accepted, to talk to you about the launch and your request.

  3. 3.How we use information

    To provide and operate the Service (accounts, sign-in, Moments, points, leaderboards, conversations, the Social tab, Rewards); to keep one account per person and prevent fraud, multiple accounts and automation; to moderate the Social tab and reported messages and keep the community safe; to send account emails (confirmation, password recovery) and in-app notifications; to measure use and improve the product, in aggregate; to measure and report on sponsored content, in aggregate (section 5); and to comply with the law, enforce our Terms and protect rights and safety. We do not use your information for targeted advertising or for automated decisions that have legal or similarly significant effects on you.

  4. 4.What we do not do

    • We do not sell your personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined by the CCPA, and we have not done so in the preceding 12 months.
    • We do not use third-party advertising, analytics or tracking SDKs in the app and do not combine your information with other companies' data for advertising. There is no tracking across apps and websites.
    • There are no in-app purchases: we do not process card or payment data.
    • We do not use information about users under 18 for advertising profiles and do not show them advertising chosen for them.
    • We do not read your conversations and groups and do not moderate or automatically scan what is said there. The only exception is a message that a participant reports: our team reads that message (and only it) to decide, and it is kept for up to 180 days as evidence.
    • We do not knowingly collect information from anyone under 13.

  5. 5.Sponsored content

    Some Moments and cards carry a sponsor's brand, identified as "Presented by". We record how many times a sponsored Moment was shown and answered. These records are used to measure and report on the sponsorship, which is the only advertising purpose in the app. There is no ad SDK, no auction and no advertising profile: everyone who receives a sponsored Moment sees the same content. Sponsors receive only aggregate numbers (totals and percentages); they do not receive your name, @username, email or individual answers. If a reward were ever delivered by a sponsor and that required sharing your name and address, we would ask for your specific consent first.

  6. 6.How we share information

    Service providers that process information on our behalf, under contract and only to provide the Service:

    • Supabase: database, authentication and photo storage. Data stored in São Paulo, Brazil; the provider's technical support may access it from outside Brazil, including the United States.
    • Vercel: hosting of the website and the Moments player. Functions run in São Paulo; its global delivery network and technical access logs (IP address and browser) are processed by Vercel Inc. in the United States.
    • Resend: account emails (confirmation, password-recovery code). United States.

    We may also disclose information to public authorities when required by law, subpoena, court order or other legal process (including reports of risk to children and teenagers to the competent authorities); to professional advisers (legal, accounting) under confidentiality; and in connection with a merger, acquisition, financing or sale of assets, with notice to you. We do not disclose personal information to data brokers or advertising networks.

  7. 7.International transfers

    TORCIDA.ai is a Brazilian company, and your information is stored in Brazil (São Paulo), where Brazil's data protection law (the LGPD, Lei 13.709/2018) applies to us. If you are in the United States, your information therefore leaves the United States. Account emails are sent from the United States, and our hosting provider's network and logs are processed there. We protect information in transit with encryption (TLS) and limit access to what each person is allowed to see.

  8. 8.Children and teenagers

    TORCIDA.ai is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). United States accounts require a minimum age of 16: at sign-up you enter your date of birth and we keep only the age range. If the date of birth shows an age under 16, the account is closed immediately and the sign-up data is deleted or anonymized. If you believe a child under 13 has given us personal information, contact [PENDING: privacy@torcida.ai] and we will delete it.

    Teenagers aged 16 and 17 may use the Service [PENDING: counsel — currently without a parental consent step; the app does not collect a parent's information for United States accounts]. They are not shown advertising chosen for them, their profile is not used for commercial purposes and they are not eligible for physical prizes. We do not knowingly sell or share the personal information of consumers under 16.

  9. 9.How long we keep information

    • While your account exists: everything in section 2.
    • When you delete your account (immediately in the app; within 15 days when requested by email): we delete or anonymize your identification, profile, preferences, relationships and posts (full detail in section 14). Pseudonymized and tied only to an internal identifier remain: messages and photos already sent to other people (shown as from "Removed user"), answers, points and usage records, used only for statistics and the integrity of closed leaderboards.
    • Content reported or removed by moderation: up to 180 days after the decision, for our team only, as evidence and for your appeal. After that only the record of the decision remains (date, rule applied, outcome), without the content.
    • Access records (IP address): 6 months.
    • Raw usage data (sessions and events): [PENDING: 13 months]; after that only aggregates.
    • Reward delivery data, if any: [PENDING: 5 years], for tax and legal-defense purposes.
    • Acceptance of the Terms: while the account exists and for the applicable limitation period after that.

  10. 10.Your privacy rights

    Depending on where you live, you may have the right to: know what personal information we collect, use and disclose, and access it; correct inaccurate information; delete your personal information; receive a portable copy; opt out of the sale or sharing of personal information and of targeted advertising and profiling (we do none of these); limit the use of sensitive personal information (we use only your age range and, if you provide it, your gender, for the purposes above); and not be discriminated against for exercising your rights. These rights are provided by the CCPA for California residents and by the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states for their residents. [PENDING: counsel to confirm the list and whether the laws' applicability thresholds are met.]

    How to exercise them: in the app, in your Profile (display name, @username, photo, bio, favorite club, privacy settings, language and account deletion); for everything else, email [PENDING: privacy@torcida.ai] from the email address on your account. We verify requests by matching them to the email on the account (and, if needed, a confirmation code sent to it) and respond within 45 days, extendable once by another 45 days with notice. An authorized agent may submit a request on your behalf with your written permission; we may still ask you to confirm your identity. If we deny your request, you may appeal by replying to our decision; we will respond to the appeal within 45 days [PENDING: counsel — 60 days in some states] and, if we still deny it, tell you how to contact your state attorney general.

    California notice at collection. In the preceding 12 months we collected the following categories of personal information (Cal. Civ. Code § 1798.140): identifiers (name, email, @username, phone number, IP address, internal account identifier); categories listed in Cal. Civ. Code § 1798.80 (name, phone number); characteristics of protected classifications (age range and, if you provide it, gender); internet or other electronic network activity (usage events, sessions, access records); audio, electronic or visual information (photos you upload); and inferences (none drawn). Sources: you, and our own systems. Purposes: section 3. Sold or shared: none. Retention: section 9. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link; we treat Global Privacy Control signals as an opt-out of sale or sharing, which has no practical effect because none occurs. California "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.

    Nevada residents: we do not sell covered information as defined by Nevada law.

  11. 11.Security

    Information travels encrypted (HTTPS/TLS). Database access is restricted by per-user rules: each person can read only what they are entitled to see. Our team accesses the console with strong passwords and two-factor authentication, and each access to a winner's or referrer's contact details is logged with who and when. No system is infallible: in case of a security incident involving your personal information, we will notify you and the authorities as required by applicable law, including state breach-notification laws.

  12. 12.Cookies and tracking

    The app does not use cookies. The website uses only cookies strictly necessary for it to work (such as your language choice) and no advertising cookies or third-party pixels. Because we do not track users across sites, we do not respond differently to "Do Not Track" browser signals; see section 10 for Global Privacy Control.

  13. 13.Changes to this policy

    When we change something material, we will publish the new version here with its date and notify you in the app [PENDING: counsel — at least 30 days in advance, or with a new acceptance in the app]. The version in force is the one at the top.

  14. 14.How to delete your account

    In the app (fastest): open TORCIDA.ai and tap your photo in the top-left corner to open your Profile; scroll to Legal and Account and tap Delete my account; tap Delete account to confirm. The account is closed immediately and you are signed out.

    By email (without the app): write to [PENDING: support@torcida.ai] with the subject "Delete account", from the email address on the account, stating your @username. To protect your account we will ask you to confirm the request from that same address (or with a code sent to it). After confirmation we delete the account within 15 days and let you know by email.

    Deleted or anonymized immediately:

    • Display name (becomes "Removed user"), @username, profile photo and bio.
    • First and last name, email address and phone number; age range; gender, city and state.
    • Favorite club and favorites, notification preferences, who you follow and who follows you, blocks you made, likes, pending requests and invitations, conversation invitations nobody accepted.
    • Your posts and comments and their photos. You leave all conversations and groups.
    • Your login account is anonymized and the email address is freed for a new sign-up.

    Remains, without a link to your name, or for the legally required period:

    • Messages and photos you sent in conversations and groups remain visible to the other participants, shown as from "Removed user" (as in a conversation someone left).
    • Blocks other people made against you, so that a new account of yours cannot circumvent them.
    • Answers to Moments, points and statement, and usage records, tied to an internal identifier without a name, only for aggregate statistics and the integrity of closed leaderboards.
    • Content that was reported or removed by moderation, kept for our team only as evidence for up to 180 days after the decision; after that, only the record of the decision.
    • Access records (date, time and IP address) for 6 months.
    • Reward delivery data, if any, for [PENDING: 5 years].
    • The record that you accepted the Terms (version and date).

    United States accounts have no CPF, so no identifier of yours is retained to block new accounts after deletion.

    If you delete your account while a reward is being delivered, [PENDING: counsel — the delivery is canceled under the promotion's Official Rules / continues with the details you already confirmed]. Prefer to wait until the delivery is complete.

  15. 15.Contact

    Privacy requests: [PENDING: privacy@torcida.ai]. Support: [PENDING: support@torcida.ai] · https://torcida.ai/en/contact. Mail: TORCIDA.AI TECNOLOGIA LTDA, [PENDING: full address], Brazil.