Mystery XI

Privacy Policy

Last updated: 1 November 2026

1. Who we are and what this policy covers

Mystery XI is a daily football quiz app for Android and iPhone, published by Foreningskompasset, CVR 46741242, Æbeløgade 5, 3, 3, 8000 Aarhus C, Denmark ("we", "us"). We are the data controller for the personal data described in this policy.

This policy covers the Mystery XI app and the website mysteryxi.app. Mystery XI is intended for players aged 13 and older.

2. Information we process

Account and friends

When you first open the app, we create an account for you with a random user ID, similar to an account number, and a friend code. We store the display name you choose, when the account was created and last used, who you are friends with, and pending friend requests. The user ID does not contain your name, but because it is linked to your account and device, we treat it as personal data.

Daily results

For each daily puzzle we store whether you won, the number of guesses or players found, tips used and points. This is used for the friends league and to check that results are fair.

Information that stays on your device

Your stats, streaks, game progress and settings are stored only on your device and are not sent to us. "Reset progress" in Settings deletes them.

Technical information

Our hosting provider records IP addresses and basic device information in server logs when the app connects to our servers.

Advertising information

Google AdMob, which shows the ads in the app, collects your device's advertising ID, IP address, device information, approximate location, and which ads are shown and clicked. See section 4.

Purchases

If you subscribe to Mystery XI Plus, the payment is handled by Google Play or the App Store. We receive your user ID, the product you bought and when it renews or ends. We do not receive or store your payment card details.

Sign in with Apple or Google

If you link your account to Apple or Google, we receive an account ID and the email address Apple or Google shares with us.

We do not collect your real name (unless you choose it as your display name), phone number, contacts, photos or precise location.

3. How we use information

• To create and run your account and let your friends find you.
• To run the daily puzzles and the friends league, including points and fair-play checks.
• To show ads that keep the app free, and to remove them for subscribers.
• To restore your account and purchases on a new device.
• To keep the app secure, fix errors and answer your questions.
• To comply with the law, such as bookkeeping rules.

4. Advertising and your choices

The app shows ads from Google AdMob: a full-screen ad before a new game, and an optional video ad if you want a tip. Mystery XI Plus removes the ads before games.

• EU, EEA, UK and Switzerland: the first time you open the app, Google's consent form asks whether ads may be personalised. If you decline, you still see ads, but they are not based on your interests. Google still uses limited data, such as IP address and device information, to show and count ads and to prevent fraud.
• Change your choice at any time in Settings → Privacy choices.
• iPhone: the app asks whether it may track you. If you decline, your advertising ID is not shared. You can change this in iPhone Settings → Privacy & Security → Tracking.
• Android: you can reset or delete your advertising ID in Android Settings → Google → Ads (or Privacy → Ads).

Declining personalised ads does not reduce the number of ads; the ads are simply not based on your interests. Google uses advertising data partly as its own controller. See how Google uses data from partner apps.

5. How we disclose information

• Supabase – our database and login provider. Stores account, friends and results on servers in the EU, on our instructions, under a data processing agreement.
• Google (AdMob) – shows the ads. For the EU, this is Google Ireland Limited. Google Privacy Policy.
• Google and Apple – handle payments in Google Play and the App Store, as their own controllers.
• RevenueCat – keeps track of active subscriptions, on our instructions, under a data processing agreement.
• Your friends – see your display name, friend code and daily results. Other players can only find you with your friend code.
• Authorities – when the law requires it, for example on a court order.
• A buyer of the app – if the app is sold, the buyer must follow this policy.

We do not sell your personal data: nobody pays us for it. Google pays us for showing ads in the app, not for data about you. However, under some US state laws, personalised ads may count as a "sale" or "sharing" of personal data. See Your privacy rights – United States.

6. Retention and deletion

• Account, friends and results: until you delete your account.
• Guest accounts (not linked to Apple or Google): deleted automatically after 60 days without playing, together with friends and results.
• Server logs: kept for a short period by our hosting provider, normally days.
• Subscription records: while the subscription is active, and afterwards for 5 years as required by Danish bookkeeping law.
• Advertising data: kept by Google under its own policy.

Deleted data is removed from our database immediately and from backups when they are replaced, normally within 30 days. We may keep anonymous totals, such as how many players completed a puzzle, which cannot be linked to anyone. We do not try to re-identify anonymous data.

7. Deleting your account

• In the app: Settings → Delete account. Your account, display name, friend code, friends and results are deleted immediately.
• Without the app: email foreningskompasset@gmail.com from any address with your friend code. We delete the account within 30 days. See also mysteryxi.app/delete-account.

Deleting your account does not cancel a subscription. Cancel it in Google Play or the App Store.

8. Legal bases

Under the EU General Data Protection Regulation (GDPR), we process personal data on the following legal bases:

• Performance of a contract (GDPR art. 6(1)(b)): your account, friends, daily results, purchases and sign-in. This processing is necessary to provide the app and the services described in our Terms of Use.
• Legitimate interests (GDPR art. 6(1)(f)): server logs, security and fraud prevention, and non-personalised ads that keep the app free. We have weighed these interests against your privacy.
• Consent (GDPR art. 6(1)(a)): personalised ads. You can withdraw consent at any time in Settings → Privacy choices.
• Legal obligation (GDPR art. 6(1)(c)): keeping bookkeeping records.

9. International processing

Our database is located in the EU. Google, Apple and RevenueCat are US companies and may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

10. Security

Data is encrypted in transit (HTTPS) and stored encrypted in the EU. Database rules ensure each player can only change their own data, and administrative access is limited to us. No system is completely secure. If a data breach is likely to put your rights at risk, we notify the Danish Data Protection Agency within 72 hours and inform affected players where required.

11. Your privacy rights

EU, EEA and UK

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. We respond within one month. To protect your account, we may ask you to confirm that it is yours, for example with your friend code. Some rights have legal limits; for example, we must keep bookkeeping records.

You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

United States

Allowing Google to use data such as your advertising ID for personalised ads may be considered a "sale" or "sharing" of personal data under some US state privacy laws. You can opt out in Settings → Privacy choices; you will still see ads, but they will not be personalised.

Depending on where you live, you may have the right to know what personal data we hold, to receive a copy, to have it corrected or deleted, and to opt out of targeted advertising. We respond within 45 days. We do not collect sensitive personal data, and we do not use personal data for decisions with legal or similarly significant effects.

We will not discriminate against you for exercising a privacy right.

12. Children's privacy

Mystery XI is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has an account, contact us and we will delete it.

13. Changes to this policy

We will post any updated policy here and change the date at the top. Important changes are announced in the app before they take effect.

14. Contact us

Foreningskompasset, CVR 46741242, Æbeløgade 5, 3, 3, 8000 Aarhus C, Denmark.
Email: foreningskompasset@gmail.com

For privacy requests, include your friend code (Settings → Friend code). Do not send passwords or other sensitive information.