Privacy Policy

Last updated: September 16, 2026

This policy describes how the Pugna MMA mobile app (Android and iOS) and website process personal data. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).

1. Who we are (Data Controller)

The controller responsible for your personal data is:

• Nikola Mitrovic (operating "Pugna MMA" as a private individual)
• Hannah-Arendt-Platz 2, 1220 Vienna, Austria
• Privacy & data requests: privacy@pugnamma.com
• General support: support@pugnamma.com

We have not appointed a Data Protection Officer, as we are not legally required to do so. You can reach us for any privacy matter at the address above. Further legal information is available in our Imprint.

2. Scope

This policy covers the Pugna MMA application (package com.pugnamma.app) on Android and iOS, and the Pugna MMA website (pugnamma.com). Pugna MMA is a mixed martial arts (MMA) database and a free fight-prediction game. It does not offer real-money gambling, in-app purchases, subscriptions, or advertising.

3. What we collect

Account & authentication

• Email address and password (the password is handled by our authentication provider, Google Firebase Authentication — we never see or store your raw password).
• Google account data (name, email, profile photo) if you choose "Sign in with Google".
• Account identifier (a Firebase user ID) used to link your data to your account.
• Terms & age confirmation: we record that you confirmed you are at least 18 years old and accepted the Terms and the Privacy Policy at sign-up, and when you did so.

Profile information you provide

• Username and, optionally, a display name, first/last name, phone number, and date of birth.
• Profile visibility preference (public or private).

Activity you create in the app

• Predictions (your picked winner, method, round and confidence for a fight).
• Favourites (fighters, fights and events you save).
• Prediction groups you create or join, and your leaderboard statistics (points, accuracy, streaks, rank).
• "Report incorrect info" submissions about a fighter (a category and a short description).
• Reports you send us about another user's display name or a prediction group (via email), and our moderation decision.
• Notification preferences (which categories of push notifications you want).

Device & technical data

• Push notification token plus device identifier, brand/model, type and app version (to deliver and manage notifications).
• Usage events (e.g. app opened, login, search, prediction submitted, screens viewed) via Firebase Analytics, where you have consented.
• Crash diagnostics (stack traces, device model, OS version) via Firebase Crashlytics, in production builds only.
• Standard technical data such as IP address, seen transiently by our infrastructure providers and by the third-party servers listed in section 6 when your device connects to them.

We do not collect an advertising identifier (Google Advertising ID / Apple IDFA), and we do not track you across other apps or websites.

Stored on your device only

• Login tokens and your profile are kept in encrypted device storage (Android encrypted preferences / iOS Keychain).
• Language preference and cached content (including a local database for live-fight data) are stored locally for performance and offline use.

4. Why we use your data and our legal bases

Crash reporting is limited to technical diagnostics needed to keep the app working and secure; it contains no advertising identifiers and is not used to track you.

5. What other users can see

If your profile is public, your display name and your aggregate prediction statistics (points, accuracy, streaks, rank) appear on public and group leaderboards. If you set your profile to private, you appear as "Anonymous" instead. Your email, phone number, date of birth, favourites and individual picks are never shown to other users.

6. Recipients of your data

We do not sell your personal data. Your data is received by the following service providers and third parties:

See also the Firebase Privacy information and the Google Privacy Policy.

International transfers

Our backend hosting is located in the EU (Germany), so no transfer outside the EEA is involved there. Where the providers listed above process data outside the EEA, such transfers are covered by the EU–US Data Privacy Framework (for certified US companies) and/or by the European Commission's Standard Contractual Clauses under Art. 46 GDPR, as indicated in the table.

7. Artificial intelligence (AI)

• We use generative AI services to produce parts of the editorial content in the app: articles in the "Insights" section (event previews, recaps, odds and rankings roundups), fight storylines and key insights, and fight summaries. This content is labelled "PUGNA AI" / "AI-generated" in the app.
• AI-generated content can contain errors. Please report mistakes to support@pugnamma.com or via "Report incorrect info" in the app.
• We also use AI services to research, match and validate public MMA data (e.g. fighter records and event results; see section 8).
• Providers: Anthropic (Claude), Google (Gemini) and OpenAI. These providers are based in the United States; data transfers are based on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• No personal data of app users (account, predictions, favourites, device data) is sent to these AI services. The app has no AI chatbot and you cannot submit prompts.
• No automated decision-making with legal or similarly significant effects on users (Art. 22 GDPR) takes place.

8. Data about athletes and other public figures

This section provides the information required by Art. 14 GDPR to athletes and other persons whose data we did not obtain from them directly. We publish it here because informing each person individually would involve a disproportionate effort (Art. 14(5)(b) GDPR).

• Persons concerned: professional MMA athletes, referees, judges and other persons active in public sport.
• Data: name, nickname, nationality, date of birth/age, physical attributes (such as height, weight and reach), fight record and results, fight statistics, rankings, public career information, and publicly available photos.
• Purpose: operating a sports database and editorial reporting on mixed martial arts.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing sports information and in journalistic purposes, and the public's freedom of expression and information (cf. Art. 85 GDPR and § 9 DSG).
• Sources: publicly available sources such as official promotion websites and results, Wikipedia, UFCStats, ESPN, Sherdog, Tapology, SofaScore and sports-data APIs. AI tools may be used to collect and cross-check this public information (see section 7).
• Recipients: users of the app and website, and the providers listed in sections 6 and 7.
• Retention: for as long as the data is relevant to the sports record.
• Special categories: we do not intentionally process health data beyond information that athletes or promotions have made public (e.g. publicly reported injury withdrawals).
• Your rights: access; rectification (we correct errors promptly); erasure and objection (which we balance against the public interest in accurate sports records); and the right to lodge a complaint with the Austrian Data Protection Authority (see section 10). Athletes and other persons concerned can contact us at privacy@pugnamma.com.

9. How long we keep your data

• Account, profile and activity data: for as long as your account exists. When you delete your account (see section 11), this data is erased.
• Crash diagnostics: retained by Firebase Crashlytics for up to 90 days.
• Analytics data: retained by Firebase Analytics for no longer than 14 months, and only where you have consented.
• Moderation reports and related emails: up to 12 months after the matter is closed.
• Encrypted database backups are kept on a rolling 30-day window and are automatically deleted after that.

10. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any of these, contact privacy@pugnamma.com; we will respond within one month.

Analytics is off unless you switch it on. You can grant or withdraw that consent at any time in the app under Profile → Settings → Privacy → Usage analytics. Withdrawing consent stops all further analytics collection; it does not affect processing that already took place.

You also have the right to lodge a complaint with the Austrian supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, +43 1 52 152-0.

11. Account deletion & data export

You can permanently delete your account at any time from the app (Settings → Danger Zone → Delete Account). This erases your server-side data (profile, predictions, favourites, etc.) and your authentication account. You can also request deletion or a copy of your data by emailing privacy@pugnamma.com. Step-by-step deletion instructions are also available on our Delete Your Account page.

12. Age limit

Pugna MMA is intended for users aged 18 and over and is not directed at children. At sign-up you must confirm that you are at least 18 years old. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

13. Security

We protect your data with encryption in transit (HTTPS), encrypted storage of credentials on your device, and authenticated, access-controlled backend APIs. No method of transmission or storage is completely secure, but we take reasonable measures to safeguard your information.

14. Cookies, local storage & device access

On our website we do not use cookies, analytics or any other storage of or access to information on your device. If this changes, non-essential storage will only be used with your prior consent, in line with § 165(3) of the Austrian Telecommunications Act (TKG 2021) and the ePrivacy Directive.

In the app, access to information on your device for crash reporting and delivering notifications is strictly necessary to provide the service you requested (§ 165(3) TKG 2021); analytics only with consent.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, notified in the app.

16. Contact

Questions about this policy or your data: privacy@pugnamma.com.