Privacy Policy

Last updated: October 21, 2026

This policy describes how the Pugna MMA mobile app (Android and iOS) and website process personal data. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).

1. Who we are (Data Controller)

The controller responsible for your personal data is:

• Nikola Mitrovic (operating "Pugna MMA" as a private individual)
• Hannah-Arendt-Platz 2, 1220 Vienna, Austria
• Privacy & data requests: privacy@pugnamma.com
• General support: support@pugnamma.com

We have not appointed a Data Protection Officer, as we are not legally required to do so. You can reach us for any privacy matter at the address above. Further legal information is available in our Imprint.

2. Scope

This policy covers the Pugna MMA application (package com.pugnamma.app) on Android and iOS, and the Pugna MMA website (pugnamma.com). Pugna MMA is a mixed martial arts (MMA) database and a free fight-prediction game. It does not offer real-money gambling, in-app purchases, subscriptions, or advertising.

3. What we collect

Account & authentication

• Email address and password (the password is handled by our authentication provider, Google Firebase Authentication — we never see or store your raw password).
• Google account data (name, email, profile photo) if you choose "Sign in with Google".
• Account identifier (a Firebase user ID) used to link your data to your account.
• Guest sessions: if you use the app without an account, Firebase Authentication creates an anonymous identifier for your installation so the app can load its content. It is not linked to your name or email address, and no picks, favourites or groups are stored for it. When you create an account or sign in, the guest session is converted into your account or replaced by it.
• Terms & age confirmation: we record that you confirmed you are at least 18 years old and accepted the Terms and the Privacy Policy at sign-up, and when you did so.

Profile information you provide

• Username and, optionally, a display name, first/last name, phone number, and date of birth.
• Profile visibility preference (public or private).

Activity you create in the app

• Predictions (your picked winner, method, round and confidence for a fight).
• Favourites (fighters, fights and events you save).
• Prediction groups you create or join, and your leaderboard statistics (points, accuracy, streaks, rank).
• "Report incorrect info" submissions about a fighter (a category and a short description).
• Reports you send us about another user's display name or a prediction group (in the app or via email), the reason you give, and our moderation decision.
• The users you have blocked, so that their names and profiles stay hidden from you.
• Notification preferences (which categories of push notifications you want).

Device & technical data

• Push notification token plus device identifier, brand/model, type and app version (to deliver and manage notifications).
• Usage events (e.g. app opened, login, search, prediction submitted, screens viewed) via Firebase Analytics and in our own copy of the same events (see section 6), where you have consented. They are recorded with the Firebase app-instance identifier, your account identifier when you are signed in, device brand/model, operating system version, language and app version.
• App sessions, where you have consented and are signed in: when each use of the app started and when it was last active, the platform and the app version, linked to your account. Together with the dates of your predictions and favourites, they show us how often the app is used and what is done in a session.
• Crash diagnostics (stack traces, device model, OS version) via Firebase Crashlytics, in production builds only. When you are signed in, an account identifier (your Firebase user ID) is attached to crash reports, so that we can help you if you contact support.
• Standard technical data such as IP address, seen transiently by our infrastructure providers and by the third-party servers listed in section 6 when your device connects to them.

We do not collect an advertising identifier (Google Advertising ID / Apple IDFA), and we do not track you across other apps or websites.

Stored on your device only

• Login tokens and your profile are kept in encrypted device storage (Android encrypted preferences / iOS Keychain).
• Language preference and cached content (including a local database for live-fight data) are stored locally for performance and offline use.

4. Why we use your data and our legal bases

Crash reporting is limited to technical diagnostics needed to keep the app working and secure; it contains no advertising identifiers and is not used to track you.

5. What other users can see

If your profile is public, your display name and your aggregate prediction statistics (points, accuracy, streaks, rank) appear on public and group leaderboards. Anyone using the app, including guests without an account, can also open your profile from a leaderboard or a group. It shows your display name, the month you joined, the same statistics and your ten most recent scored picks (the fight, the fighter you picked, whether you got the winner, method and round right, and the points). Picks on fights that have not been scored yet are never shown to others. If you set your profile to private, you appear as "Anonymous" on leaderboards, and your profile and your picks are not shown to anyone else. Your email, phone number, date of birth and favourites are never shown to other users.

6. Recipients of your data

We do not sell your personal data. Your data is received by the following service providers and third parties:

See also the Firebase Privacy information and the Google Privacy Policy.

International transfers

Our backend hosting is located in the EU (Germany), so no transfer outside the EEA is involved there. Where the providers listed above process data outside the EEA, such transfers are covered by the EU–US Data Privacy Framework (for certified US companies) and/or by the European Commission's Standard Contractual Clauses under Art. 46 GDPR, as indicated in the table.

7. Artificial intelligence (AI)

• We use generative AI services to produce parts of the editorial content in the app: articles in the "Insights" section (event previews, recaps, rankings roundups and, in the Android app only, odds roundups), fight storylines and key insights, and fight summaries. This content is labelled "PUGNA AI" / "AI-generated" in the app.
• AI-generated content can contain errors. Please report mistakes to support@pugnamma.com or via "Report incorrect info" in the app.
• We also use AI services to research, match and validate public MMA data (e.g. fighter records and event results; see section 8).
• Providers: Anthropic (Claude), Google (Gemini) and OpenAI. These providers are based in the United States; data transfers are based on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• No personal data of app users (account, predictions, favourites, device data) is sent to these AI services. The app has no AI chatbot and you cannot submit prompts.
• No automated decision-making with legal or similarly significant effects on users (Art. 22 GDPR) takes place.

8. Data about athletes and other public figures

This section provides the information required by Art. 14 GDPR to athletes and other persons whose data we did not obtain from them directly. We publish it here because informing each person individually would involve a disproportionate effort (Art. 14(5)(b) GDPR).

• Persons concerned: professional MMA athletes, referees, judges and other persons active in public sport.
• Data: name, nickname, nationality, date of birth/age, physical attributes (such as height, weight and reach), fight record and results, fight statistics, rankings, public career information, and publicly available photos.
• Purpose: operating a sports database and editorial reporting on mixed martial arts.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing sports information and in journalistic purposes, and the public's freedom of expression and information (cf. Art. 85 GDPR and § 9 DSG).
• Sources: publicly available sources such as official promotion websites and results, Wikipedia, UFCStats, ESPN, Sherdog, Tapology, SofaScore and sports-data APIs. AI tools may be used to collect and cross-check this public information (see section 7).
• Recipients: users of the app and website, and the providers listed in sections 6 and 7.
• Retention: for as long as the data is relevant to the sports record.
• Special categories: we do not intentionally process health data beyond information that athletes or promotions have made public (e.g. publicly reported injury withdrawals).
• Your rights: access; rectification (we correct errors promptly); erasure and objection (which we balance against the public interest in accurate sports records); and the right to lodge a complaint with the Austrian Data Protection Authority (see section 10). Athletes and other persons concerned can contact us at privacy@pugnamma.com.

9. How long we keep your data

• Account, profile and activity data: for as long as your account exists. When you delete your account (see section 11), this data is erased.
• Guest identifiers: kept until the guest session becomes an account. A guest ID that has not been used for 30 days is deleted automatically, together with the data linked to it. They hold no name, email address or profile data.
• Crash diagnostics: retained by Firebase Crashlytics for up to 90 days.
• Analytics data: only where you have consented. Firebase Analytics and our BigQuery copies keep it for no longer than 14 months; events waiting on our servers to be loaded into BigQuery are deleted after at most 60 days.
• App sessions: only where you have consented; deleted 12 months after the session was last active.
• Website analytics (Google Analytics 4): event-level data is kept for 2 months (the default setting of our Analytics property), and only where you have consented; the _ga cookies expire after at most 2 years, or when you reject or withdraw consent (see section 14).
• Moderation reports and related emails: up to 12 months after the matter is closed.
• Encrypted database backups are kept on a rolling 30-day window and are automatically deleted after that.

10. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any of these, contact privacy@pugnamma.com; we will respond within one month.

Analytics is off unless you switch it on. You can grant or withdraw that consent at any time in the app under Profile → Settings → Privacy → Usage analytics. Withdrawing consent stops all further analytics collection and deletes the events still waiting on your device to be sent, as well as your app sessions on our servers; it does not affect processing that already took place.

On the website, Google Analytics stays off unless you click "Accept" in the cookie banner. You can withdraw that consent at any time: click "Cookie settings" at the bottom of any page and choose "Reject".

You also have the right to lodge a complaint with the Austrian supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, +43 1 52 152-0.

11. Account deletion & data export

You can permanently delete your account at any time from the app (Settings → Danger Zone → Delete Account). This erases your server-side data (profile, predictions, favourites, analytics events and app sessions linked to your account, etc.) and your authentication account. You can also request deletion or a copy of your data by emailing privacy@pugnamma.com. Step-by-step deletion instructions are also available on our Delete Your Account page.

12. Age limit

Pugna MMA is intended for users aged 18 and over and is not directed at children. At sign-up you must confirm that you are at least 18 years old. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

13. Security

We protect your data with encryption in transit (HTTPS), encrypted storage of credentials on your device, and authenticated, access-controlled backend APIs. No method of transmission or storage is completely secure, but we take reasonable measures to safeguard your information.

14. Cookies, local storage & device access

On our website, cookies and similar technologies are used only for Google Analytics, and only after you have consented in the cookie banner (see "Website analytics" below), in line with § 165(3) of the Austrian Telecommunications Act (TKG 2021) and the ePrivacy Directive. Your choice in the banner is saved in your browser's local storage (key pugna-consent-v1); this is strictly necessary to remember your decision and is not shared with anyone.

In the app, access to information on your device for crash reporting and delivering notifications is strictly necessary to provide the service you requested (§ 165(3) TKG 2021); analytics only with consent.

Website analytics (Google Analytics 4)

If you click "Accept" in the cookie banner, our website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to understand how the site is used (for example which pages are visited, how visitors find the site and how long they stay). Google acts as our processor.

• Only with your consent: until you click "Accept", the Google Analytics script is not loaded and nothing is sent to Google, and no cookies are set or read on your device. If you click "Reject", nothing is loaded or sent. If you withdraw consent later, no further data is sent and the site deletes the _ga cookies.
• What is collected after you accept: the pages you view and how you interact with them (e.g. scrolling, clicks on links to other sites), the referring page, approximate location (country and city, derived from your IP address), device type, browser and operating system, screen size and language, and a randomly generated identifier stored in the cookies _ga and _ga_<ID>.
• IP address: Google Analytics 4 does not log or store IP addresses. For visitors in the EU, Google uses the IP address only on servers in the EU to derive the approximate location and then discards it.
• No advertising: Google signals and advertising features are switched off. We do not use the data for advertising and do not link it to your app account.
• Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
• Retention: event-level data is kept for 2 months (the default setting of our Analytics property); aggregated reports derived from it may be kept longer. The _ga cookies expire after at most 2 years; when you reject or withdraw consent, the site deletes them.
• Withdrawing consent: click "Cookie settings" at the bottom of any page of the website and choose "Reject". This stops further collection; it does not affect processing that already took place.
• Transfers outside the EU: Google LLC in the USA may process the data. Such transfers are based on the EU–US Data Privacy Framework (Google LLC is certified) and the European Commission's Standard Contractual Clauses (Art. 46 GDPR). See the Google Privacy Policy and how Google Analytics safeguards data.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, notified in the app.

16. Contact

Questions about this policy or your data: privacy@pugnamma.com.