Privacy policy
Draft — to be reviewed by a lawyer before launch.
Who is responsible
The controller of your personal data is [Operator name and address]. Contact: [contact@your-domain].
What we collect and why
- Account data: email address, player name, optional nation, and your password stored only as a secure hash — to run your account (GDPR Art. 6(1)(b)).
- Game data: your team, squads, scores and league memberships — to run the game and show standings. Your player name, nation and team name are visible to other players.
- Technical data: server logs such as IP address and browser, kept briefly by our hosting provider for security, and recent sign-in attempts (email and IP, deleted after a day) to stop password guessing (Art. 6(1)(f)).
- Sign-in with Google: if you choose it, Google tells us your name and verified email address; we receive nothing else.
- Emails: we send password reset links on request and, as part of the game, round summaries and deadline reminders. You can turn the latter off on the account page or with the link in every email.
We do not sell your data, show third-party ads or use analytics or tracking cookies.
Cookies
We use one essential cookie to keep you signed in and one that remembers your language. Both are needed for the game to work, so no consent banner is needed.
Who processes data for us
- Vercel Inc. — hosting; our servers run in Frankfurt, Germany.
- Neon (Databricks) — database hosting in Frankfurt, Germany.
- Resend — sending emails such as password reset links.
- Google — only if you sign in with Google.
They act under data-processing agreements; any transfer outside the EEA relies on standard contractual clauses.
How long we keep it
As long as your account exists. When you delete your account, your personal and game data are deleted immediately; backups expire within 30 days.
Your rights
You can access, correct, export or delete your data, object to processing and lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). Most of this you can do yourself on the account page; for anything else write to [contact@your-domain].