Your data, in plain terms
Privacy
notice.
This is the whole of it: what we hold, why we hold it, who else touches it, and how to get it back or have it deleted. No part of this is written to be skipped.
Version 1.0 — published 15 August 2026. This is the first version; there is nothing yet to list as changed.
The short version
- We hold an email address, a display name, a county, and the predictions and seasons you save. That is nearly all of it.
- Other players can see your display name, county and points. Nothing else about you is visible to anybody.
- We do not sell your data, we do not run advertising, and there are no advertising or tracking cookies on this site.
- Analytics is off until you say yes, and nothing is loaded from Google until you do. If your browser sends Do Not Track or Global Privacy Control, we take that as a no and never ask.
- Emails you get from us are the ones you asked for or need — verification, password reset, invitations, and a matchweek reminder you can switch off in one click.
- Deleting your account deletes the data. You do it yourself, in Settings, and it is not reversible.
The rest of this page is the detail behind those six lines.
Who is responsible for it
Sideline Call is run by [OPERATOR LEGAL NAME], [REGISTERED POSTAL ADDRESS]. In data protection law that makes us the data controller — the ones answerable for what happens to your data. Write to us about anything on this page at support@sidelinecall.com.
We are established in the United Kingdom, so UK GDPR and the Data Protection Act 2018 apply to what we do. Most of the people who play are in Ireland, and for them the EU GDPR applies too. Where the two differ, we hold ourselves to whichever gives you more.
[If a Data Protection Officer or an EU/UK representative is appointed, name them here. One is not required at this size, but the line has to be either filled in or deleted before this page goes live.]
What we hold, and why
| What | Specifically | Why | Lawful basis |
|---|---|---|---|
| Account | Your email address, and a password you never send us in readable form. If you sign in with Apple, Google or Facebook, the identifier they give us and the address they pass on — including an Apple private relay address, if that is what you chose. | To have an account at all, to sign you back in, and to reset a password. | Performance of a contract |
| Profile | Display name, county, which codes you play (football, hurling), whether you have seen the product tour, when the account was created, and your two email preferences. | To show you the right fixtures, to name you on a leaderboard, and to remember what you have already been shown. | Performance of a contract |
| Game data | Your predictions, your saved seasons — one per client, so the web and the phone can each keep their own — your scores by competition, and a small reminder record holding the current matchweek, its deadline, how many calls you have left to make, and your time zone. | To play the game, to score it, and to know whether a reminder is worth sending. | Performance of a contract |
| Leaderboard row | A copy of your account identifier, display name, county and points, in the table for each competition. | So a leaderboard can be read in one go rather than by reading every player's private data. | Performance of a contract |
| Email records | One row per message we send: the address, which template, when, whether it was accepted, and the provider's own message id. Then delivery events from the provider — delivered, bounced, marked as spam, opened, clicked. A suppression list of addresses that bounced or complained. Counters for the rate limits. | To answer “did that email actually go?”, to stop sending to addresses that reject us, and to stop the invitation feature being used to pester somebody. Bodies and links are never stored. | Legitimate interests, and legal obligation for the suppression list |
| Analytics | Only if you agree: page views and a short list of game events — sign-up, login, a prediction saved, a banker set, a survivor pick, a league created or joined, a week completed — with a Google Analytics identifier. | To know which parts of the game are worth building next. | Consent, which you can withdraw |
| Technical records | Server logs from the functions that run the game and send the email, including the account identifier involved and any error. Standard web server logs, including IP address, kept by our hosting provider. | To keep the service working, to find a fault, and to deal with abuse. | Legitimate interests |
What the last column means. Those three phrases are the law's words rather than ours. Performance of a contract means we need it to give you the game you signed up for. Legitimate interests means we have a practical reason for it and have weighed that reason against your privacy. Consent means you said yes, and can say no again whenever you like.
Playing as a guest. If you play without signing up, none of the above happens. The guest season lives in your own browser's local storage and never reaches us. Clearing your browser data clears it, and there is nothing on our side to delete.
What we do not hold. We do not ask for your date of birth, your address, your phone number or any payment details, because the game is free and none of those are needed to run it. We do not build a profile of you for advertising, and there is nothing here that is sold or shared for anybody else's marketing.
What other players can see
Three things, and only these three: your display name, your county, and your points. They appear on the leaderboard for a competition, and in any league or Survivor pool you have joined, to the other people in it.
Your email address is never shown to another player. Neither are your individual predictions before they lock, your settings, or anything else on your profile.
If you would rather not be identifiable, use a display name that is not your full name. You can change it at any time in the game, and the leaderboard picks up the new one at its next rebuild.
Who else touches it
We use a small number of suppliers, each of which processes data on our instructions and is bound by a contract to do nothing else with it.
| Who | What they do for us | What they see |
|---|---|---|
| Google (Firebase) | Authentication, the database, the functions that run the game, and the hosting the site is served from. | Everything in the table above, other than analytics and email records. |
| Resend | Sends our email and reports back on delivery. | Your email address, the message, and whether it arrived. |
| Google Analytics | Counts visits and the game events listed above. | Only if you have agreed. Nothing is loaded from Google Analytics before that. |
| Google Fonts | Serves the two typefaces the pages are set in. | Your IP address and browser, as part of requesting the font files. This happens on page load, before any choice is offered, because it is how the page is drawn. |
| Apple, Google, Facebook | Sign-in, if you choose one of them rather than an email and password. | Whatever their own sign-in flow shows them. What they hand back to us is an identifier and, usually, an email address — that part is governed by their privacy policies, not this one. |
Beyond those, we share personal data only where we are required to by law, or where it is necessary to establish or defend a legal claim. We do not sell it, and we will not transfer it to anyone else without telling you — if the game were ever sold or transferred, you would be told before your data moved.
Where it is held
The database and the functions that read it run in Google's europe-west1 region, in Belgium. Our email provider sends from its EU region. Both were chosen so that the ordinary running of the game happens inside the EU.
Both suppliers are groups with operations in the United States, and support, backup or fault-finding can involve access from outside the UK and EEA. Where that happens it is covered by the standard contracts approved for exactly that — the UK's International Data Transfer Addendum and the EU Standard Contractual Clauses — together with the extra safeguards those suppliers publish. Google Analytics, if you have agreed to it, processes data in the United States on the same basis.
How long we keep it
| What | How long |
|---|---|
| Account, profile, game data | Until you delete your account. Deletion removes all of it immediately, in one operation, and it is not recoverable afterwards. |
| Leaderboard rows | Removed at the next rebuild of that table after your data goes — hours, not days. |
| Email records and delivery events | 12 months from the date of the message. |
| Suppression list | Kept for as long as the address needs to be suppressed. Forgetting that an address bounced or complained would mean emailing it again, which is the thing the list exists to prevent. |
| Analytics | No more than 14 months, the longest retention Google Analytics offers for this kind of data. |
| Usage totals | Indefinitely. They are counts with nothing in them that relates to a person, so there is nothing in them to expire. |
| Server logs | Up to 30 days, which is our hosting provider's default. |
The one question we ask, and the counting we do anyway
There are two kinds of counting here and they are not versions of each other. One follows you and is off until you say yes. The other counts nothing about you at all and is always on. This section is about both, because a privacy notice that describes only the part with a banner on it is not describing what happens.
Analytics, which we ask about
The first time you visit, a bar at the bottom of the page asks whether we can count visits. On the apps the same question is a card, shown once, shortly after your first session. Until you answer:
- no analytics script is downloaded from Google;
- no analytics cookie or identifier is created;
- nothing is sent anywhere.
That is stricter than the usual arrangement, where the analytics script loads first and is then told to hold back. Here there is nothing to hold back, because nothing has loaded. On the apps the same thing is done by shipping with Analytics switched off in the app's own configuration, so it is inert before any of our code has run.
If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a no and the bar is never shown. If you say yes, the events recorded are the ones listed in the table above and nothing else — no page content, no predictions, no email address. The apps collect no advertising identifier, which is why iOS never shows you the tracking prompt: there is nothing behind it we would be asking for.
To change your mind: on the apps, Profile → Counting. On the web, clear this site's data in your browser and answer the bar differently when it reappears. [A control in Settings that flips this on the web without clearing storage is planned — remove this note when it ships.] Withdrawing does two things rather than one: collection stops, and the identifier Analytics had given your device is discarded, so changing your mind back does not make you recognisably the same person as before.
Totals, which we do not
Separately, and whatever you answer above, the site and the apps send us plain counters: a page was loaded, a screen was opened, a call was saved, something failed in a named part of the app. We use them to know how much the thing is being used and whether it is working.
We do not ask about these, and the reason is that there is nothing to ask about. Specifically:
- Nothing is stored on your device. No cookie, no local storage entry, no file, nothing. The law that makes analytics cookies need consent is about storing or reading things on your equipment, and this does neither.
- No identifier is sent. Not your account, not a session number, not a device id, not a randomised stand-in for one. Two visits from your laptop are indistinguishable to us from two visits by two different people. This is not a promise about what we choose to look at; there is no field in the request that could carry it.
- Your address is not kept. Your IP arrives, as it must for any request to reach a server. It is used to stop one machine flooding the counter, in memory, and is never written down or turned into anything that is.
- Nothing free-form can be sent. Every name and value is checked against a fixed list before it is counted and discarded if it is not on it. There is no field for a fixture, a name or an address to end up in by accident, which is how this sort of counting usually acquires personal data.
- What is stored is a number. The result is integers on a per-day record — 142 sessions, 61 on iOS. There is no row about you to show you, correct, or delete, because there is no row about you.
- It goes nowhere else. Our own database in Belgium. No third party, no Google, no advertiser.
In data protection terms: because none of it identifies you, it is not personal data and the rules in this notice about access, correction and deletion have nothing to attach to. Where the law nonetheless treats the collecting as needing a basis, ours is legitimate interests — knowing whether a thing we are building is used and working — and the interference with you is nil by construction rather than by policy.
The cost of doing it this way, which is worth being open about: it means we genuinely cannot tell how many people use this, only how many visits there were. We think that is the right trade, and we would rather have the weaker number honestly than the stronger one by following you around.
Your rights
Under UK and EU data protection law you have the right to:
- see what we hold about you, and get a copy of it;
- correct anything wrong — most of it you can correct yourself in Settings;
- delete it — you can do this yourself, in Settings, at any time;
- put a hold on what we do with it, or object to it, where we rely on legitimate interests;
- take it elsewhere, in a portable form;
- withdraw consent to analytics, at any time, without affecting what was lawful before you did.
To exercise any of them, write to support@sidelinecall.com from the address on your account. We will reply within one month. There is no charge, and we will not ask you for more identification than we need to be sure the account is yours.
The fastest route for two of them does not involve us at all: Settings → Delete my account deletes everything, and every marketing email we send carries a one-click unsubscribe link.
Children
Accounts are for people aged 13 and over. We do not knowingly collect data about anyone younger, and the game asks for nothing that would identify a child beyond an email address and a chosen name.
If you are a parent or guardian and believe a child under that age has an account, write to support@sidelinecall.com and we will remove it and the data with it.
How it is protected
Access to your data is enforced at the database itself, by rules that allow an account to read and write only its own records — not by the app asking politely. Passwords are handled entirely by Firebase Authentication and are never visible to us. Entering or correcting a fixture or a result is limited to the handful of accounts marked as admin, and every one of those actions is logged.
Everything is served over HTTPS. Email links that act on an account expire. Password reset links, verification links and their contents are never written to our database, because a copy of a credential in a log outlives the credential.
No system is perfect. If a breach ever affects your data and is likely to be a risk to you, we will tell you and the regulator, within the time the law allows.
Changes to this notice
The version and date at the top of this page say which notice is current. If we change something that materially affects you — a new supplier, a new purpose, a longer retention — we will tell you by email to the address on your account before it takes effect.
Complaints
If you are unhappy with how we have handled your data, tell us first at support@sidelinecall.com. We would rather fix it than have it explained to us by a regulator.
If that does not settle it, you can take it to the regulator:
- United Kingdom — the Information Commissioner's Office, ico.org.uk.
- Ireland — the Data Protection Commission, dataprotection.ie. If you live elsewhere in the EEA, you can complain to your own country's authority.