Privacy Policy

Abdullahi, [Registered or business address], is the controller of your personal data on The Football Exchange. Contact us about anything in this policy at support@thefootball.exchange.

What we collect

• Account details: your email address and password. Passwords are stored hashed by our authentication provider; we never see them.
• Your portfolio: your leaderboard handle, simulated cash, positions and trade history.
• Subscription details:your plan, renewal date and a customer reference from Stripe. Card details are entered on Stripe's checkout and never reach our servers.
• Technical data: server logs (IP address, browser, pages requested and errors), kept by our hosting provider for security and debugging.

We do not use advertising trackers or sell your data. The football statistics we publish are about professional players, not about you.

Why we use it, and our legal basis

• To run your account, portfolio and subscription — performance of our contract with you.
• To send account emails such as confirmations, password resets and billing receipts — contract.
• To keep the site secure, prevent abuse and fix problems — our legitimate interests.
• To keep payment and tax records — legal obligation.

Who processes it for us

• Supabase — database and authentication
• Vercel — hosting and server logs
• Stripe — payments and subscription billing
• Our email delivery provider — account and billing emails

Some of these providers process data outside the UK, including in the United States. Where they do, transfers are covered by the UK's adequacy regulations or approved safeguards such as the International Data Transfer Addendum.

Cookies and local storage

We only use cookies that are strictly necessary for the site to work, so we do not ask for consent to them:

• Authentication cookies that keep you signed in
• fa_session and fa_guest — whether you are signed in or browsing as a guest
• fa_tier — which version of the market feed to show
• sidebar_state — whether you left the sidebar open

If we add analytics or any non-essential cookies, we will ask first.

How long we keep it

Account and portfolio data is kept while your account is open and deleted within 30 days of you asking us to close it. Payment records are kept for six years to meet tax law. Server logs are kept for a short, rolling period set by our hosting provider.

Your rights

Under UK data protection law you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw any consent you have given. Email support@thefootball.exchangeand we will respond within one month. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

The site is for adults aged 18 and over. We do not knowingly collect data from children.

Changes

If we change this policy in a way that matters, we will tell you by email or on the site.