Privacy Policy

1. Who We Are

FootyStack is a football prediction platform built as a side project by two friends. This policy explains what data we collect, why, and how we handle it. We believe in being straightforward — no legalese walls.

FootyStack is the data controller responsible for your personal data. You can reach us at: privacy@footystack.com

2. Data We Collect

We collect the following categories of information:

Account information

When you sign up, our authentication provider (Clerk) collects your name, email address, and profile picture. If you sign in with a social provider (e.g. Google), Clerk receives the profile data that provider shares. We do not store passwords directly — Clerk handles all credential management.

Usage & prediction data

Your picks, pool memberships, leaderboard positions, and related activity within the app are stored in our database so the Service can function.

Analytics

We use Vercel Analytics to understand how people use FootyStack at an aggregate level (page views, performance metrics). Vercel Analytics is privacy-focused and does not use cookies for tracking. No personally identifiable information is sent to Vercel Analytics.

Cookies

We use essential cookies for authentication (session management via Clerk) and theme preference (light/dark mode). We do not use advertising or third-party tracking cookies. We do not respond to Do Not Track ("DNT") browser signals because we do not track users across third-party sites for advertising purposes.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases to process your personal data:

• Performance of a contract: We process your account and prediction data because it is necessary to provide the Service you signed up for (e.g. running your pools, showing leaderboards).
• Legitimate interests: We process aggregate usage data to improve the Service and fix bugs. We do this in a way that we believe does not override your rights and interests.
• Consent: Where required by law, we will obtain your consent before processing your data (e.g. for non-essential communications). You may withdraw consent at any time.
• Compliance with legal obligations: We may process data where required by applicable law.

4. How We Use Your Data

• Providing the Service: Your account and prediction data power your pools, leaderboards, and match history.
• Communication: We may send you transactional emails (e.g. pool invitations). You can unsubscribe from non-essential emails at any time.
• Improving the app: Aggregate analytics help us understand what features are used and where things break.
• Feedback: If you submit feedback through the app, we store it to follow up and improve the Service.

We do not sell your personal data. We do not use your data for advertising. Full stop.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Third-Party Services (Data Processors)

FootyStack acts as the data controller. The services listed below act as data processors — they handle data on our behalf and under our instructions, subject to their own data processing agreements.

• Clerk (United States) — Authentication and user management. Clerk processes your login credentials and profile data. Clerk Privacy Policy
• Vercel (United States) — Hosting and analytics. Vercel serves the app and collects anonymous performance data. Vercel Privacy Policy
• Neon (United States) — Database hosting. Your prediction and account data is stored in a Neon-hosted PostgreSQL database. Neon Privacy Policy
• SportMonks (Netherlands) — Football data provider. We sync match fixtures, scores, teams, and player data from SportMonks. No user data is shared with SportMonks. SportMonks Privacy Policy

6. International Data Transfers

FootyStack uses third-party services (Clerk, Vercel, and Neon) that are based in the United States. If you are accessing the Service from the European Economic Area (EEA), United Kingdom, or other regions with data protection laws, your personal data may be transferred to and processed in the United States or other countries that may not have the same level of data protection as your country.

Where required, these transfers are made subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. You can request more information about these safeguards by contacting us at privacy@footystack.com.

7. Data Retention

We keep your personal data for as long as your account is active. Specifically:

• Account data: Retained until you delete your account. Upon deletion, your personal data and predictions are permanently removed from our active database within 30 days.
• Backups: Deleted account data may persist in encrypted database backups for up to 90 days before being purged from backup systems.
• Aggregate/anonymized data: Pool statistics and anonymized usage data that cannot be linked back to you may be retained indefinitely.
• Application logs: Server logs are retained for up to 30 days for debugging and security purposes.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete personal data through your account settings, or by contacting us.
• Deletion — delete your account and associated personal data at any time from your profile settings.
• Portability — request a copy of your data in a portable, machine-readable format.
• Restrict processing — ask us to limit how we use your data in certain circumstances.
• Object to processing — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Unsubscribe from emails — opt out of non-essential communications via the unsubscribe link in any email.
• File a complaint — if you believe your data rights have been violated, you have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, or your EU supervisory authority).

To exercise any of these rights, contact us at privacy@footystack.com. We will respond within 30 days.

9. US State Privacy Rights

If you are a resident of California, Virginia, Colorado, or another US state with applicable privacy laws, you may have additional rights:

• Right to know what personal information we collect, use, and share.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale of personal information — though we do not sell personal information.

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes. To submit a request under applicable US state privacy laws, contact us at privacy@footystack.com.

10. Data Security

We take reasonable measures to protect your data. Authentication is handled by Clerk, our database is encrypted at rest, and all traffic is served over HTTPS. That said, no system is perfectly secure — we cannot guarantee absolute security.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and/or the relevant supervisory authorities as required by applicable law, without undue delay.

11. Children's Privacy

FootyStack is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are between 13 and 16 and located in the EEA, you may need parental consent to use the Service depending on local law. If you believe a child has provided us with personal data, please contact us at privacy@footystack.com so we can remove it.

12. Changes to This Policy

We may update this policy from time to time. When we do, we'll update the effective date at the top. We encourage you to review this page periodically.

13. Contact

Questions or concerns about your privacy? Email us at privacy@footystack.com, use the "Send feedback" button in the app footer, or reach out through the About page. We read every message and take privacy seriously.