Privacy Policy

Last updated: 25 September 2026.

This policy explains what we collect, why, and what you can do about it. We've written it to be read, not to be survived. If anything here is unclear, ask us.

1. Who controls your data

Champs FC is operated by Cuyler Consulting, which is the data controller (the "responsible party" under POPIA). Ross Cuyler is our Information Officer.

For any privacy request, email support@champsfc.com or use the contact page.

2. What we collect

• Account data — your email address and display name. If you sign in with Google, we receive your email address and basic profile information from Google; we never receive your Google password.
• Gameplay data — the pools you join, the picks you make, your results, and whether you're still standing.
• Feedback you choose to send — if you rate a Panenka game at the end, we keep your rating, anything you write, which question you reported (if any) and the day's game, linked to your account if you're signed in. We don't record your IP address or device with it, and it sets no cookies.
• Communication preferences — which game emails you've chosen to receive.
• Technical data — IP address, browser and device information, and server logs, needed to run and secure the service.
• Cookies — essential cookies only: signing in, and your Panenka game if you play without an account. See section 4.

We do not collect payment details, because the game is free and there is nothing to pay. We don't ask for your real name, date of birth, address or ID.

3. How & why we use it

We don't make any decision about you by automated means that produces a legal or similarly significant effect. Round settlement is automated, but it applies the published Rules to a football result — it isn't a decision about you as a person.

4. Cookies and analytics

We use essential cookies only, so we don't show you a cookie banner. The only cookies we set are the ones that keep you signed in and, if you play Panenka without an account, one that holds your game and streak on that device (it's set only when you play your first round, and removed once you sign in and the game moves to your account). They're required for the game to work, we don't use them for advertising, and we don't share them with anyone.

Our analytics is Vercel Web Analytics, which is cookieless — it sets no cookies, stores nothing on your device, and doesn't track you across other sites. We see aggregate page counts, not individuals.

When you're signed in we also keep a minimal, cookie-free record of which app pages you visit, so we can understand usage like how many players are active each week and improve the game. We send the same record, plus key actions like making a pick or joining a pool, to PostHog, our analytics provider in the EU, so we can see where the game is hard to use. It's tied to your account ID, never your name or email, sets no cookies, stores nothing on your device, and is never used for advertising. If you play Panenka without an account, PostHog is told only that someone started, finished, shared or rated that day's game, with no ID at all, so none of those can be linked to each other or to you.

When something breaks. If a page errors, we send a technical error report to Sentry so we can fix it: what failed, on which page, your browser type, the country you're in, and your account ID if you're signed in. It never includes your name, email, password or IP address, sets no cookies, stores nothing on your device, and is kept in the EU.

We don't run advertising pixels or third-party trackers. If that ever changes, we'll ask for your consent first and update this policy before anything loads.

How we know which link brought you here. When you arrive from one of our own posts or links, the web address carries a short campaign tag — you can see it in your address bar, and it says something like "instagram". When you arrive from a link in an AI assistant such as ChatGPT, Claude or Gemini, we add the same kind of tag naming the assistant (just its name, never your conversation). If you go on to create an account, we store that tag against it, so we know which posts are worth making. We store nothing on your device to do this: the tag travels in the address bar for that visit and is discarded if you never sign up. It tells us the link you clicked, never who you are or where else you've been, and it is never shared or used for advertising.

Our emails. Links in the emails we send you about the game carry the same kind of tag, naming the email (for example "pick_reminder"). When you follow one while signed in, we record that you came from that email, and we keep a record of which emails we sent you. That's how we know which emails are useful and which we should stop sending. We don't track whether you open an email — there are no tracking pixels — and these records are deleted after 180 days.

5. Who we share it with

We don't sell your personal data, and we never will. These are every processor we use:

Our football fixture and result providers receive no personal data — the data flows one way, from them to us.

We may also disclose data where the law requires it, or to establish or defend legal claims. If we're ever involved in a business transfer, your data may move with the service, and this policy would continue to apply until you were told otherwise.

6. International transfers

Your account and gameplay data is stored and processed in the European Union (Frankfurt) — both our database and our application run there.

Some of our processors are US-headquartered and may access or process data outside the EU or South Africa. Where that happens, it's covered by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. For POPIA purposes, these recipients are bound by agreements requiring a level of protection substantially similar to POPIA's own conditions (section 72).

7. Retention & deletion

• While your account is active — we keep your account and gameplay data so the game works and results stand up.
• When you delete your account — your profile, pool entries and picks are permanently removed. You can do this yourself, any time, from your account page. Accounts without a password (Google sign-in) are deleted via a confirmation link we email you.
• After deletion — server and security logs roll off on their normal cycle (generally within 90 days). We may keep a minimal record where the law requires it, or where we need it to defend a legal claim.
• Completed pools — results may remain visible to other players in that pool's history, but without your account attached to them.

8. Email

We send game emails — a round opening, a pick reminder before lock, your result, and occasionally a reminder that a competition is about to start if you haven't joined a pool yet. Each kind has its own switch on your account page, and every email has a one-click unsubscribe link. Turning them all off doesn't affect your ability to play.

We won't send you marketing from anyone else, and we won't pass your address to any third party for their own marketing.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate — do it yourself on your account page
• Delete your account and data — do it yourself, any time
• Export your data in a portable form
• Object to or restrict processing based on legitimate interests
• Withdraw consent at any time, without affecting what came before

Most of this you can do yourself from the account page in a few seconds, which we think is better than making you write us a letter. For anything else, contact us and we'll respond within 30 days.

You can also complain to a regulator. In South Africa that's the Information Regulator; in the UK, the Information Commissioner's Office; in the EU, your national data-protection authority.

10. Security

Passwords are hashed and never stored in readable form, and we check new passwords against known-breached password lists. Access to the database is restricted at row level, so players can only read what they're entitled to. Traffic is encrypted in transit. No system is perfectly secure, but we take this seriously and will tell you promptly if something material goes wrong.

11. Children

The service is for players aged 18 and over and is not directed at children. We don't knowingly collect data from under-18s. If you believe a child has given us data, tell us and we'll delete it.

12. Changes

We'll post any changes here and update the date above. If a change is material, we'll ask you to accept it the next time you sign in rather than quietly hoping you noticed.

13. Contact

To exercise your rights or ask a question, email support@champsfc.com or use the contact page.