Privacy Policy

Who We Are

Total Football Recall is a daily Scottish football trivia game operated from the United Kingdom. For any privacy-related queries, contact us at gaffer@totalfootballrecall.co.uk.

What Data We Collect

When you create an account, we collect:

• Email address — used for account login and identification
• Display name — shown publicly on leaderboards and within private leagues
• Password — stored as a one-way bcrypt hash (we cannot see your password)
• Game scores — your daily scores history
• Private league membership — which leagues you have created or joined

If you play without an account, we store a random session identifier in your browser's local storage. This is not personally identifiable.

Why We Collect It

We use your data for the following purposes:

• To provide account login functionality
• To display your chosen name on public leaderboards
• To track and display your game scores and history
• To enable private leagues where your display name and scores are visible to other league members

The legal basis for processing is consent (you choose to create an account and join leagues) and legitimate interest (providing the game service you signed up for).

Private Leagues

When you create or join a private league, the following information is visible to other members of that league:

• Your display name
• Your game scores within the league's date range
• Your ranking position

Your email address is never shared with other league members. League creators can see the same information as other members — they cannot access your email or account details.

How We Store Your Data

• Data is stored in a PostgreSQL database hosted by Supabase (EU region)
• Passwords are hashed using bcrypt and cannot be reversed
• Database connections use SSL encryption
• We do not store payment card information (no payments are currently taken)

Data Sharing

We do not sell, rent, or share your personal data with any third parties for marketing purposes. Your data is only processed by:

• Supabase — database hosting (data processor)
• AWS Amplify — application hosting (data processor)

Cookies

We use only essential cookies required for authentication sessions. We do not use tracking cookies, analytics cookies, or advertising cookies.

Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your account and all associated data
• Portability — request your data in a machine-readable format
• Withdraw consent — delete your account at any time

To exercise any of these rights, email gaffer@totalfootballrecall.co.uk.

Data Retention

We retain your account data for as long as your account is active. If you delete your account, all personal data (email, display name, scores) will be permanently removed within 30 days. Private leagues you created will also be deleted.

Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance.

Complaints

If you have concerns about how we handle your data, you can contact the Information Commissioner's Office (ICO) at ico.org.uk.