Privacy Policy

Last updated: July 23, 2026

This document is available in English only. The English version is the one that applies.

This policy explains what Fantascores (fantascores.com) collects, why, and what you can do about it. Fantascores is a football prediction game — we sell nothing, advertise nothing, and share nothing with data brokers. It is written to be read, not to be survived.

1. What We Collect

• Account — your email address and username. A password is held by our authentication provider as a salted hash; we never see or store the password itself.
• Profile — anything you choose to add, such as a bio, plus your friend connections.
• Game data — your predictions, banker picks, skill tokens and objective progress, the leagues you join, your points and standings, and your archived finishing positions.
• Preferences — theme, language, and your notification and privacy toggles.
• Technical data — our hosting and database providers log request metadata (IP address, user agent, timestamps) for security and operations. We also run privacy-friendly, aggregate page analytics that do not use cookies and do not build a profile of you.

We do not collect payment details, location data, or contacts, and we do not use advertising or cross-site tracking of any kind.

2. Why We Use It

• To run the game — record your predictions, score them, and rank you in leagues. Legal basis: performance of our contract with you.
• To keep the service secure and working, and to diagnose faults. Legal basis: our legitimate interest in a functioning, non-abused service.
• To send you matchday and reminder emails, if you have those switched on. Legal basis: consent, withdrawable at any time — see §5.
• To send account and security emails (confirmation, password reset). These are necessary to operate your account and cannot be switched off while the account exists.

3. What Other Users Can See

Fantascores is a social game, so some of your data is deliberately public to other signed-in users:

• Your username, and your profile bio if you set one.
• Your predictions — but only after the deadline has passed. Before kickoff your picks are hidden from everyone, which is the point of the game. Once a match locks, they are revealed on the league board alongside everyone else’s, including a marker if you amended a pick using a skill.
• Your points, accuracy and league position, and your archived finishing positions (your palmarès).

Your email address is never shown to other users.

4. Who We Share It With

We do not sell or rent your data. It is handled on our behalf by a small number of service providers, each bound to process it only on our instructions:

• Supabase — database and authentication (where your account and game data live).
• Vercel — application hosting and aggregate analytics.
• Resend — delivery of the emails we send you.

These providers may process data outside the European Economic Area; where they do, transfers rely on the European Commission’s Standard Contractual Clauses. Our football data sources (ESPN and football-data.org) supply match information to us and receive no personal data about you. We will also disclose data where we are legally obliged to, or where it is necessary to protect the service or someone’s safety.

5. Emails, and How to Stop Them

Matchday and reminder emails are optional. You can turn them off in Settings, or use the one-click unsubscribe link that every one of those emails carries — including the unsubscribe button your mail app shows at the top of the message. Either route takes effect immediately, without you needing to sign in. Account and security emails are not affected.

6. Your Rights

Under the GDPR you can access, correct, export, delete, restrict or object to our use of your data, and withdraw consent at any time. Two of these are built into the app and need no request:

• Export your data — Settings → “Export my data” downloads everything we hold about you as a single JSON file, immediately.
• Delete your account — Settings → Danger Zone. See §7 for exactly what this does.

For anything else, contact us at the address in §11. You also have the right to complain to a supervisory authority — in Italy, the Garante per la protezione dei dati personali.

7. What Deletion Actually Does

We would rather describe this precisely than promise something we do not do. When you delete your account:

• Deleted outright — your login, your predictions and their history, your points and standings, your skills and objectives, your preferences, your activity, your league memberships and your friend connections.
• Kept, without your identity — your archived finishing positions in completed seasons (a league’s final table would otherwise become false for everyone else in it). If you have any, your profile is replaced by an anonymous placeholder such as “Deleted user” with your email and all other personal fields erased. If you have none, your profile is deleted outright.
• Already anonymous — how often each scoreline was predicted for a given match is stored as a frozen count with no link to any user, and is unaffected by your deletion.

Deletion is immediate and cannot be undone. Export your data first if you want to keep it. Backups taken before deletion age out on our providers’ ordinary retention cycles.

8. How Long We Keep It

We keep your account data for as long as your account exists, because the game is cumulative — your record only means anything if it is kept. Once you delete your account, §7 applies. Operational logs held by our providers are retained on their standard short cycles.

9. Cookies

We use a small number of cookies, all of them necessary for the site to work. We set no advertising or cross-site tracking cookies, which is why you are not being asked to dismiss a consent banner:

• Session cookies — keep you signed in. Set by our authentication provider.
• fantascore-theme — remembers which colour theme you chose.
• locale — remembers your language.

10. Security

Data is encrypted in transit, passwords are stored only as hashes, and access to your rows is enforced in the database itself rather than only in the application. No system is perfectly secure, and we will not claim otherwise — but if a breach ever affects your data, we will notify you and the supervisory authority as the GDPR requires.

11. Children

Fantascores is not intended for children under 14, the age of digital consent in Italy. We do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will remove it.

12. Changes to This Policy

We may update this policy. Changes are published on this page with a new “Last updated” date, and anything significant will be flagged in the app.

13. Contact Us

For any question about this policy, or to exercise a right that is not already a button in Settings: