Privacy Policy
Effective date: 20 September 2026 · Operator: [OPERATOR LEGAL NAME] · Last reviewed: 20 September 2026
This Privacy Policy explains what personal data BotBall collects when you use bot-ball.com, why we collect it, how long we keep it, who we share it with and the rights you have. We have designed the Service to work with as little personal data as possible.
1. Overview
Most of the Service can be used without an account and without cookies. Our own visitor statistics rely on salted, irreversible hashes rather than identifiers. Optional features (nicknames, Google sign-in, Friends Groups, the analyst chat) involve limited additional data described below. We never sell personal data and we do not use it for advertising.
2. Controller and contact
The data controller is [OPERATOR LEGAL NAME], [registered address], e-mail [contact e-mail address]. [If you are required to appoint an EU/UK representative or a Data Protection Officer, insert their details here.]
3. What we collect and why
| Activity | Data | Purpose |
|---|---|---|
| Browsing the site | Server logs (IP address, user agent, requested URL, timestamp) held briefly by our hosting and CDN providers; a salted daily hash derived from IP + user agent for our own visitor counts — the hash cannot be reversed into an IP and is discarded with the daily rollup; page (tab) name, referrer domain, coarse device/browser class and country as supplied by our CDN. | Operating, securing and monitoring the Service; understanding aggregate usage. |
| Google Analytics 4 | Cookie-based analytics identifiers, pages viewed, events (such as viewing a match or submitting a prediction), approximate location, device data. IP anonymisation is applied by Google Analytics 4 by default. | Aggregate audience measurement — see the Cookie Policy for how to opt out. |
| Playing with a nickname | The nickname you choose, a random token stored in your browser's local storage and on our servers, your predictions and results. | Keeping your picks and statistics between visits; public leaderboard (nickname only). |
| Google sign-in | Your Google account identifier (“sub”), first name and profile-picture URL, as provided by Google after you consent; a random session token. We do not receive your password and we do not store your e-mail address. | Recognising you across devices; weekly statistics; leaderboard (first name and avatar). |
| Friends Groups | Group name and settings, your membership, your predictions within the group, the nickname or first name shown to other members. | Running private leagues you choose to create or join. |
| “Speak to the Data” analyst chat | The text of your question (please do not include personal data), which is processed together with public football data by a third-party large-language-model provider and kept by us in a short rolling log of recent questions for quality review. | Answering your question; improving the feature. |
| Contacting us | Whatever you include in your message and your contact details. | Responding to you. |
We do not collect payment data (there is nothing to pay for), precise geolocation, contacts, or special categories of personal data.
4. Legal bases (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on: legitimate interests (Art. 6(1)(f)) for operating, securing and measuring the Service with privacy-preserving techniques and for the analyst chat log; performance of a contract / steps at your request (Art. 6(1)(b)) for nicknames, Google sign-in, predictions and Friends Groups; consent (Art. 6(1)(a)) for non-essential cookies such as Google Analytics, which you may withdraw at any time; and legal obligation (Art. 6(1)(c)) where we must retain or disclose data by law.
5. Cookies and similar technologies
We use a small number of cookies and local-storage items. Essential items (your nickname token, session token, and remembered preferences such as having dismissed the “how it works” panel or the 18+ notice) are required for the Service to function. Google Analytics cookies are optional. Full details, including how to refuse or delete them, are in our Cookie Policy.
6. Who we share data with
We share data only with processors that help us run the Service, under contracts that restrict their use of it: Railway (application hosting and database), Cloudflare (CDN, DNS and security), Google (Sign-In and Analytics), and a large-language-model provider that processes analyst-chat questions. Football data providers receive no personal data from us. We may disclose data if required by law, to protect our rights or the safety of any person, or as part of a merger, acquisition or asset sale (in which case this policy continues to apply). Public leaderboards and groups display the nickname or first name and avatar you chose to use — nothing else.
7. International transfers
Our providers may process data in the United States and other countries outside your own. Where the GDPR/UK GDPR applies, transfers are protected by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision (including the EU-US Data Privacy Framework for certified providers). You may request a copy of the relevant safeguards.
8. Retention
Daily visitor hashes: discarded within 48 hours after aggregation; aggregate counts are kept indefinitely. Server and CDN logs: as configured by our providers, typically up to 30 days. Nickname tokens, sign-in associations, predictions and group data: for as long as you use the Service and until you delete them; inactive records may be pruned after a season ends. Analyst-chat log: rolling, most recent 500 questions only. Contact correspondence: up to 24 months. Google Analytics data: per your settings and Google's retention controls (default 14 months).
9. Your rights and how to delete your data
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You can delete your BotBall data yourself at any time: open the Beat the Bots section, choose your profile and select “Delete my data” — this permanently removes your nickname or sign-in association, predictions, statistics and group memberships from our servers. Clearing your browser's site data removes the local token. For any other request, e-mail [contact e-mail address]; we respond within one month (extendable where permitted). We may need to verify your identity, which for Google sign-in we do by asking you to sign in again.
California residents: we do not “sell” or “share” personal information as defined by the CCPA/CPRA and we do not use it for targeted advertising; you may exercise access and deletion rights as described above without discrimination.
10. Children
The Service is not directed at persons under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data to us, contact us and we will delete it promptly.
11. Security
All traffic is encrypted in transit (HTTPS with HSTS). Administrative functions are protected by server-side credentials that are never exposed to the browser, third-party API keys are held only in the hosting provider's encrypted environment, and application state is backed up daily. No system is completely secure; if we become aware of a breach affecting your data we will notify you and the competent authority where the law requires.
12. Automated decision-making
The bots' predictions, the Judge's scorelines, credit tiers in the BotBall Bank and leaderboard rankings are automated outputs about fictional participants or public football data, not about you. We make no automated decisions with legal or similarly significant effects on any user.
13. Changes to this policy
We may update this policy to reflect changes in the Service or the law. The effective date at the top will change, and material changes will be signposted on the Service. Continued use after the effective date means the updated policy applies.
14. Contact and complaints
Questions or requests: [contact e-mail address]. If you are in the EEA or UK and are unhappy with our response, you may lodge a complaint with your local supervisory authority (for example the Irish Data Protection Commission or the UK Information Commissioner's Office). [If applicable, name the authority of the operator's home jurisdiction here, e.g. the Israeli Privacy Protection Authority.]