Privacy Notice

Who is responsible

The controller of the data described here is the developer named at the foot of this page, and the address there is where every request in this notice goes. The developer is one person: there is no data protection officer, there is no representative in the European Union or the United Kingdom, and the game sits inside the exemption from the Turkish controllers' registry (VERBİS) for controllers of that size.

What we store

An account consists of a generated username, a hashed password, a hashed single-use recovery code, the position you prefer to play, and a record of which version of the terms and of this notice you accepted and when. We do not ask for or store an email address, a telephone number, a postal address or any other contact detail.

If you make a footballer, we store what you chose for it: its name, a country picked from a list, the physical details on the form — height, weight, position, foot, shirt number and colours — and the things that decide how the figure on the pitch is drawn: a body type, a skin tone, a haircut and a hair colour. Those describe the footballer you drew, and nothing reads them as a fact about you. The name is the one other players read in a lobby, on the pitch and on a scoreboard. Unless you have said you are 13 or over, the game gives the footballer its name — one the server generated, never yours; if you have, you type it, and then nothing checks whether it is your real name, so pick one you are happy for strangers to see. The form used to ask for a town as well. It no longer does, and the column that held it has been dropped.

If you build a stadium, we store how you designed it — its size, colours, grass, boards and nets, the draft you are working on and the version you built — what you spent on it, and the words you gave it: its name, its city and district, and what its boards say. With each we keep whether the developer has approved it, the reason if it was turned down, and a note of each decision until you have been shown it. A picture you try on a board for the preview stays in your browser and never reaches us.

If you buy a sponsor for the chest of your shirt, we store the words you asked for and the words that were approved, whether the developer has approved them, the reason if they were turned down, and what you paid.

The trials keep the score of each drill from your best attempt, because your attributes are computed from them and can be recomputed if the mapping is ever retuned.

For each match you finish we store the result — including the lobby's name and both teams' names — and your line in it: goals, assists, shots, passes, tackles, saves, distance covered, your rating and the experience and gold you earned. We also keep lifetime totals and your character's attributes and level.

Everything the game gives you for playing is stored so that it is still there tomorrow: your level, skill points, and gold with a ledger of what earned and spent it; the equipment and items you bought, what you are wearing, and the tickets you bought to watch a match; your training sessions and what they improved; and, if you started a Career, its save — the club, the fixtures, the tables, the seasons behind you and the choices you made along the way. If you played as a guest first, a note that your guest experience was transferred to the account, once.

Your browser's IP address is used for a few minutes at a time to slow down repeated sign-in, sign-up and lobby-creation attempts: it is kept, keyed to the attempt, in the server's memory or in Redis for at most ten minutes and then discarded. It is not written to our access log, which records only the path, status, size and duration of a request, and it is not linked to your account.

If you write to us, we keep your message, the address it came from and our answer, so that we can answer you and, later, show how the request was handled.

Guest play

You can play without registering, at any age. A guest account is a real account row flagged as a guest, with a generated username and no password you ever see.

A guest has no footballer profile and types nothing anybody else reads: their lobby's name is picked from a few the server offers, and they are shown to other players as "Guest". That is what makes guest play safe to open to a child, and it is why the section on children below can say what it says.

Experience earned as a guest is held in a server-side cache (Redis) for 24 hours so that it can be claimed if you register. Guest accounts that have not been used for 30 days — no finished match and no change to the account in that time — are deleted automatically, along with everything attached to them.

Why we store it

Everything we hold comes from you — typed into a form or produced by playing — and from your browser, which is where the IP address comes from; nothing is bought, scraped or received from anybody else. We keep it to let you sign back in, to run matches and show scoreboards, to keep your progression between sessions, and to stop abuse such as automated sign-ups.

The legal ground for each of those

Article 10 of the Turkish Personal Data Protection Law (KVKK) asks a controller to name the ground it processes on, not only what it processes and why. None of this rests on your consent, and that is deliberate: consent can be withdrawn at any moment, and processing that can be switched off on request is a poor foundation for the account you asked us to keep. Where the law already permits something, asking for consent as well would make the consent meaningless.

Your account — the generated username, the password hash and the recovery code hash — is processed under KVKK Article 5(2)(c), directly related to the conclusion and performance of a contract, and GDPR Article 6(1)(b). The contract is this one: you asked for an account, and these three things are what an account is.

For a child, who cannot make a contract, that ground does not hold, and we do not pretend otherwise: their account and their matches are processed under KVKK Article 5(2)(f) and GDPR Article 6(1)(f) instead, our legitimate interest in running the game they asked to play. We do not ask your age, so we do not know which of the two applies to you; both cover the same processing and give you the same rights, and the balancing in the section on children below is written as if you were a child.

Your matches — results, your line in each of them, lifetime totals, and your character's attributes and level — sit on the same ground, as do the footballer you made, a stadium you build and the words on your shirt. Keeping them between sessions is not a side effect of the service; it is the service.

Your IP address, used for a few minutes to rate-limit sign-ins and sign-ups, is processed under KVKK Article 5(2)(f), our legitimate interest in keeping the game standing against automated sign-ups and abuse, and GDPR Article 6(1)(f). Because that ground is a balance rather than a permission, you may object to it; write to the address below.

A message you send us, and the address it came from, are processed to answer you: under KVKK Article 5(2)(f) and GDPR Article 6(1)(f), our legitimate interest in replying to the people who write to us, or — when the message is a request about your data — under KVKK Article 5(2)(ç) and GDPR Article 6(1)(c), because answering it is a duty the law puts on us. It is kept for a year after the answer under KVKK Article 5(2)(e) and GDPR Article 6(1)(f), so that we can show how the request was handled if that is ever questioned.

The jwt and preferred_language cookies are strictly necessary to deliver the game you asked for, so they are set without consent — and, equally, there is nothing about them to opt out of. Everything a consent banner normally guards is absent here.

Nothing in this notice rests on your consent, so there is no consent to withdraw; what you have instead is the right to object, above, and the right to delete your account, which ends all of it at once.

Children

Nothing here has a minimum age — not guest play, and not an account. Rather than put up a bar that a ten year old would step over without pausing, we assume some of the people playing are children and build for that.

Nothing is sold here and nothing is advertised. There is no analytics, no profiling, no tracking of any kind, and no way for one player to send another a message. A guest is asked for no email address, no name, no telephone number and no location, and cannot type anything another player reads: their lobby's name is one of a few the server offers them to pick from, and on the pitch they are "Guest". A child playing as a guest therefore has no way to tell anybody who they are, which matters more than any age box, because the guardrail that screens public text can refuse an email address and a phone number but cannot refuse a true sentence.

The only identifiers guest play involves are the sign-in cookie, the language preference and the IP address. Each is used solely to support the internal operations of the game: the cookie signs you in, the language preference is a setting you chose, and the IP address holds off automated sign-up floods for a few minutes at a time. None of the three is used to build a profile, to recognise anybody across other websites, or for any other purpose, and none is disclosed to anyone. Under the United States Children's Online Privacy Protection Act that is the support-for-internal-operations basis, which is why guest play asks for no verifiable parental consent — there is nothing being collected that would need one.

For a child in the European Union or the United Kingdom, we rely on our legitimate interest in running the game they asked to play, rather than on a contract a child is too young to make or a consent they are too young to give. The balancing is short because the processing is: what is handled is the minimum needed to put somebody on a pitch, none of it is used for anything else, and a guest account is deleted after thirty days without use.

An account keeps more and keeps it longer — a footballer, a level, a career, held until you delete them — so the things on it that could be about a person are closed the same way. A footballer's name and a lobby's name are picked from ones the server offers, and anything typed in their place is refused, unless the player has said they are 13 or over; a stadium's name, city, district and board words, and the sponsor on a shirt, cannot be written at all until then. The server checks the name against the ones it generated and remembers the declaration on the profile, rather than trusting what a form claimed, so the declaration is a gate rather than a decoration. An account therefore collects nothing that is contact information and no child's own name, which is what keeps it, like guest play, inside the support-for-internal-operations basis under COPPA.

For a child's account the ground is legitimate interest, as it is for a guest, because a child cannot make the contract the adult version of that account rests on. The balancing is the same short one: what is kept is a footballer, their level and what happened in their matches, none of it is used for anything but showing it back to them, and all of it goes the moment the account is deleted.

If you are a parent and would rather a guest's records went sooner, they can be deleted from the data rights page without a password — a guest has no password to have.

Who we share it with

No analytics provider, no advertising network, no crash reporter and no third-party font or script. The only companies that touch your data are the hosting provider that runs our servers in Türkiye, described in the next section, and — only if you write to us — the provider of our mailbox, which is in Türkiye as well. Other players see your display name, your position, your rating and your match statistics — in the lobby list, on the pitch and on the scoreboard — which is the point of a multiplayer game.

A stadium you build, and the words you put on your shirt, are seen first by you and by the developer, who reads the words and looks at the stadium in order to approve them or not; the site's mailbox is told only how many stadiums and words are waiting, never whose. Once approved, a stadium's name, city and district, its size and what its boards say are shown on your player card and to everybody in a match played in it, and the words on your shirt on your player card, on the team sheet and across your chest in the close-up after you score in an online match.

A name you type — a footballer's or a lobby's — is checked automatically on our own server before anyone sees it, against word lists and by a language model that runs there. It is sent nowhere else, the check writes nothing down, and a name it refuses you simply change.

Tapping a registered player's name opens their player card: their display name, country, level, position and shirt number, their totals and last five online matches, the badges those and their career have earned, and how many players follow them. A registered player can follow another from the card; the player followed sees only the number going up, never who, and nobody else sees whom you follow. You can make your own card private from your copy of it, and then nobody else sees any of it or can follow it; a guest's card is always private, and a guest follows nobody.

The weekly and monthly tables reach further. They are public pages, open to anyone who visits the site, signed in or not, and to search engines, and they show a registered player's display name beside their goals, average rating and matches. The name opens the player card there too, for anyone who visits, unless the card has been made private. A guest never appears on them.

Where it is stored

The game runs on a rented server in Türkiye, and the database sits on that same server. Your account row and your match records are stored and processed in Türkiye by our hosting provider, which processes them only to run the service for us, under a written data processing agreement; it is not a recipient in its own right. Our mailbox is in Türkiye too, with the same provider and under the same agreement, so an email you send us is kept here. Nothing is sold, shared for advertising, or handed to anyone else.

Because the data stays in Türkiye, there is no transfer abroad under Article 9 of the Turkish Personal Data Protection Law (KVKK) for any of it to rest on.

If you play from the European Union or the United Kingdom, your browser sends your data straight to our server in Türkiye. Türkiye has no adequacy decision from either of them, so the protection you have is the one this notice describes: the GDPR and the UK GDPR apply to us because we offer the game to you, and the rights listed below are yours whichever country you play from.

How long we keep it

Registered accounts are kept until you delete them. Guest accounts are deleted after 30 days of inactivity. Deleting your account removes your attributes, progression, lifetime statistics, match lines, stadium and shirt words from the live database immediately and permanently, and replaces your name on the scoreboards of finished matches with "Deleted player". A finished match's full scoreboard — every player's line in it — is kept for 30 days; after that only the score, the winner and the player of the match remain, and your own line in it stays with your account. Whom you follow is kept until you unfollow them or either account is deleted, and so is a note of which badges you have already been shown, so that the result screen announces a new one only once.

A backup of the database is taken and kept in Türkiye, so that the game can be put back if something goes wrong; a row you delete is gone from it by the next night. A guest's cached experience expires 24 hours after their last match, and the rate-limit counters that carry an IP address last at most ten minutes. A match is held in Redis as well while it lasts, so that another server can finish it if one fails: an open lobby until it closes, a match in progress until it is settled and never longer than six hours, and an online match played in your browser for three hours, so that its result can still be accepted after a restart.

The servers' own logs hold no IP address and no name; they record what the server did, and they are rotated once they reach ten megabytes.

A message you send us is kept, with the address it came from and our answer, until the request has been answered and for one year after that; then it is deleted.

Your rights

Under Article 11 of the KVKK you may learn whether we process data about you and ask for it; learn why, and whether it is used for that; know who it is passed to, here or abroad; have it corrected if it is incomplete or wrong; have it erased; have a correction or an erasure passed on to anyone we passed the data to; object to a decision about you taken purely by a machine (there are none here); and claim compensation for damage from unlawful processing. Under the GDPR and the UK GDPR you have the matching rights of access, rectification, erasure, restriction, portability and objection.

Most of them you exercise yourself, without writing to anyone: your data is on the character and Online Match screens, a full copy can be downloaded from the data rights page, a footballer can be edited on the character page, and the account can be deleted on the data rights page. For anything else, write to the address below from within reach of the account: we hold no email address, so the only way we can tell that a request is yours is that you can sign in, or that you know the username and the recovery code.

We answer within 30 days and free of charge, as Article 13 of the KVKK asks; if the answer is no, we say why.

If you think we have got something wrong, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) — after writing to us first, as the law asks — and, in the European Union or the United Kingdom, to your data protection authority.