Privacy Policy

Last updated: 10 August 2026.

This policy explains what we collect, why, and what you can do about it. We've written it to be read, not to be survived. If anything here is unclear, ask us.

1. Who controls your data

Champs FC is operated by Cuyler Consulting, which is the data controller (the "responsible party" under POPIA). Ross Cuyler is our Information Officer.

For any privacy request, email support@champsfc.com or use the contact page.

2. What we collect

• Account data — your email address and display name. If you sign in with Google, we receive your email address and basic profile information from Google; we never receive your Google password.
• Gameplay data — the pools you join, the picks you make, your results, and whether you're still standing.
• Communication preferences — which game emails you've chosen to receive.
• Technical data — IP address, browser and device information, and server logs, needed to run and secure the service.
• Cookies — essential sign-in cookies only. See section 4.

We do not collect payment details, because the game is free and there is nothing to pay. We don't ask for your real name, date of birth, address or ID.

3. How & why we use it

We don't make any decision about you by automated means that produces a legal or similarly significant effect. Round settlement is automated, but it applies the published Rules to a football result — it isn't a decision about you as a person.

4. Cookies and analytics

We use essential cookies only, so we don't show you a cookie banner. The only cookies we set are the ones that keep you signed in. They're required for the game to work, we don't use them for advertising, and we don't share them with anyone.

Our analytics is Vercel Web Analytics, which is cookieless — it sets no cookies, stores nothing on your device, and doesn't track you across other sites. We see aggregate page counts, not individuals.

When you're signed in we also keep a minimal, cookie-free record of which app pages you visit — just your account and the page, on our own servers, never stored on your device — so we can understand aggregate usage like how many players are active each week and improve the game. It sets no cookies and is never shared or used for advertising.

We don't run advertising pixels or third-party trackers. If that ever changes, we'll ask for your consent first and update this policy before anything loads.

How we know which link brought you here. When you arrive from one of our own posts or links, the web address carries a short campaign tag — you can see it in your address bar, and it says something like "instagram". If you go on to create an account, we store that tag against it, so we know which posts are worth making. We store nothing on your device to do this: the tag travels in the address bar for that visit and is discarded if you never sign up. It tells us the link you clicked, never who you are or where else you've been, and it is never shared or used for advertising.

5. Who we share it with

We don't sell your personal data, and we never will. These are every processor we use:

Our football fixture and result providers receive no personal data — the data flows one way, from them to us.

We may also disclose data where the law requires it, or to establish or defend legal claims. If we're ever involved in a business transfer, your data may move with the service, and this policy would continue to apply until you were told otherwise.

6. International transfers

Your account and gameplay data is stored and processed in the European Union (Frankfurt) — both our database and our application run there.

Some of our processors are US-headquartered and may access or process data outside the EU or South Africa. Where that happens, it's covered by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. For POPIA purposes, these recipients are bound by agreements requiring a level of protection substantially similar to POPIA's own conditions (section 72).

7. Retention & deletion

• While your account is active — we keep your account and gameplay data so the game works and results stand up.
• When you delete your account — your profile, pool entries and picks are permanently removed. You can do this yourself, any time, from your account page. Accounts without a password (Google sign-in) are deleted via a confirmation link we email you.
• After deletion — server and security logs roll off on their normal cycle (generally within 90 days). We may keep a minimal record where the law requires it, or where we need it to defend a legal claim.
• Completed pools — results may remain visible to other players in that pool's history, but without your account attached to them.

8. Email

We send game emails — a round opening, a pick reminder before lock, your result, and occasionally a reminder that a competition is about to start if you haven't joined a pool yet. Each kind has its own switch on your account page, and every email has a one-click unsubscribe link. Turning them all off doesn't affect your ability to play.

We won't send you marketing from anyone else, and we won't pass your address to any third party for their own marketing.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate — do it yourself on your account page
• Delete your account and data — do it yourself, any time
• Export your data in a portable form
• Object to or restrict processing based on legitimate interests
• Withdraw consent at any time, without affecting what came before

Most of this you can do yourself from the account page in a few seconds, which we think is better than making you write us a letter. For anything else, contact us and we'll respond within 30 days.

You can also complain to a regulator. In South Africa that's the Information Regulator; in the UK, the Information Commissioner's Office; in the EU, your national data-protection authority.

10. Security

Passwords are hashed and never stored in readable form, and we check new passwords against known-breached password lists. Access to the database is restricted at row level, so players can only read what they're entitled to. Traffic is encrypted in transit. No system is perfectly secure, but we take this seriously and will tell you promptly if something material goes wrong.

11. Children

The service is for players aged 18 and over and is not directed at children. We don't knowingly collect data from under-18s. If you believe a child has given us data, tell us and we'll delete it.

12. Changes

We'll post any changes here and update the date above. If a change is material, we'll ask you to accept it the next time you sign in rather than quietly hoping you noticed.

13. Contact

To exercise your rights or ask a question, email support@champsfc.com or use the contact page.