Last updated: 13 September 2026
This explains what Football Squares collects about you, why, who else sees it, and what you can ask us to do about it. We have tried to write it in plain English rather than the usual fog.
1. Who we are
Matthew Travis is the controller of the personal data described here.
Privacy enquiries: privacy@runthesquares.com
2. What we collect
You give us
- Account details — your name, email address, and a phone number if you choose to add one. Your password is stored only as a bcrypt hash; we cannot read it.
- Game content — game names, the team names you type, dates, prices and payout splits.
- Pool activity — which squares you claimed, and whether the organiser has marked them paid.
- Messages — anything you send us through the contact form or by email.
We collect automatically
- Technical data — IP address, browser type and timestamps, in server logs. We use IP addresses to rate-limit sign-in and sign-up attempts, which is how we keep accounts from being brute-forced.
- A session cookie — see section 7.
We do not collect
- Card details. Payments go directly to Stripe. Card numbers never reach our servers.
- Any money you stake in a pool, or any record of it beyond the organiser's own paid/unpaid marker.
- Advertising or cross-site tracking data. There are no third-party advertising or analytics trackers on this site.
3. Why we use it, and our legal basis
For anyone covered by UK or EU data protection law, the basis for each use is set out below.
| What for | Legal basis |
|---|---|
| Creating your account and running your games | Performance of a contract |
| Taking the game activation fee | Performance of a contract |
| Showing your name to other members of a pool you have joined | Performance of a contract |
| Service emails — payment reminders, password resets | Performance of a contract |
| Rate limiting, abuse prevention, keeping accounts secure | Legitimate interests |
| Fixing faults and improving the Service | Legitimate interests |
| Meeting tax and accounting obligations | Legal obligation |
We do not send marketing email. If that ever changes we will ask first, and every message will have an unsubscribe link.
4. Who else sees it
We do not sell your personal information, and we never have. We share it only as follows.
Other people in your pool
When you join a pool, your name becomes visible to its other members, so people can see who owns which square. The organiser of that pool can also see your email address, so they can chase payment and pay you if you win. Nobody outside a pool can see that you are in it.
Service providers
| Who | What for | What they get |
|---|---|---|
| Stripe | Card payments | Your email address and payment details you give them |
| Our hosting provider | Running the site and database | All stored data, as processor |
| Our email provider | Sending service email | Your email address and the message content |
Each acts under contract and may use the data only to provide the service to us.
Otherwise
We may disclose data where the law requires it, to enforce our Terms, to protect someone's safety, or to a successor if the business changes hands — in which case we will tell you first.
5. How long we keep it
| What | How long |
|---|---|
| Account data | Until you delete your account |
| Games and squares | Until the organiser deletes the game, or you delete your account |
| Payment records | Seven years, to meet accounting and tax obligations |
| Server logs | Up to 30 days |
| Password reset tokens | One hour |
| Contact form messages | Up to two years |
Deleting your account removes your personal details. Squares you claimed in a pool that is still running may remain, shown without your name, so the pool's result stays intact for everyone else in it.
6. Your rights
Wherever you live, you can email privacy@runthesquares.com and ask us to do any of the following. We will reply within 30 days and will not charge you or treat you differently for asking.
- Access — a copy of what we hold about you.
- Correction — fix anything inaccurate.
- Deletion — erase your account and data, subject to records we must keep by law.
- Portability — your data in a machine-readable form.
- Objection and restriction — object to processing based on legitimate interests, or ask us to pause it.
- Withdraw consent — where we relied on consent, without affecting what was done beforehand.
If you are in California, the CCPA and CPRA give you rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those laws define it, and we do not process it for cross-context behavioural advertising. Exercising a right will never get you worse service.
If you are in the UK or EU, you may complain to your supervisory authority — the ICO in the UK — though we would rather you came to us first.
7. Cookies
We use one cookie: a session cookie that keeps you signed in. It is strictly necessary for the Service to work, so no consent banner is required for it. It is HTTP-only, so scripts cannot read it.
We set no advertising, analytics or tracking cookies. Blocking the session cookie will stop you being able to sign in.
8. Security
Passwords are hashed with bcrypt. Traffic is encrypted in transit with TLS. Access to a game is limited to its members, and sign-in, sign-up and password attempts are rate-limited.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data we will notify you and any regulator we are required to, within the applicable deadlines.
9. International transfers
We and our providers may process data in countries other than yours, including the United States. Where data covered by UK or EU law is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
10. Children
The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@runthesquares.com and we will delete it.
11. Changes
If we change this policy we will update the date above, and tell you by email or a notice in the Service if the change materially affects you.
12. Contact
Matthew Travis
privacy@runthesquares.com