Privacy Policy

This page explains what information Offside Fund collects, why, and how it's used. It covers the site and its Google sign-in and reCAPTCHA integrations.

Account information you provide: username, email address, and a password (stored as a salted hash, never in plain text) — or, if you sign in with Google, your Google account ID and the profile info Google shares with us instead of a password.

Activity on the Service: your virtual balance, trades, portfolio holdings, ETF positions, short positions, and dividend history — this is core to how the Service works, not optional analytics.

• To create and operate your account, and to run the trading/dividend mechanics themselves.
• To send account emails — email verification, and (to admins only) match-verification mismatch alerts.
• To detect and prevent abuse, spam, and automated signups (rate limiting, reCAPTCHA).
• To respond if you contact us.

We do not sell your personal information, and we do not use it for third-party advertising.

Google — powers optional "Sign in with Google" and the reCAPTCHA on registration. Google processes some data (like your IP address) directly under its own privacy policy when you use these.

Email delivery — verification and admin-alert emails are sent through an SMTP provider, which handles the delivery of the email address and message content.

Football data provider — supplies match fixtures and player statistics used to price players and calculate dividends. This is football data only; we don't share your personal account information with it.

Hosting provider — the servers and database that run the Service and store the data described above.

We use a login session cookie and a CSRF-protection cookie. Both are functional — they keep you signed in and protect form submissions — not advertising or tracking cookies.

We keep your account data for as long as your account is active. If you ask us to delete your account, we'll do so, though we may retain minimal records for a reasonable period where needed for security or legal reasons.

Passwords are stored as salted hashes, not plain text. We take reasonable steps to protect your data.

To request a copy of your data, a correction, or account deletion, email [email protected].

The Service is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn an account belongs to a child under 13, we will delete the account and its data.

We may update this policy from time to time. Material changes will update the "Last updated" date above.

Questions about this policy: [email protected].