Privacy and cookies

What we keep, and why

Your account

Your email address, the nickname you give, your password — stored only as a bcrypt hash, never as you typed it — and when you registered. They exist so you can sign in, and your email so we can confirm it is yours and send you a new confirmation link when you ask. Kept until your account is deleted.

Your check-ins

The matches and grounds you record, with the day, the time when it is known, your rating and your note. This is a history of where you have been and when, so it is private by default: nobody else sees it unless you choose a username and make your profile public in Settings, and even then your notes are never shown to anyone. Kept until you delete the check-in or your account.

Your settings

The country the map opens on, your username and whether your profile is public. Kept until you change them or delete your account.

Signing in

Each signed-in browser holds a random token, which we store only as a hash, valid for 30 days or until you sign out. A link confirming your email is valid for 24 hours. To stop password guessing, failed sign-ins are counted per account in the server's memory for up to half an hour, and never written down.

Your address on the internet (IP)

Used, and not stored, to guess which country to open the map on — looked up in a database on our own server (MaxMind GeoLite2), so it goes nowhere — and to limit how often one address can call the site. Our request logs record which page was asked for, the result and how long it took, but not your address.

Errors

When something breaks, the error, the page it happened on and your browser's description of itself are sent to our error tracker so we can fix it. We do not attach your account or email to it.

The account, check-ins and settings are kept because you asked for the service they make up. The rest is kept in our legitimate interest in running the site securely and fixing it when it breaks.

Who else receives it

• Our hosting and database providers, who run the server and store the data above for us.
• An email service, which delivers the confirmation emails to your address.
• Sentry, the error tracker, and Better Stack, which keeps our logs — each only what is described above.
• MapTiler or OpenFreeMap, which draw the maps: your browser asks them for the map tiles, so they see your IP address and the part of the world you are looking at. The world map on the front page is only loaded when you press Show map, or straight away when you are signed in.
• API-Football's image server, from which your browser loads team crests, league logos and ground photos, and which sees your IP address as a result.
• Have I Been Pwned: when you choose a password, the first five characters of its SHA-1 hash are sent to check it against passwords published in breaches. Neither the password nor anything identifying you leaves our server.

Cookies and what we store in your browser

Only what the site needs to work. Nothing tracks you, nothing is used for advertising, and there are no third-party cookies — which is why there is no consent banner.

Your rights

You can ask for a copy of what we hold about you, have it corrected or deleted, take it elsewhere, or object to how we use it. Check-ins can be changed and deleted on My grounds, and your profile closed in Settings; deleting your account removes your check-ins and settings with it. You can also complain to the data protection authority of your country.

Contact

For any of the above, write to [email protected]. Account deletion is done on request for now; we will answer within a month.