Throwback FootyThrowback Footy

Throwback Footy Privacy Policy

This policy explains how Throwback Footy Ltd uses personal information for our website and support service, and how information will be used in the planned launch version of Throwback Footy: Classic Matches. The app sections cover Single Player, same-device Head to Head, free matches, the referral reward and the paid match pack when those features are made available. They do not mean that the app or every feature is already available in your country.

It explains your choices and how to ask us to delete information. The planned initial launch markets are the United Kingdom, Australia and New Zealand. The United States and Canada are deferred. Store availability is separate from this policy.

Who we are and how to contact us

Throwback Footy Ltd is the controller responsible for the uses described in this policy. Our company number is 17498477 and we are registered in England and Wales. Our registered office is 21 Ormskirk Road, Rainford, St. Helens, England, WA11 8DQ.

You can email [email protected] or write to Throwback Footy Ltd, 21 Ormskirk Road, Rainford, St. Helens, WA11 8DQ, United Kingdom. Please use these details for privacy questions, requests and complaints.

A short explanation for younger players

Throwback Footy gives your app a guest identifier so it can remember referral rewards and unlocked matches. Our services also process technical information, such as your IP address, to run and protect the app. If you contact support, we receive the information you send us. You or your parent or carer can ask privacy questions at [email protected].

You do not need to give us your real name or create an email-and-password account to play. Use nicknames for Head to Head. Ask a parent or carer before buying something or sending us personal information. The rest of this policy explains the details.

Guest accounts and access

On first opening the app, each new user receives a persistent guest account. Later openings resume the existing account where its credentials remain available. Supabase, our authentication and database provider, generates a random, unique account identifier. The same identity supports referral participation, unlocked matches, purchases and account access. This happens before you choose to buy a pack or redeem a code. It avoids separate identities being created for those features. It does not identify every person who shares a device, or guarantee recovery across devices.

Although we call it a guest or anonymous account, the identifier and records linked to it are personal information. They are not necessarily anonymous under data-protection law. Authentication involves account and session identifiers, access and refresh credentials, timestamps and technical information such as IP addresses and software details. Credentials are stored on your device so you do not have to sign in each time. On iPhone, new authentication credentials use the operating system's secure storage.

A guest account is not an email-based account-recovery service. Losing local credentials or reinstalling the app may affect your ability to recover that account. Device storage and backups can behave differently across operating systems. Uninstalling the app does not request deletion of server records. Purchase restoration is a separate store process and does not restore an erased guest profile or game history.

Gameplay and player searches

In the native app, answer checking, scores, personal bests, settings, progress and same-device Head to Head names are handled on your device. We do not upload completed answers or a score history to the gameplay database. This does not mean every gameplay interaction stays on your device.

When you search for a footballer, the search text is sent to Supabase to return matching players. Match and content requests also go to our backend. These requests can reveal which game content you request. The player-search database function reads football reference data; it does not create a personal search-history record. Service and security logs are separate from that function.

The app stores information needed to maintain your session, remember your choices and show local game results. Removing local app data can remove settings and progress and may affect guest-account access. Device or operating-system backups are controlled separately and may retain copies. We do not remotely erase your personal device backups.

Referrals

The app creates or retrieves a referral profile and code for your guest account. If another player enters your code, or you enter theirs, we record the participating account identifiers, code, participation and reward. Each account can participate once under the referral rules. A qualifying referral unlocks Match #3 for both participants.

The person you give your code to can see that code. The app does not give them your authentication credentials or support correspondence. We do not ask for address-book access or upload your contacts. If you choose to communicate with someone using a separate messaging service, that service handles the message under its own terms.

Deleting one participant's account does not remove the other participant's legitimately earned reward. We remove or minimise the deleted person's information while retaining the limited records needed for the remaining reward and any justified legal or security purpose.

Purchases and restoration

Apple processes payments for purchases made through the App Store. The paid match pack is a one-off, non-consumable purchase, not a subscription. We do not receive your full payment-card details.

RevenueCat helps verify purchases and restore access. The app, RevenueCat and our backend process the guest identifier, product and transaction identifiers, purchase and verification dates, purchase status, refunds or revocations and the matches your account may access. RevenueCat also processes technical information about the app and device and can associate identifiers for the same customer, known as aliases. We use purchase evidence and ownership history to distinguish valid purchases, refunds and changes of ownership and to avoid giving the same purchase to conflicting accounts.

Use Restore Purchases to ask the store to check eligible purchases. Restoration depends on store records and the applicable ownership rules; it is not a promise to recover a deleted account. Account deletion does not itself issue a refund or erase Apple's transaction records, and does not remove your statutory consumer rights. If you use a version distributed through Google Play, Google processes the corresponding store payment and purchase records.

Technical information and website use

Our hosting, authentication, purchase and security services process request information, including IP addresses, device or browser type, operating system, app version, request times, requested addresses and relevant account or session metadata. Security services may derive an approximate country or region from an IP address and use network characteristics to identify suspicious traffic. This is different from asking for GPS location.

This information helps deliver content, verify access, prevent abuse and investigate faults. We receive purchase verification and ownership information from the app stores and RevenueCat, and referral participation information when another player redeems your code. The website uses Cloudflare Pages and Cloudflare security services. App images may be delivered through Draftbit's image-hosting service, which receives the network information needed to serve the image. Requests to external links, such as our social-media pages, are handled by those sites under their own privacy notices.

The launch app has no advertising. We do not use your information for cross-app advertising tracking, sell personal information or upload your contacts. Service logging still takes place. We assess new analytics, advertising or other optional technologies before enabling them and provide information and choices where required.

Support and privacy correspondence

When you contact us, we receive your email address, message and any attachments or account information you choose to provide. Cloudflare Email Routing forwards messages to our Microsoft Outlook/Hotmail mailbox. Only send information relevant to your enquiry. Do not send passwords, session tokens, full card details or unrelated sensitive information.

If we use a child's contact details solely to answer a one-off enquiry under a legal exception, we delete those details and the unnecessary enquiry content promptly after answering and do not use that exception to link the message to an account or contact the child again.

We may ask for limited evidence to locate the relevant account and verify that you are entitled to make a request. A public referral code or account identifier alone is not proof of ownership. We do not routinely require identity documents.

We use the following bases under UK data-protection law:

The UK lawful bases above do not replace consent required by another applicable law. Where consent is required, the relevant person must receive clear information about the collection, purposes and recipients and be able to make the required choice before that processing begins. A parent or guardian must provide consent where the child cannot validly do so. You can withdraw consent by contacting us; we will explain any effect on the relevant feature and any information we must still retain.

We do not treat merely reading this policy as consent. Rules governing access to information on your device apply separately from the UK lawful bases.

You can choose whether to buy content, take part in a referral or contact support. Without the necessary network and account information, we cannot provide the corresponding online access, reward or purchase feature. Automated checks determine referral eligibility and content access. You can contact support to ask us to investigate an incorrect result; we do not use those checks to build advertising profiles.

Who receives information

We use Supabase for authentication and backend services, RevenueCat for purchase services, Cloudflare for website/security services and email forwarding, Microsoft for support correspondence, and Sync.com for protected encrypted recovery records. Draftbit's image service receives requests for remotely hosted app images. Development and build tools do not automatically receive your game history merely because they were used to make the app.

Service providers process information for the relevant service. Apple and Google also have their own responsibilities for store accounts, payments, fraud prevention and transaction records. Their privacy notices explain those separate uses. We may disclose limited information where required by law or necessary to establish, exercise or defend legal claims. We do not give other players your private account records.

International processing

Our services use providers operating in the United Kingdom, the European Economic Area, the United States and Canada. Hosting a database in one country does not mean every support, security or supplier operation stays there. Information processed abroad may be accessible to courts, law enforcement or other authorities under that country's laws.

For transfers covered by a UK adequacy decision, we rely on that decision within its scope. For other restricted transfers, we use appropriate contractual safeguards, such as the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, together with necessary assessments and supplementary protection. A country's adequacy arrangements may cover only particular organisations or activities. You can contact us for information about the safeguards applying to your information or a copy, with unrelated confidential information removed where necessary.

How long information is kept

We keep information for its purpose, not for an arbitrary universal period:

Local information remains subject to the app's clearing controls and your device or backup settings. We cannot erase independent store records or copies controlled by other people merely by deleting your app account.

Your rights and how to delete your account

Depending on the circumstances, you can ask for access, correction, erasure, restriction or a portable copy of personal information. These rights have conditions and exceptions. Where we use consent, you may withdraw it without affecting earlier lawful use.

Your right to object

You can object, on grounds relating to your situation, where we rely on legitimate interests. We must stop that processing unless we demonstrate compelling overriding grounds or need the information for legal claims. You can object to direct marketing at any time.

Account deletion

The planned in-app deletion service is reached through Help, then Delete Guest Account. The following procedure applies when that service is enabled in your app version. The app authenticates the request using your existing session. You must acknowledge the consequences for guest-linked rewards and purchased access. You receive a private receipt; keep it safe and do not share it publicly. Completion is confirmed through receipt-status checking; an automatic email is not part of this process. We record the request in a private queue and fulfil it manually.

We aim to complete routine requests within 14 days of receipt. We respond without undue delay and normally within one calendar month, subject to any shorter applicable local deadline. Where the law permits an extension, we explain the reason and revised timeframe within the applicable deadline. You can check your receipt while the request is pending and for 30 days after verified completion.

We erase the relevant guest account, authentication/session data and associated personal records, subject to justified retention described above, and address relevant information held by our service providers. We preserve the other referral participant's earned reward. Purchase restoration cannot be used to recover an erased personal profile. A new guest account is separate from the deleted one.

If you cannot use the app, have lost your session or receipt, or want to exercise another privacy right, email [email protected] or write to us. You do not need to reinstall the app to ask. We will consider reasonable ways to identify the information and verify your authority. If we cannot identify the relevant account safely, we will explain the limitation and what additional information could help. We will not expose an account or erase another player's data based only on an unverified identifier. Requests are normally free, subject to legal exceptions.

Privacy complaints

Contact [email protected] or write to our address above. We acknowledge privacy complaints within 30 days, make appropriate enquiries, keep you informed and give an outcome without undue delay. A complaint and a privacy-rights request can have different deadlines, which we handle separately.

You can complain to the Information Commissioner’s Office, the Office of the Australian Information Commissioner, or the Office of the Privacy Commissioner in New Zealand, as applicable.

Children and parents

Throwback Footy: Classic Matches is intended for players aged 13 and over. We do not intentionally direct the game or its marketing to children under 13. This is an intended audience, not an enforced age restriction. The current app does not collect dates of birth or ask players to prove their age. Teenage players remain entitled to applicable privacy protections.

If you are concerned that a child under 13 is using the game, please contact [email protected]. We will review the concern promptly. If we learn that we are processing a child's personal information without permission required by law, we will stop that processing and delete information that we cannot lawfully retain. We may need limited information to identify the relevant account and verify a parent's or guardian's authority. Please do not send identity documents unless we specifically explain why they are necessary and how to provide them safely.

Age and parental-permission requirements vary by location. Our intended 13+ audience does not override applicable privacy protections for younger players.

We limit guest identifiers to account continuity, access and rewards, purchase verification, service operation and security. They are not used for behavioural advertising or marketing profiles. We do not offer public player profiles or in-app messaging. We limit access to account records and use service providers for the purposes explained above.

A parent or guardian can contact [email protected] to ask about a child's information, request access or correction, request deletion, or ask us to stop further collection or use where applicable. We verify the request proportionately and explain any effect on continuing access. Children do not have to provide more personal information than is necessary for the feature they use. An app-store age rating or approval of a purchase is not, by itself, parental permission for unrelated data processing.

Additional information for our launch markets

In Australia, applicable privacy rights include access, correction and complaints. In New Zealand, you can request access and correction; we normally communicate an access-request decision within 20 working days, subject to lawful extensions, and provide information granted without undue delay. Information about you can come from another referral participant, the stores and RevenueCat as described above.

We do not sell personal information or use it for cross-service behavioural advertising. Our website tracking and browser Do Not Track handling require final verification before publication.

The rights and procedures in this policy are subject to the laws that apply to your request. Contact us if you need help identifying the relevant route. We do not treat a request to exercise privacy rights as a reason to penalise you.

Security and changes to this policy

We use technical and organisational measures designed to protect personal information against unauthorised access, loss and misuse. These measures are reviewed as the app and its services develop. No service can guarantee absolute security.

We may update this privacy policy as the app or our data practices change. The latest published version will show its revision date. Where required, we will bring significant changes to your attention through an appropriate notice and explain a new use before it begins.