Privacy Policy
Last Updated: October 19, 2026
Contents17 sections
- 1. Overview
- 2. Information We Do NOT Collect — Website and Reddit Widget
- 3. Data We Access — Website (matchpal.io)
- 4. Data We Access — Reddit Widget
- 5. Mobile Apps (iOS and Android)
- 6. How We Use Data
- 7. Third-Party Services
- 8. Cookies and Tracking
- 9. Data Security
- 10. Children’s Privacy
- 11. International Data Transfers
- 12. Your Rights
- 13. Data Retention
- 14. Changes to Privacy Policy
- 15. Contact Information
- 16. Compliance
- Summary
1. Overview
This Privacy Policy explains how MatchPal ("we", "us", "our") collects, uses, and protects information when you use:
- MatchPal Website (matchpal.io)
- MatchPal mobile apps (iOS and Android)
- MatchPal Live Reddit Widget (Devvit app)
We are committed to protecting your privacy. We aim to comply with GDPR, UK data protection laws, and Reddit's Developer Platform policies.
The website holds very little data about you. The Reddit widget stores limited data against your Reddit user ID (see section 4). The mobile apps use accounts and hold more. Section 5 covers the apps.
2. Information We Do NOT Collect — Website and Reddit Widget
On the website and the Reddit widget, MatchPal does NOT collect, store, or process:
- Email addresses or phone numbers
- Real names
- GPS or other precise location data
- Login credentials or authentication tokens
- Browsing history or device fingerprints
- Social media profiles or connections
The website and the Reddit widget do not create user accounts. See section 4 for the data the Reddit widget stores against your Reddit user ID, including the fantasy game.
Country and time zone on the website: On each visit the website works out your country and time zone from your IP address. It uses them to choose TV channels and kick-off times. The website does not store them against you. Our hosting providers keep standard server logs, which include IP addresses (see section 7).
The mobile apps are different. They create an account for you and store data against it. See section 5.
3. Data We Access — Website (matchpal.io)
The MatchPal website accesses the following public football data:
- Match fixtures: Dates, times, teams, leagues, venues
- Live scores: Goals, match events (cards, substitutions)
- Team information: Names, logos, colours
- TV broadcast schedules: Channels by country
- Player lineups: Starting XI, substitutes, formations
- Betting odds: Decimal odds from public sources (informational only)
- Match statistics: Possession, shots, corners, fouls
- AI-generated blog content: Match previews and analysis generated using the Anthropic Claude API
This data is publicly available sports information and is not linked to any user identity.
4. Data We Access — Reddit Widget
The MatchPal Live Reddit widget operates on Reddit's Devvit platform. It reads the same public football data as the website. In addition, to support interactive features, the widget stores the following limited data. Everything except fantasy squads is kept in Reddit's key-value store (Redis):
- Community predictions (votes): We record which outcome a Reddit user voted for (Home / Draw / Away) per fixture, keyed by Reddit post ID and Reddit user ID. This prevents duplicate votes. Vote counts are aggregated and anonymous — we do not display or export individual vote choices.
- Match ratings: We store a Reddit user's star rating (1–5) per fixture. This prevents duplicate ratings. Ratings are averaged for display and not linked to a public identity.
- Match reminders: If a user enables "Remind Me", their Reddit user ID is stored temporarily so a DM can be sent 5 minutes before kickoff. This data is deleted immediately after the reminder is sent.
- Fantasy squads: If you save a fantasy squad in the Reddit widget, the squad is stored in our own database (Supabase) with your Reddit user ID and a display name. It is not kept in Reddit's store and does not expire. Each squad is copied forward into the next gameweek. Fantasy entries may be shown on a leaderboard with the display name.
- View counts: The widget counts how many times each post is viewed and how many different users viewed it. To count different users, Reddit user IDs are kept per post in Reddit's store. Only the totals are sent to our database. The user IDs are not.
Votes and ratings expire after 30 days. Reminders are deleted on send. Fantasy squads are kept until our team removes them. We do not link Reddit user IDs to real-world identities.
The widget does NOT access Reddit comments or voting history.
5. Mobile Apps (iOS and Android)
The MatchPal apps for iPhone and Android show the same public football data as the website. Unlike the website, the apps use accounts and store personal data. This section lists what the apps collect and why.
Your account
- Guest account: When you first open the app we create a guest account for you automatically. It has a random account ID and no email address. What you do in the app is stored against that ID.
- Email and password: If you save your account or sign in, we collect your email address and, if you set one, a password. The password is stored in scrambled form.
- How we use your email: To sign you in, to recover your account on another device and to reply to feedback. We do not send marketing email.
Your profile
- Display name: Every account has a display name. We create one for you and you can change it.
- Profile photo: You can add a profile photo. This is optional.
- What other users can see: Your display name, photo, primary team, Pal Score, streak and activity counts are visible to other users.
Notifications
- Push token: To send notifications we store a push token (an address Apple or Google gives your device) against your account.
- On iPhone: We collect the token after you allow notifications. A Live Activity token is registered automatically if Live Activities are on in iOS Settings.
- On Android: The token is registered when the app starts. Google's Firebase software also creates its own installation ID and sends it to Google.
Country, language and time zone
- Country: We work out your country from your IP address or your device's region setting and store the two-letter code against your account. We use it for TV listings, country leaderboards and user counts.
- No GPS: We never use GPS. The apps do not ask for location permission.
- Language and time zone: When you send feedback we also record your language and time zone.
Match chat
- Chat messages are stored with your account ID and display name.
- Chat is public and can be read without signing in.
- If you reply to someone, the start of your reply and your display name are sent to them as a notification.
Picks, fantasy and line-ups
- We store your match picks, fantasy squads and saved line-ups against your account.
- Picks become public after kick-off.
- Fantasy squads appear on a public leaderboard with your display name.
- Saved line-ups are private.
Activity, follows and settings
- Activity: We record when you last opened the app, your daily check-in, your streak and each Pal Score award. We use this to run those features and to count active users.
- Follows and notification settings: We store the teams, leagues and players you follow, your notification settings and the matches you asked to be alerted about. We use them to personalise your feeds and to choose which notifications to send.
- Invite codes: If you use an invite code we record which account invited which. On Android the code is read from the Google Play install link. Nothing else from that link is sent to us.
- App and device details: We store your app version, build type and platform against your account to count users by version.
Feedback you send us
- What we store: When you use the Send feedback form we store your message, its category, your reply email if given, your account ID, app version, operating system version, device model, country, language, time zone, the screen you came from and whether you are a guest.
- Copy for our team: A copy of your message, reply email, device details, country and the first eight characters of your account ID is posted to our team's private Discord channel. It stays there until our team removes it. Deleting your account does not remove this copy.
IP addresses and server logs
- Our hosting providers record your IP address, device type and the data requested in server logs.
- We use IP addresses to limit abuse and to work out your country.
- Supabase may also record the IP address and device type used for each sign-in.
Live viewer count (iPhone)
- While a match page is open, your account ID and the side you support are sent live to other viewers of that match to show a viewer count. This is not saved.
What the apps do not contain
- The apps contain no adverts and no advertising or analytics software from other companies.
- Nothing is for sale in the apps, so they collect no payment details.
- The apps do not read your contacts.
Deleting your account
- You can delete your account in the app. See matchpal.io/delete-account.
- If you saved your account with an email address, you can also ask by emailing [email protected] from that address.
- A guest account has no email address, so we cannot find it from an email. Delete a guest account in the app.
- Sections 12 and 13 explain what is removed and what is kept.
6. How We Use Data
Public football data is used solely to:
- Display match schedules and TV broadcast information
- Show live scores and match events in real-time
- Present team lineups and formations
- Provide betting odds for informational purposes
- Generate match preview blog posts using AI
- Power community prediction, rating and fantasy features in the Reddit widget
- Choose TV channels and kick-off times for your country and time zone on the website
- Count views of Reddit widget posts
Data from the mobile apps is used to:
- Create your account, sign you in and recover it on another device
- Show your display name, photo, chat messages, picks and fantasy squads where section 5 says they are public
- Send notifications, such as match alerts, replies to your chat messages, streak reminders and weekly Pal Score recaps
- Personalise your feeds from the teams, leagues and players you follow
- Show TV listings for your country and run country leaderboards
- Run daily check-ins, streaks, Pal Score and invites
- Count users and how much features are used, for example active users, users by country and app version, and the number of chat messages and picks
- Read and reply to feedback
- Limit abuse
On the website and the Reddit widget, data is never: sold to third parties, used to build personal profiles, or shared beyond what is necessary to operate the service.
7. Third-Party Services
MatchPal uses the following third-party services:
Supabase (Database and Sign-in)
- Purpose: PostgreSQL database hosting, and sign-in for the mobile apps
- Data stored: Football data, Reddit widget fantasy squads and view totals (see section 4) and, for app users, the account and activity data described in section 5
- Privacy Policy: supabase.com/privacy
Vercel (Website Hosting and Analytics)
- Purpose: Next.js website hosting and CDN. Vercel works out your country and time zone from your IP address
- Vercel Analytics counts page views on the website
- May collect: Basic server logs (IP, user agent) for security
- Privacy Policy: vercel.com/legal/privacy-policy
Google Ads and Google Analytics (Website Measurement)
- Purpose: The website loads the Google tag (gtag.js) so we can measure whether our Google Ads campaigns bring visitors to MatchPal. The same tag sends page-view statistics to Google Analytics
- In the UK, the EEA and Switzerland the tag runs in Google's consent mode with advertising and analytics storage turned off: it sets no cookies and sends Google limited signals without cookies, such as the page address, your IP address and browser details
- Elsewhere it may set Google advertising and analytics cookies
- Privacy Policy: policies.google.com/privacy
Railway (Backend API)
- Purpose: Flask API hosting for data ingestion and processing, and scheduled jobs
- Processes: API requests for match data fetching. Railway also handles profile photo uploads and account deletion requests
- Privacy Policy: railway.app/legal/privacy
Cloudflare (Network and Notification Queue)
- Purpose: Cloudflare carries our app traffic, works out your country from your IP address and queues notifications
- Privacy Policy: cloudflare.com/privacypolicy
Apple (Notifications on iPhone)
- Purpose: Apple Push Notification service delivers notifications on iPhone
- Data sent: Your push token and the content of each notification
- Privacy Policy: apple.com/legal/privacy
Google Firebase (Notifications on Android)
- Purpose: Google Firebase Cloud Messaging delivers notifications on Android
- Data sent: Your push token and the content of each notification. Firebase also creates its own installation ID and sends it to Google
- Privacy Policy: firebase.google.com/support/privacy
Resend (Sign-in Emails)
- Purpose: Resend sends our sign-in emails and receives your email address to do so
- Privacy Policy: resend.com/legal/privacy-policy
Discord (Feedback Copies)
- Purpose: Discord hosts the private channel where our team reads feedback
- Data sent: The feedback copy described in section 5
- Privacy Policy: discord.com/privacy
SportMonks API
- Purpose: Source of football match data
- Data accessed: Public football statistics and schedules
- Privacy Policy: sportmonks.com/privacy
Image Hosts (SportMonks and News Publishers)
- Team crests, player photos and article images load directly from SportMonks and news publishers, who see your IP address
Anthropic (AI Content)
- Purpose: Generating AI-written match preview blog posts
- Data sent: Public match data (teams, stats, fixtures) — no user data
- Privacy Policy: anthropic.com/privacy
Reddit Devvit Platform
- Purpose: Reddit widget hosting, delivery, and key-value storage. Fantasy squads are stored in Supabase instead
- Governed by: Reddit's Privacy Policy and Developer Platform policies
- Privacy Policy: reddit.com/policies/privacy-policy
8. Cookies and Tracking
The MatchPal website does not show adverts at present.
The website uses Vercel Analytics to count page views. It also loads the Google tag, which measures whether our own Google Ads campaigns bring visitors to MatchPal and sends page-view statistics to Google Analytics. In the UK, the EEA and Switzerland the Google tag runs with advertising and analytics storage turned off, so it sets no cookies there. Outside those places it may set Google advertising and analytics cookies (see section 7).
MatchPal itself does NOT use:
- Social media tracking buttons
Vercel (our hosting provider) may set essential technical cookies for security and performance. These are not used for user tracking or profiling.
The mobile apps contain no adverts and no advertising or analytics software from other companies.
9. Data Security
We implement security measures to protect data:
- HTTPS encryption: All connections use secure SSL/TLS
- Read-only website: The website only reads match data
- API rate limiting: Prevents abuse and overload
- Secure storage: Database credentials stored as environment variables
- Accounts: The website and the Reddit widget have no user accounts. In the mobile apps, sign-in is handled by Supabase and passwords are stored in scrambled form
- Short data retention: Reddit widget votes and ratings expire automatically
10. Children's Privacy
MatchPal does not knowingly collect information from children under 13 years old. The website and the Reddit widget display public sports information. They do not collect personal data beyond the Reddit widget data described in section 4 (which requires a Reddit account to use).
The mobile apps are not aimed at children under 13 and do not ask for age or date of birth.
11. International Data Transfers
Football match data is stored in Supabase's cloud infrastructure, which may involve data transfers across international borders. This data is publicly available sports information and is processed in accordance with Supabase's data governance policies and GDPR requirements.
Account and activity data from the mobile apps is stored and handled by the providers listed in section 7. Their systems may be in countries other than the one you live in.
Reddit widget votes, ratings, reminders and viewer records are stored within Reddit's infrastructure and governed by Reddit's own data policies. Reddit widget fantasy squads are stored in Supabase.
12. Your Rights
Under GDPR and UK data protection law, you have rights regarding personal data we hold.
Mobile apps
- Change your details: You can change your display name and your notification settings in the app
- Delete your account: In the app. If you saved your account with an email address, you can also email [email protected] from that address. A guest account has no email address, so we cannot find it from an email. See matchpal.io/delete-account
- Ask for a copy, a correction or a removal: Email [email protected]. This includes the records that account deletion does not remove (see section 13)
Website and Reddit widget
- Website: The website does not create accounts or personal profiles, so there is no profile to delete or export
- Reddit widget votes, ratings and reminders: These are kept in Reddit's store against your Reddit user ID and removed as section 13 describes
- Reddit widget fantasy squads: We hold these against your Reddit user ID and a display name. To ask for a copy or a removal, email [email protected] with your Reddit username
For any privacy questions or concerns, please contact us through our contact page.
13. Data Retention
- Match data: Historical fixture data retained indefinitely for reference
- Live cache: Redis cache expires after 20 seconds (live) to 7 days (finished matches)
- Community votes and ratings: Expire after 30 days via Redis TTL
- Reminders: Deleted immediately after the reminder DM is sent
- Reddit widget fantasy squads: Kept until our team removes them. Each squad is copied forward into the next gameweek
- Blog posts: Retained on the website indefinitely
- App account data: Kept until you delete your account. You can delete it in the app. If you saved your account with an email address, you can also email [email protected] from that address. See matchpal.io/delete-account
- Guest accounts: A guest account that is no longer used is kept until it is deleted or until our team removes it
- Feedback: The stored message is deleted with your account. The copy in our team's private Discord channel is kept until our team removes it
- Fantasy entries: Deleting your account does not remove your fantasy squads. They keep your display name and account ID and stay on the public leaderboard. Each squad is also copied forward into the next gameweek, so new entries with your display name keep being created. To have them removed, email [email protected]
- Invite rewards: If someone invited you and was rewarded for it, the record of their reward keeps your account ID after you delete your account
- Reminder and weekly score records: Records of reminder notifications sent to you and weekly Pal Score snapshots are stored against your account ID. They may remain after you delete your account
- Server logs: Kept by our hosting providers for the periods they set. They may hold your IP address and account ID
14. Changes to Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. The "Last Updated" date at the top indicates when changes were made.
Material changes will be communicated through prominent notices on our website. Continued use of MatchPal after changes constitutes acceptance of the updated policy.
15. Contact Information
For privacy questions, concerns, or requests, please contact us:
- Contact Form: matchpal.io/contact
- Email: [email protected]
16. Compliance
This privacy policy aims to comply with:
- GDPR (General Data Protection Regulation)
- UK Data Protection Act 2018
- Reddit Developer Platform policies
- Supabase data governance requirements
Summary
The MatchPal website and Reddit widget display public football information without creating user accounts. The website works out your country and time zone from your IP address to choose TV channels and kick-off times. The Reddit widget stores votes, ratings and reminders against your Reddit user ID with short expiry times. It stores fantasy squads in our database with your Reddit user ID and a display name, and these do not expire. The website does not show adverts at present. It uses Vercel Analytics to count page views, and the Google tag to measure our Google Ads campaigns (without cookies in the UK, the EEA and Switzerland).
The MatchPal mobile apps create an account for you and store the data listed in section 5 against it. The apps contain no adverts and no advertising or analytics software from other companies. We keep account data until you delete your account, which you can do in the app. If you saved your account with an email address, you can also email [email protected] from that address.