Privacy Policy

Who we are

GoalStack is a goalscorer sweepstake app. If you have any questions about this policy or your data, contact us at hello@playgoalstack.com.

What data we collect

• —Name — first and last name, used to personalise your experience
• —Email address — used to create your account and, if you opt in, to send you updates about the draft and your league
• —Team name — the name you choose for your manager profile
• —League activity — which leagues you've joined, your draft picks, and your scores

We do not collect payment information. We do not collect any sensitive personal data.

Why we collect it

• —To create and manage your account
• —To run your leagues and leaderboard
• —To send you emails about your league and the draft — only if you opted in
• —To monitor errors and keep the service running reliably

Our legal basis (UK GDPR)

• —Contract performance — we need your name and email to provide the service you signed up for
• —Legitimate interest — running leagues and leaderboards on your behalf
• —Consent — marketing emails, which you can opt out of at any time

Who we share your data with

We use a small number of third-party services to run GoalStack:

• —Supabase — database and authentication. Your account and league data is stored here.
• —Resend — email delivery. Your email address is used to send transactional and opt-in emails.
• —Render — backend hosting.
• —Vercel — frontend hosting.
• —Sentry — error monitoring. May capture limited technical data when errors occur.

We do not sell your data. We do not share it with anyone else.

How long we keep your data

We keep your data for as long as your account is active. If you ask us to delete your account, we will remove your personal data within 30 days. Some anonymised data (e.g. aggregate player scores) may be retained for longer.

Your rights

Under UK GDPR you have the right to:

• —Access the personal data we hold about you
• —Correct inaccurate data
• —Request deletion of your data
• —Object to or restrict how we process your data
• —Withdraw consent for marketing emails at any time — use the unsubscribe link in any email or contact us directly

To exercise any of these rights, email hello@playgoalstack.com. We'll respond within 30 days.

Cookies

GoalStack uses a small number of cookies to keep the service working:

• —Authentication cookie — keeps you logged in during your session. This is essential to the service and cannot be disabled.

We may add analytics cookies (such as Google Analytics) in the future to help us understand how people use the site. If we do, we'll update this policy and ask for your consent where required.

Prize pools and money

GoalStack does not handle, hold, or process any money. Entry fees and prize pools are set by league organisers and settled directly between participants. GoalStack accepts no responsibility for any financial disputes between users.

Age requirement

GoalStack is intended for users aged 18 and over. By creating an account you confirm that you are at least 18 years old. We do not knowingly collect data from anyone under 18. If you believe a child has registered, please contact us at hello@playgoalstack.com and we will remove their account.

International data transfers

Some of our third-party service providers are based outside the UK, including in the United States. Where your data is transferred internationally, we rely on those providers having appropriate safeguards in place (such as Standard Contractual Clauses or equivalent frameworks) to protect your data in line with UK GDPR requirements.

Security

We take reasonable steps to protect your data. All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text. Access to backend systems is authenticated and rate-limited. We use Sentry to monitor and respond to errors. No system is completely secure, but we take this seriously.

Third-party links

GoalStack may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend reading their privacy policies before providing any personal data.

Complaints

If you're unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) — the UK's data protection regulator.

Changes to this policy

If we make significant changes to this policy we'll update the date at the top. For major changes affecting your rights, we'll notify you by email.