Privacy Policy

Who we are

GoalPost (the-goalpost.com) is an independent football discovery and intelligence site. This policy covers the website and any GoalPost mobile web app / PWA install. It does not cover third-party sites you reach by clicking a link from GoalPost — see “Third-party links” below.

Information we collect

You can use GoalPost without giving us anything

Browsing matches, competitions, clubs, players, and the Intelligence Desk doesn’t require an account, an email address, or any personal information.

Automatically, as you use the site

• An anonymous device identity. On your first visit, we silently create an anonymous Firebase Authentication account for your browser (no name, email, or password involved) so your follows and preferences can sync back to you on return visits. If you choose to “upgrade” with a Google account (a feature used in some fan-engagement tools), Google shares your name, email, and profile photo with us for that purpose only.
• Follows and preferences. Teams, competitions, and players you follow are stored in your browser’s local storage and synced to a Firestore record tied to your anonymous device identity, so they survive a page reload or a return visit. Your theme (light/dark) and language preference are stored the same way, plus a small first-party cookie that remembers your theme choice across visits (not used for tracking or advertising).
• Aggregate usage analytics. We use Firebase Analytics (Google) to understand which pages and features get used, sampled at a small percentage of sessions. Event data is scrubbed of things like search queries and coordinates before it’s sent.
• Error diagnostics. When something breaks, a sanitized error report (with obvious sensitive fields stripped) may be sent to our error-monitoring provider, Sentry, so we can fix it.
• Abuse prevention. A few write endpoints (newsletter signup, push-notification subscription) are rate-limited using a one-way hash of your IP address and browser user-agent, stored briefly and deleted automatically once the rate-limit window passes. We do not store your raw IP address.

Only if you opt in

• Push notifications. If you enable goal alerts or follow-based notifications, your browser generates a push token (via Firebase Cloud Messaging) that we store along with the list of topics you subscribed to (e.g. a specific team or competition). This token isn’t linked to your name or email.
• Newsletter. If you sign up for the GoalPost Dispatch, we collect the email address (and first name, if you give one) you provide and pass it to our email delivery provider, Resend, to send it. Every email includes an unsubscribe link.
• Google sign-in. Described above — only if you explicitly choose to upgrade an anonymous session.

Cookies and similar technology

We don’t use third-party advertising or cross-site tracking cookies. What we do use:

• a first-party cookie that remembers your light/dark theme choice;
• browser local storage for your follows, identity, and language preferences;
• Firebase Analytics (Google), which relies on its own client identifiers to measure aggregate, non-personally-identifying usage; and
• if you click an outbound affiliate link (see below), the destination network may set its own cookie to track that referral once you land on their site — governed by their privacy policy, not this one.

Affiliate link tracking

GoalPost participates in affiliate programs and earns a commission on qualifying purchases made through certain outbound links (for example, Hotels.com via Commission Junction, and Fanatics via Impact.com). These links carry a tracking parameter so the network can attribute the referral back to GoalPost; we don’t receive your payment information or purchase details from these networks. Full details: Affiliate Disclosure.

Infrastructure and third parties

GoalPost runs on Google Cloud / Firebase. In the course of operating the site, data may pass through:

We don’t sell your personal data. We share it only with the service providers above, only as needed to run the features described on this page.

Data retention

Follows, preferences, and your anonymous device identity persist until you clear your browser’s storage or stop using GoalPost. Push-notification tokens that go stale (e.g. the app is uninstalled or notifications are revoked) are cleaned up automatically. Rate-limit hashes expire on their own within the rate-limit window.

Your choices

• Clear your browser’s cookies and local storage at any time to reset your theme, follows, and identity.
• Revoke notification permission in your browser or device settings at any time.
• Unsubscribe from the newsletter using the link in any newsletter email.
• Signing out reverts you to a fresh anonymous session rather than leaving you signed out entirely.

Children’s privacy

GoalPost is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We’ll update the date at the top of this page whenever this policy changes, and note anything material here.

Contact

Questions about this policy or your data can be sent to privacy@the-goalpost.com.