Privacy Policy

Who we are

GoalPost (the-goalpost.com; “we”, “us”) is an independent football discovery and intelligence site. GoalPost is responsible for the personal information described here (its “controller” under data-protection law). This policy covers the website and any GoalPost mobile web app / PWA install. It does not cover third-party sites you reach by clicking a link from GoalPost — see “Third-party links” below.

Information we collect

You can use GoalPost without giving us anything

Browsing matches, competitions, clubs, players, and the Intelligence Desk doesn’t require an account, an email address, or any personal information.

Automatically, as you use the site

• An anonymous device identity. On your first visit, we silently create an anonymous Firebase Authentication account for your browser (no name, email, or password involved) so your follows and preferences can sync back to you on return visits. If you choose to “upgrade” with a Google account (a feature used in some fan-engagement tools), Google shares your name, email, and profile photo with us for that purpose only.
• Follows and preferences. Teams, competitions, and players you follow are stored in your browser’s local storage and synced to a Firestore record tied to your anonymous device identity, so they survive a page reload or a return visit. Your theme (light/dark) and language preference are stored the same way, plus a small first-party cookie that remembers your theme choice across visits (not used for tracking or advertising).
• Aggregate usage analytics. We use Firebase Analytics (Google) to understand which pages and features get used, sampled at a small percentage of sessions. Event data is scrubbed of things like search queries and coordinates before it’s sent.
• Error diagnostics. When something breaks, a sanitized error report (with obvious sensitive fields stripped) may be sent to our error-monitoring provider, Sentry, so we can fix it.
• Abuse prevention. A few write endpoints (newsletter signup, push-notification subscription) are rate-limited using a one-way hash of your IP address and browser user-agent, stored briefly and deleted automatically once the rate-limit window passes. We do not store your raw IP address.

Only if you opt in

• Push notifications. If you enable goal alerts or follow-based notifications, your browser generates a push token (via Firebase Cloud Messaging) that we store along with the list of topics you subscribed to (e.g. a specific team or competition). This token isn’t linked to your name or email.
• Newsletter. If you sign up for the GoalPost Dispatch, we collect the email address (and first name, if you give one) you provide and pass it to our email delivery provider, Resend, to send it. Every email includes an unsubscribe link.
• Google sign-in. Described above — only if you explicitly choose to upgrade an anonymous session.

Cookies and similar technology

We don’t use third-party advertising or cross-site tracking cookies. What we do use:

• a first-party cookie that remembers your light/dark theme choice;
• browser local storage for your follows, identity, and language preferences;
• Firebase Analytics (Google), which relies on its own client identifiers to measure aggregate, non-personally-identifying usage; and
• if you click an outbound affiliate link (see below), the destination network may set its own cookie to track that referral once you land on their site — governed by their privacy policy, not this one.

Affiliate link tracking

GoalPost participates in affiliate programs and earns a commission on qualifying purchases made through certain outbound links (Hotels.com and Expedia via Commission Junction, and Fanatics via Impact.com). These links carry a tracking parameter so the network can attribute the referral back to GoalPost, and a label for the GoalPost page the link was on (for example “city-london”), never anything about you. We don’t receive your payment information or purchase details from these networks. Full details: Affiliate Disclosure.

Infrastructure and third parties

GoalPost runs on Google Cloud / Firebase. In the course of operating the site, data may pass through:

We don’t sell your personal data. We share it only with the service providers above, only as needed to run the features described on this page.

Why we use your information (the legal bases)

Where data-protection law such as the EU or UK GDPR applies, we rely on:

• Your consent for the newsletter, push notifications and Google sign-in. You can withdraw it at any time, as described under “Your choices”.
• Our legitimate interests in running, securing and improving GoalPost: the anonymous device identity, aggregate analytics, error diagnostics and abuse prevention.
• Performing a service you asked for, such as syncing the teams you follow.

Data retention

Follows, preferences, and your anonymous device identity persist until you clear your browser’s storage or stop using GoalPost. Push-notification tokens that go stale (e.g. the app is uninstalled or notifications are revoked) are cleaned up automatically. Rate-limit hashes expire on their own within the rate-limit window.

Your choices

• Clear your browser’s cookies and local storage at any time to reset your theme, follows, and identity.
• Revoke notification permission in your browser or device settings at any time.
• Unsubscribe from the newsletter using the link in any newsletter email.
• Signing out reverts you to a fresh anonymous session rather than leaving you signed out entirely.

Your rights, and how to make a data request

You can ask us to tell you what personal information we hold about you, to give you a copy of it, to correct it, or to delete it. To make a request, email privacy@the-goalpost.com with the subject “Data request”, say what you are asking for, and include the email address you signed up or signed in with, if any. Most of what GoalPost keeps is tied to an anonymous device identity rather than to your name, so we may ask for details that let us find your records, and for enough to confirm the request is yours. We answer within one month, or within 45 days where a US state law sets that time, and tell you if we need longer where the law allows it. Requests are free.

If you live in the United States

Depending on your state, consumer privacy laws (in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states) give you the right to know what personal information we collect, use and disclose; to access it and get a portable copy; to correct it; to delete it; and to opt out of its sale, of its sharing for cross-context behavioral advertising, and of profiling that produces legal or similarly significant effects. We honor these requests for every US resident, whether or not a particular law applies to us.

• We don’t sell your personal information, and we don’t share it for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of both.
• We don’t use sensitive personal information to infer anything about you, and we don’t profile you.
• You can use an authorized agent to make a request for you; we may ask the agent for proof of authority and ask you to confirm your identity.
• We won’t treat you differently, or charge you more, for exercising any of these rights.
• If we decline a request, you can appeal by replying to our answer with the subject “Appeal”. We’ll answer the appeal in writing within the time your state’s law sets, and if we deny it you can contact your state attorney general.

If you live in the European Economic Area or the UK

Under the GDPR and the UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it (including where we rely on our legitimate interests), to receive it in a portable format, and to withdraw any consent you have given at any time, without affecting what we did before you withdrew it. You can also lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office), though we’d welcome the chance to put things right first.

GoalPost runs on Google Cloud in the United States, so your data may be processed outside your country. Where it is, we rely on the safeguards our providers offer for those transfers, such as the European Commission’s Standard Contractual Clauses.

Children’s privacy

GoalPost is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We’ll update the date at the top of this page whenever this policy changes, and note anything material here.

Contact

Questions about this policy or your data, and data requests, can be sent to GoalPost at privacy@the-goalpost.com.