Privacy Policy

MatchCard is operated by Carlos Magalhães, an individual based in Portugal, who acts as the data controller for the personal data described in this policy. You can reach us at carlosmagalhaes.dev@gmail.com.

• Account information: your email address, and, if you sign in with Google, the name, email, and profile photo Google shares with us.
• Player profile data: player name, stat ratings (pace, technique, defending, finishing) submitted by you or your leaguemates, archetype, an optional profile photo, and shirt-color preferences.
• League and game data: the leagues and teams you belong to, match results and goals, ratings you submit about other players, game availability (RSVPs), and referee/admin actions taken in the app.
• Usage data:aggregated, anonymized page-view and performance metrics collected automatically via Vercel Analytics and Speed Insights (see below). This doesn't use cookies and can't identify you individually.

We don't collect payment information — MatchCard is currently free to use.

• To run the core Service: authenticate you, operate your leagues/games/teams, and compute ratings and standings.
• To communicate with you: transactional emails such as sign-in links, password resets, and league invitations.
• To improve the Service, using only aggregated, anonymized usage and performance metrics.

For users in the EU/UK, our legal basis is performance of a contract (running your account and league) and legitimate interest (aggregated analytics and keeping the Service secure).

• Supabase— authentication, database, and file storage for player photos. See Supabase's privacy policy.
• Vercel— application hosting, plus Vercel Analytics and Speed Insights, which are cookie-free and only report aggregated, anonymized metrics. See Vercel's privacy policy.
• Google— used if you choose "Continue with Google" to sign in (Google shares the basic profile info you authorize), and for Google AdSense, which may show ads on some pages if you accept the cookie banner. See Google's privacy policy.

We use one essential cookie, set by Supabase Auth, to keep you signed in. It's required for the Service to function and isn't used for tracking, advertising, or cross-site profiling, so it isn't part of the consent choice below.

The first time you visit, a small banner asks whether you accept or decline non-essential cookies. We use Google AdSense to display third-party advertisements on some pages, to help keep the Service free. AdSense's base script may load on every page so Google can verify this site — that alone doesn't request or display an ad. An actual ad is only ever requested, and any advertising cookie only ever set, if you choose "Accept"; choosing "Essential only" means no ad is ever requested or shown to you. See Google's how Google uses advertising cookies page for details on what AdSense itself collects once an ad is shown.

We keep your account and league data for as long as your account or league stays active. If you ask us to delete your account, we'll delete or anonymize your personal data (email, photo, name-linked profile) within a reasonable time, except where we're required to keep it for legal reasons. Aggregated league statistics that no longer identify you (e.g. historical scorelines) may be retained.

If data-protection law gives you rights over your personal data (for example, GDPR in the EU/UK, or Brazil's LGPD), you can ask us to access, correct, export, or delete it, and to object to or restrict some processing. To exercise any of these rights, email carlosmagalhaes.dev@gmail.com. You also have the right to lodge a complaint with your local data protection authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).

MatchCard isn't directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has created an account, contact us and we'll remove it.

We may update this policy as the Service changes — for example, when advertising is actually enabled. We'll update the "last updated" date above and, for material changes, make a reasonable effort to notify signed-in users.

Questions about this policy or your data: carlosmagalhaes.dev@gmail.com.