Privacy Policy

Version 2. Effective date: 29 October 2026

1. Who We Are

Goal Legends is an online football manager game, available as a website (goallegends.com) and as an app for Android and iOS. Both use the same account. This policy explains what personal data we collect, why, how long we keep it, and what rights you have. It applies to the website and the app.

The controller responsible for your data is Bjorn Onderstal, an independent developer in the Netherlands who makes and runs Goal Legends under the name Stable Studios (a name, not a company).
Email: admin@goallegends.com

2. Information We Collect

Account data: your email address, manager name, password (stored only as a secure hash, never in plain text), date of birth (to check you are at least 16), your optional bio, your club and stadium names, when you registered, when you last logged in and from which IP address, when you were last active, and the date and version of the Terms of Service and Privacy Policy you accepted.

Sign-in data: if you sign in with Google, we receive your name, email address, and Google account ID from Google. If you use a passkey, we store its public key (your fingerprint or face scan never leaves your device). If you turn on two-step verification with an authenticator app, we store the secret key and your recovery codes.

Gameplay data: your club, players, lineups, tactics, transfers, finances, match results, and other activity in the game.

Content you create and messages: forum posts, images you upload to posts (we remove hidden metadata such as a photo's location), polls and poll votes, reactions, inbox messages to and from other managers and from the game, votes on new features, applications and votes in national team elections, feature requests and bug reports, and the managers you block. When you report content we store your report (reason, your explanation, and a copy of the reported content) with your user ID and the reported manager's; the reported manager is never told who reported them. Feature requests and bug reports are stored with your user ID, manager name, and email address, and are also emailed to our team.

Referrals: if you joined through another manager's referral link, we store who referred you and whether the referral reward was paid out.

Android app testers: if you sign up to test the Android app (on our Android tester page, with or without an account), we store the Google account email address you give us, your language, when you signed up, and, if you are logged in, your user ID and manager name. We use it only to add you to the test on Google Play and to email you the install link.

App and push notifications: if you allow notifications in the app, we store your device's push token (from Firebase Cloud Messaging), the platform (Android or iOS), the app's language, your device's time offset from UTC (so times in notifications are right), and when the device was last seen. When you log out, the device is removed.

Time zone and language: we read your time zone from your browser or phone to show kick-off times in your local time. On the website we do not store it. Your language choice is kept in a cookie on the website and in the app on your phone.

Technical data: your IP address is used to limit the number of login and sign-up attempts (kept only briefly in memory) and is stored with your account when you log in, to protect accounts and detect abuse such as multiple accounts. Our servers keep standard logs (such as requests and errors). The match viewer sends us performance and error reports: your user ID and manager name, graphics card model, screen refresh rate, frame-rate timings, browser user agent, and any error message.

3. Cookies and Local Storage

Always on, because the website needs them: an authentication cookie that keeps you logged in; an antiforgery cookie that protects forms against misuse; short-lived cookies used during Google sign-in and two-step verification; a short status-message cookie that shows a confirmation after an action; gl-lang (your language); gl-theme (light or dark mode); and gl-consent-v1 in your browser's local storage, which remembers your cookie choice.

Only if you click Accept on our cookie banner: analytics cookies from Google Analytics and measurement cookies from the Meta Pixel (see Section 6).

Neither of these loads at all until you click Accept, and declining changes nothing about the game itself. You can change your choice at any time: Cookie settings.

4. Why We Use Your Data, and Our Legal Basis

To run your account and the game (sign-up, login, your club, matches, the forum and inbox, national team elections, referrals, GL Coins, account emails, and notifications you asked for): necessary to perform our agreement with you (the Terms of Service).

To check your age: necessary to perform our agreement, and our legitimate interest in keeping Goal Legends for people aged 16 and over.

To keep the game secure and fair (rate limiting, storing login IP addresses, detecting multiple accounts and other abuse, moderation), to fix bugs and improve performance (server logs, match viewer reports, bug reports, and feature requests), and to send inactivity reminders: our legitimate interest in a safe, fair, and working game. You can object to this (see Section 9).

Analytics and measurement cookies, and push notifications: your consent, which you can withdraw at any time via Cookie settings or your device settings.

Android tester sign-ups: your consent (without an account) or our agreement with you (with an account). You can withdraw at any time on the tester page or by emailing us.

To meet legal obligations, for example tax rules or a valid request from an authority: legal obligation.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell your personal data.

5. Emails and Notifications

We send emails you need for your account and its security, such as confirming your email address, password resets, and confirming an account deletion. We also send reminders when you have been inactive (after 30 days, a warning after 83 days, and a message when your club is handed to another manager after 90 days). You can opt out of these and other non-essential emails with the unsubscribe link in them; account and security emails will still be sent. Push notifications in the app are only sent if you allow them, and you can turn them off in your device settings.

6. Who We Share Data With

We use a small number of service providers. They process data on our behalf and only for the purposes below:

Hosting (STRATO, Germany): runs our server and database, where all the data in this policy is stored, inside the EU.

Zoho (ZeptoMail, with Zoho Mail as a backup): sends our emails, such as confirmation links and notifications.

Cloudflare: provides security and performance services in front of our servers, and processes connection data such as your IP address as part of that.

Google: Google sign-in (if you choose it), Firebase Cloud Messaging (to deliver push notifications in the app), and Google Analytics. Google Analytics only runs if you accept cookies: it counts visits and shows us how the site is used (pages viewed, how visitors found us, roughly where they are, device type), and we also record a "sign up" event when someone creates an account. It sets cookies and sends your IP address and device information to Google.

Meta (Meta Pixel): only if you accept cookies. Measures whether our posts and ads on Facebook and Instagram lead to visits and sign-ups. It sets cookies and sends your IP address, device information, and the pages you visit to Meta.

Advertising: Goal Legends currently shows no advertising. If we introduce ads, we will update this policy first and ask for your consent through a certified consent tool before any advertising cookies are set.

Other managers: your manager name, club, bio, registration date, badges, forum posts, and game results are visible to other players. Inbox messages are visible to the people you send them to.

We only share data with others if the law requires it, for example after a valid request from the police or a court.

7. International Transfers

Some of our service providers (such as Google, Meta, and Cloudflare) are based in the United States or may process data there. When data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses.

8. How Long We Keep Data

Account, sign-in, and gameplay data: as long as your account exists, and up to 30 days after you ask us to delete it.

Login IP address: the latest one is stored with your account and replaced at each login. IP addresses used to limit login attempts are only kept in memory for a few minutes.

Match viewer reports: 30 days.

Push devices: until you log out in the app, uninstall it, or delete your account.

Android tester sign-ups: 6 months, or until you stop testing, ask us to remove it, or delete your account.

Emails, content reports, feature requests, and bug reports: as long as needed to handle them, and no longer than 2 years. Blocks last until you undo them or delete your account.

Server logs: 30 days. Backups: at most 30 days. Deleted data disappears from backups when they are overwritten.

After account deletion: forum posts and messages you sent to others stay visible under the name "Deleted manager", and match and league history stays in anonymised form, so other players' conversations, standings, and results stay accurate.

9. Your Rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it deleted, to restrict its use, to object to its use (including where we rely on our legitimate interest), to receive it in a portable format, and to withdraw your consent at any time. Withdrawing consent does not affect what we did before.

To use these rights, email us at admin@goallegends.com, or delete your account yourself (see Section 10). We may ask you to confirm your identity, and we reply within one month.

You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. We would appreciate the chance to help you first.

10. Deleting Your Account

You can ask for your account to be deleted at any time, in your account settings on the website or in the app, or without logging in on our delete your account page. Our team then deletes it within 30 days and emails you to confirm. Your email address, manager name, login details, and other personal identifiers are removed. Your club is handed back to the game for another manager to take over. What stays is described in Section 8.

11. Minimum Age

Goal Legends is for people aged 16 and over. We ask for your date of birth at sign-up and do not create accounts for anyone under 16. If we find that an account belongs to someone under 16, we block it and offer to delete it, and we delete the data if it is not deleted on request. If you believe someone under 16 has an account, please let us know.

12. Security

We protect your data with encrypted connections (HTTPS), secure password hashing, limits on login attempts, and optional passkeys and two-step verification. Only our team has access to the admin tools. No online service can be perfectly secure, but we take reasonable steps to protect your information, and we will tell you and the authorities about a data breach when the law requires it.

13. Changes to This Policy

The version number and effective date at the top of this page show which version applies. If we change this policy in a way that matters to you, we tell you in advance and ask you to accept the new version the next time you open Goal Legends, on the website or in the app, before you can continue. Small changes, such as clearer wording, apply from the moment we publish them.

14. Contact Us

Questions about this policy or your data? Contact us at admin@goallegends.com.