Privacy policy

This is what offside.win knows about you, why, who else sees it, and how to make us delete it. If something here is unclear, write to support@offside.win and we will explain it.

The short version

You can read the whole site without telling us anything. If you make an account we hold your email address, and if you buy a membership we hold a record of what you bought and when. We never see your card. We do not sell data, show adverts or track you on other sites. Visit counting and keeping pages on your device only happen if you say yes to them.

Who is responsible

offside.win is the controller of the personal data described here, which means we decide what is collected and are answerable for it. You can reach us at support@offside.win.

What we hold, and why

If you only read the site, we hold nothing about you. Our host keeps ordinary request logs (your IP address, your browser, the page asked for and the time) to keep the site running and to stop abuse. We rely on our legitimate interest in running a secure website for that, and we do not use the logs to build a picture of anyone.

If you make an account, we hold your email address, because a sign-in link is sent to it and it is how your membership finds you. If you sign in with Google instead, Google tells us your email address, your name and your profile picture, and that you signed in. We show the name and picture on your own account page and in the header, to you and nobody else. We hold this to provide the account you asked for.

What you choose to add to your account: the name you want to be called, the teams and competitions you follow, and how you like odds written. We use them to greet you, to put your teams' games first on the front page, and to write prices your way. Your odds choice is also kept on your device so pages open in it straight away. You can change or remove any of it on your account page.

If you buy a membership, we hold which plan you bought, when it started and when it ends, and a record of each payment: the amount, the currency, the date, whether it went through, and the reference our payment provider gave it. We hold this to provide what you paid for, and we keep the payment records because tax law requires it.

Your card never reaches us. It is typed into Whop's card form, which appears on our pricing page but is served and run by Whop, and Whop keeps it. We are told that a payment happened, for which of our accounts, and the email address given to Whop.

If you say yes to visit counting, each page you open adds one to a daily count for that kind of page (the front page, a fixture page, the results and so on). The count records the day and the kind of page. It does not record which fixture, your IP address, your browser or anything that could tell you apart from anyone else, and it sets no cookie. If you say no, nothing is counted.

We send email only to sign you in and about your membership: that it started, that it is about to renew, that a payment failed. Never marketing.

Who else handles it

A few companies do part of the work for us. Each gets only what its job needs and may use it for nothing else.

• Cloudflare hosts the site and keeps the request logs described above.
• Supabase stores accounts, memberships and payment records, and runs sign-in.
• Whop runs the checkout and the billing, holds your card, and has its own privacy policy for the purchase you make with it.
• Google, if you choose to sign in with Google. Its sign-in button is loaded from Google when you open the sign-in page, so Google sees that request as any server would.
• jsDelivr serves the sign-in library to your browser when you sign in or open your account, so it sees that request as any server would.
• Club crests, league marks, player photographs and stadium photographs load from our football data provider's image server, which sees those requests. No personal data is sent to the provider, and our match and odds data comes from it, not from you.

Some of these companies process data outside the UK and the European Economic Area. Where they do, the transfer has to be covered by safeguards UK law recognises, such as standard contractual clauses.

How long we keep it

Your account and membership details stay while you have an account. You can delete the account yourself, straight away, from the Settings tab of your account page; or ask us and we will do it within 30 days. Deleting it removes your sign-in, name, follows and settings and ends any membership. Payment records are kept for six years after the payment, which is what UK tax rules require; after an account is deleted they are kept without your email address attached. Visit counts are not personal data and are kept as a running total.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop or limit using it, and ask for it in a form you can take elsewhere. Most of this you can do yourself on your account page: download your data as a file, change your name and settings, and delete the account. Where we rely on your consent, which is only visit counting and keeping pages on your device, you can withdraw it at any time from the cookie settings in the footer. Write to support@offside.win from the address on your account and we will answer within a month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live. We would rather hear about it first.

Under-18s

The site is for adults. We do not knowingly hold data about anyone under 18, and if we learn that we do, we delete it.

Changes

When this policy changes, the date at the top changes with it. If a change affects what we hold about members or why, we tell members by email before it takes effect.