Legal
Privacy policy
How CazzyFooty handles your personal data. Drafted 10 September 2026.
Draft Placeholder
This describes accurately what the site does with your data today, but it has not been reviewed by a solicitor and the details in square brackets below are not filled in yet. It must not be relied on as the live policy until both are done. Outstanding:
- The legal entity name, registered address and company number.
- An email address for privacy requests.
- Our ICO registration number.
- The minimum age for an account.
- Who hosts the site, and where.
- An effective date.
Who we are
CazzyFooty organises casual football games in Norwich. We book the pitch, provide the kit, fill the teams and take the payment.
[Legal entity name] of [registered address], company number [number], is the data controller for the personal data described here. We are registered with the Information Commissioner's Office under [ICO registration number]. This policy is governed by UK data protection law: the UK GDPR and the Data Protection Act 2018.
The short version
- We collect what we need to get you onto a pitch, and not much else.
- We do not track you. There is no analytics, no advertising, no third-party scripts and no tracking cookies anywhere on this site.
- Nothing on our pages is loaded from anyone else's servers, so no other company sees that you visited us.
- We never see your card details. Card payments will be handled entirely by Stripe; we only ever store a reference number.
- We never sell your data, and we never share it for anyone else's marketing.
- You can see, correct, export or delete your data at any time.
What we collect
When you create an account
Your email address, the name other players will see, and your password. Optionally a postcode, so we can show you games near you. Your password is never stored: we keep only a scrypt hash of it, which cannot be turned back into your password.
If you sign in with Google
We ask Google only for your name, email address and profile picture. We store Google's identifier for your account, the email address it gave us, and when you last used it, so we can recognise you next time. We never receive your Google password, and we cannot see anything else in your Google account.
Your profile and preferences
Anything you choose to add in your settings: full name, phone number, address, ability level, preferred position, and which days, formats, times, distances and prices suit you. All of it is optional except the name and email you signed up with, and all of it is there to match you to the right game.
When you use the site
Each time you sign in we record the session, the browser you used and the IP address you came from, and we keep them until the session expires or you sign out. That is what lets you stay signed in, and what lets you see and end sessions on other devices from your settings page. We do not build a browsing history of the pages you look at.
When you play
Not live yet Games and payments are not built yet, so none of this is collected today. It will be once they are.
- Which games you join, when you joined, whether you turned up, and whether you cancelled.
- A record of each payment: the amount, when it was taken, and a reference from our payment provider. Not your card number, and not your bank details — we never receive them.
- Ratings you give a game or a pitch afterwards.
Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Creating your account, signing you in, and keeping you signed in | Performance of a contract with you |
| Showing you games near you, at your level, on days that suit | Performance of a contract with you |
| Booking you into a game and taking payment | Performance of a contract with you |
| Keeping a record of attendance so games stay fair and teams get filled | Our legitimate interest in a service where people turn up when they say they will |
| Protecting accounts — rate limits, session records, fraud and abuse | Our legitimate interest in keeping the service secure |
| Emails about new games near you | Your consent, which you can withdraw at any time in your settings |
| Keeping records of payments and bookings | Our legal obligations, including tax and accounting law |
Cookies
We set four cookies. All of them are strictly necessary for the site to work, none of them track you, and none of them are readable by anyone else. That is why you are not being asked to accept them.
- Your session — keeps you signed in. Lasts 30 days, or until you sign out.
- A security token — proves a form was submitted by you and not by another website on your behalf. Lasts 12 hours.
- A message — carries a one-line confirmation such as “Your profile has been updated” across a page load. Lasts 60 seconds and is deleted as soon as it is shown.
- A sign-in-with-Google token — set only while you are signing in with Google, to make sure the reply we get back is genuinely the request you started. Lasts 10 minutes.
Every one of them is set by us, marked so that scripts cannot read them, and sent over HTTPS only.
Who we share it with
We do not sell your personal data, and we do not share it with anyone for their own marketing. We share it only with the suppliers we need to run the service, and only what they need:
- Google — only if you choose to sign in with Google. They tell us who you are; we tell them nothing about you.
- Stripe Not live yet — will process card payments. Your card details go to Stripe directly and never reach us. Stripe handles them under its own privacy policy.
- [Hosting provider] — runs the servers this site and its database sit on.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
Where your data goes
Your account data is stored on servers in [region]. Google and Stripe are global companies and may process data outside the UK; where they do, transfers are covered by UK adequacy regulations or the International Data Transfer Agreement.
How long we keep it
While your account is open, we keep your data so the service works. Sessions are deleted when they expire or when you sign out.
Closing your account does not immediately erase it. We mark it as closed and sign you out everywhere, but the record itself is kept so that past games, payments and ratings stay accurate for the other people involved and so we meet our accounting obligations — ordinarily six years for payment records. Your account stops being usable and stops appearing to other players straight away. If you want it erased outright rather than closed, ask us and we will delete everything we are not legally required to keep.
How we protect it
- Passwords are stored as a scrypt hash with a random salt, never as text, and never anywhere we could read them.
- Session tokens are stored only as a SHA-256 hash, so even a copy of our database could not be used to sign in as you.
- Everything travels over HTTPS.
- We never store card numbers, security codes or bank details.
- Changing your password signs out every other device. You can also sign out everywhere yourself, at any time, from your settings.
- Sensitive changes — your email address, your password, closing your account — need you to confirm who you are first.
No system is perfectly secure, but if a breach ever put you at risk we will tell you and the ICO as the law requires.
Your reliability score
Turning up, cancelling late and not showing up all feed a reliability score on your account. It exists so that people who commit to a game get priority over people who repeatedly do not, and it may affect your place in a queue for a busy game.
No decision with a legal or similarly significant effect is made about you purely by a computer. If you think your score is wrong, tell us and a person will look at it.
Your rights
Under UK data protection law you can:
- ask for a copy of the personal data we hold about you;
- have anything inaccurate corrected — most of it you can edit yourself in your settings;
- ask us to delete it;
- ask us to restrict how we use it, or object to us using it;
- ask for it in a portable, machine-readable form;
- withdraw consent to marketing emails at any time, without affecting anything we did before you withdrew it.
Email [privacy email address] and we will reply within one month. Exercising any of these rights is free.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you told us first, so we can put it right.
Age
CazzyFooty is for people aged [minimum age] and over. We do not knowingly collect data about anyone younger. If you believe a child has created an account, tell us and we will remove it.
Changes
If we change this policy we will update this page and change the date at the top. Where a change materially affects you, we will tell you directly rather than expect you to notice.
Contact us
Email [privacy email address], or write to [registered address].