Privacy Policy

Intro

This Privacy Policy explains what personal data BTFStats collects, why, who we share it with and what you can do about it. It describes what this website actually does — the third parties named below are the ones our code really sends data to.

Last reviewed: 3 September 2026.

Who is the controller

BTFStats is the data controller for the processing described here. For any privacy question, or to exercise any of the rights listed below, contact info@btfstats.com.

What personal data we hold

If you create an account we store: your e-mail address, username, first and last name, country, time zone, the IP address you registered from, the page that referred you to us, your password, which we store only as a bcrypt hash and never in readable form, and — if you sign in with Google or Facebook — the name held by that provider.

Whether or not you have an account our servers record your IP address and browser user-agent in access and security logs, and we record IP addresses against sign-in attempts and rate-limiting counters to protect accounts from automated abuse.

Why we process it, and on what legal basis

• Running your account — e-mail, name, password hash, time zone. Legal basis: performance of a contract with you.
• Sending you the activation and password-reset e-mails — your e-mail address and the message itself. Legal basis: performance of a contract.
• Keeping the site secure — IP addresses, sign-in attempts, rate-limit counters and anti-bot checks. Legal basis: our legitimate interest in preventing fraud, credential-stuffing and automated abuse.
• Marketing e-mail — your e-mail address and name are added to our mailing list when you register. Legal basis: consent. You can withdraw it at any time using the unsubscribe link in any message, or by writing to us, and withdrawing it does not affect your account.
• Audience measurement — usage and device data, including your IP address, so we can see how the site is used. This runs on every page. Legal basis: our legitimate interest in understanding and improving the service. You can object at any time by writing to us, and you can block it in your browser or with any standard tracker blocker.
• Push notifications — a push identifier, only if you allow notifications when your browser asks. Legal basis: consent, given through that browser prompt, and withdrawn by revoking the permission.

Who we share it with

These are the third parties that actually receive personal data from this site. Each acts as a processor on our behalf, and each gets only what is listed:

• Google reCAPTCHA — your IP address and an interaction token, each time you register, sign in or reset a password, so we can tell a person from a script.
• MailerLite — your e-mail address, first name and last name, when you register, to operate our mailing list.
• TurboSMTP — your e-mail address and the content of the message, to deliver account activation and password-reset e-mails.
• Google Analytics — usage and device data, including your IP address, for audience measurement.
• OneSignal — a push-notification identifier, only if you allow notifications in your browser.

We also share data with public authorities where we are legally obliged to. We do not sell your personal data.

Our football data provider receives only match, league and team identifiers. No personal data is sent to it.

Transfers outside the EEA

Google and OneSignal may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. MailerLite and TurboSMTP process within the EU.

How long we keep it

• Account data — for as long as your account exists, and deleted when you close it or ask us to.
• Sign-in and rate-limiting records — short-lived; rate-limit counters are discarded within 24 hours.
• Server logs — rotated and deleted on a rolling basis, currently within about ten days.
• Mailing-list data — until you unsubscribe or ask us to remove you.

Your rights

Under the GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of anything inaccurate or incomplete.
• Erasure — ask us to delete your data.
• Restriction of processing in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdraw consent at any time, without affecting processing carried out before you withdrew it.

Write to info@btfstats.com and we will respond within one month. There is no charge.

Complaints

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to your national data protection supervisory authority, in the EU or EEA country where you live or work.

Cookies and similar technologies

We use a strictly necessary cookie to keep you signed in. Analytics and push notifications use additional identifiers and are described in our Cookies Policy.

Data protection

The site is served over HTTPS only. Passwords are stored as bcrypt hashes and never in readable form. Connections to the third parties above are made over verified TLS. Access to administrative tools requires an authenticated account.

Changes to this policy

We may update this Policy. Where a change materially affects how we process your data we will give notice in advance so you have time to consider it.