Privacy policy

Who we are

The Robot Football League (“RFL”, “we”, “us”) operates rfl.football and the associated public repositories, broadcasts and data archive. The league is run from the United Kingdom by its founder, and for the purposes of UK GDPR we are the data controller for the personal data described here.

The way to reach us about anything in this policy is the contact form.

What we collect

Information you give us

Contact form (/contact): your name, email address, chosen subject and message.
Team entry form (/start-a-team): your name, email address, and optionally a club name, your intended approach, your background and any links you choose to share.
Signing a club book (/quiz): your email address, and the club the quiz matched you to. If you later choose to appear on a club's list of founding supporters, the display name you pick for that purpose.

The contact and team entry forms are emailed straight to a human inbox; if you write to us, the record of that is an email and nothing more.

One line about where you came from. If — and only if — you accepted analytics, those two forms also carry a single line saying which page you first arrived on and which site sent you (for example “first landed on /league, from chatgpt.com”). It tells us which of our pages actually brings people to the league, which is the only way we can tell what is worth writing more of. It is stored in your own browser, never shared, and if you declined analytics the line says so instead.

Following a club

Signing a club book does create a record of you, so it is worth being plain about what that means.

We store your email address, the club you follow, the date you signed, and a founding number — the position your name took in that club's book. Nothing else. We never ask for your real name, and there is no profile to fill in.
There is no password. You confirm your address by clicking a link we email you, and that same kind of link is how you would sign in later. We never hold a password for you because we never create one.
You will receive an email after each match the club you follow plays: the result, a line from its manager, and a link to the replay. That is the whole of it — we do not send anything else to that address, and we never pass it to anyone else.
Every one of those emails carries an unsubscribe link, and your mail app's own one-click unsubscribe works too. Using either stops the emails immediately. Ask us and we will delete the record entirely.
A club's founding supporters may be listed publicly on the site. That listing shows only a display name you have chosen and your founding number. Your email address is never published, and nothing appears there unless you have explicitly opted in.

Information collected automatically

Analytics — only if you accept. We use Google Analytics 4 to count visits and see which pages people read. It sets cookies in your browser and receives your IP address, approximate location, device and browser type, and the pages you view. It does not load until you accept it on the banner you get on your first visit; reject, and no analytics script is ever fetched. We never use it for advertising and we do not run ad networks on this site.
Server logs. Our hosting provider records ordinary web-server information — IP address, timestamp, URL requested, user agent — as part of serving and protecting the site.
Rate limiting. When you submit a form, your IP address is held briefly in memory to stop the same address flooding us. It is not written to disk and is discarded within minutes.

Why we use it, and our lawful basis

To reply to you and to run the league — reading your message, answering it, and assessing team entries. Lawful basis: legitimate interests (responding to people who contact us) and, for team entries, steps taken at your request before entering into an arrangement.
To send you your club's results — the emails you asked for when you signed its book, and the confirmation and sign-in links that go with them. Lawful basis: your consent, given by confirming your address, and withdrawable from any email we send you.
To understand what people read — analytics. Lawful basis: your consent, which you give on the banner and can withdraw at any time.
To keep the site up — logs and rate limiting. Lawful basis: legitimate interests in the security and availability of the service.

We do not sell personal data, we do not share it for advertising, and we do not use it to make automated decisions that produce legal effects about you.

Who else sees it

We use a small number of service providers, and they only process data on our behalf:

Vercel — hosting and delivery of this website.
Amazon Web Services (Simple Email Service) — delivery of the emails our forms generate, and of the match results we send to club followers. Our sending region is in the EU (London).
Supabase — the database holding club-book records, and the service that emails your confirmation and sign-in links. Our project is hosted in the EU (London).
AhaSend — delivery of those confirmation and sign-in emails, through their European servers.
Google — Google Analytics, as described above.

The site footer carries a badge image served by PromptFrenzy, an AI directory; loading that image tells their server your IP address and user agent, as any remote image would. Links out to Twitch, YouTube, 4DGSx and GitHub are ordinary links — those services have their own privacy policies, which apply once you arrive. Match replays on this site are embedded from 4DGSx behind a click-to-play cover: nothing loads from 4DGSx until you press play, at which point their servers see your IP address and their own analytics apply, as if you had visited 4dgsx.com directly.

We may also disclose information where we are legally required to, or to establish or defend legal claims.

International transfers

Some of these providers are based in, or route data through, the United States. Where personal data leaves the UK or EEA, it is covered by the provider's standard contractual clauses, UK addendum, or an applicable adequacy decision.

How long we keep it

Form submissions stay in our email for as long as the conversation is useful — for a team entry, for as long as the club is involved with the league. Ask us and we will delete them.
Club-book records are kept for as long as you follow the club. Unsubscribe and we stop emailing you at once; ask us to delete the record and it goes, founding number included. We do not keep a suppression copy of your address beyond what our email provider needs to honour an unsubscribe.
Analytics data is retained by Google under the retention period set on the property (14 months by default).
Server logs are kept for a short period by our host as part of their normal operations.

Cookies

We set no cookies of our own. The only cookies on rfl.football are Google Analytics cookies, which distinguish one visit from another, and they are only ever set if you accept them.

If you sign a club book, your signed-in session is kept in your browser's local storage rather than in a cookie. It stays on your device, is not sent to us with every request the way a cookie would be, and clearing your browser data removes it.

On your first visit you get a banner with two equally weighted choices, Accept and Reject. Nothing is loaded before you choose, and declining costs you nothing — the league tables, fixtures, blog and streams all work without cookies. Your choice is remembered in your browser's local storage, not in a cookie, and it never leaves your device.

To change your mind, use the Cookies link in the footer of any page. If you withdraw consent we switch analytics off immediately and delete the Google Analytics cookies already in your browser. You can also block or delete them in your browser settings, or install Google's opt-out browser add-on.

Your rights

Under UK and EU data protection law you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent, you can withdraw it at any time. Use the contact form and we will answer within one month.

For club emails you do not need to write to us at all: the unsubscribe link in any of them stops them straight away, and asking us to delete the record removes it entirely.

If you think we have handled your data badly, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would rather you told us first.

Children

The RFL is suitable for a general audience, but it is not aimed at children and we do not knowingly collect personal data from anyone under 13 — including through the club books, which nobody under that age should sign. If a child has sent us their details or signed a club book, tell us and we will delete the record and stop the emails.

Security

The site is served over HTTPS. We hold no passwords and no payment details, which removes most of what there is to lose — signing in works by emailed link, so there is no password of yours for us to leak. Form submissions travel over encrypted connections to an email inbox protected by two-factor authentication. Club-book records sit in a database where access rules are enforced per row, so one follower cannot read another's details, and email addresses are never exposed to the public site. No system is perfect, and we make no absolute guarantee.

Changes

If this policy changes we will update the date at the top of the page. Material changes will be called out on the site.

Contact

Questions, requests or complaints about this policy: rfl.football/contact. See also our terms of service.