Privacy policy
What we collect, why, who sees it, and the choices you have.
The short version
- You can play without an account. As a guest, your progress stays on your own device and isn’t sent to us.
- If you choose to create an account, we keep your email address and your daily results so your progress follows you between devices.
- Nothing you do in the game is made public. The only thing anyone else sees is a result card you choose to share yourself.
- We don’t sell your information, show advertising, or use tracking cookies.
- You can delete your account, and everything saved to it, from the game menu at any time.
Who runs Pinpoint FC
Pinpoint FC (pinpoint.football) is run by Karan Sood, who is the controller of the personal information described in this policy under UK data protection law.
For any question about your information, or to use any of your rights, email privacy@pinpoint.football.
What we collect and why
When you play as a guest
The game saves your progress on your own device, using your browser’s local storage. This includes your daily results and scores, your streak and statistics, your best guess, and settings such as whether sound is on and whether you’ve seen the instructions. None of this is sent to us. You can clear it at any time in your browser’s settings.
To show you each day’s challenge, the game asks our server for it. Like any request on the internet, this involves your device’s IP address. We don’t store that in our database or link it to you.
If you create an account
An account is optional. You sign in with a link we email to you, so there’s no password. With an account, we keep:
- Your email address, to send you sign-in links and recognise your account.
- Your daily results: which daily you played, your score, the coloured result pattern from your share card, and whether you played on the day (this is how streaks work).
- How many games you’ve played, for your statistics.
- Whether you’ve asked for a daily reminder email, if you tick that box.
- Sign-in records: a scrambled (hashed) copy of each sign-in link and each signed-in session, so we can check they’re genuine. We never store the links or sessions themselves.
- Your IP address when you ask for a sign-in link, so we can limit how often links are requested and stop misuse.
When you first sign in on a device, the guest progress saved on it is copied into your account so you don’t lose it. We don’t ask for your name, a display name, your location or any other details.
When anyone visits the site
Our hosting provider, Cloudflare, handles every visit to pinpoint.football. To deliver the site and protect it from attacks, it processes technical information such as your IP address, browser type and the pages requested. Cloudflare also gives us overall statistics, such as the number of visits and the countries they come from. These statistics don’t identify individual players, and we don’t use cookies or advertising trackers to produce them.
Why we’re allowed to use it
| What we do | Information used | Lawful basis |
|---|---|---|
| Run your account, sign you in and keep your progress in sync between devices | Email address, daily results, games played, sign-in records | Contract: providing the service you asked for |
| Keep the service secure and stop misuse of sign-in links | Sign-in records, IP address | Legitimate interests: protecting the service and its players |
| Send a daily reminder email, once we start sending them | Email address, reminder choice | Consent: you can withdraw it at any time |
| Deliver the website and understand overall use | Technical information processed by Cloudflare, overall statistics | Legitimate interests: running and improving the game |
We only email you when you ask us to: sign-in links, and the daily reminder if you’ve chosen it. Every reminder will include a way to stop receiving them.
Cookies and storage on your device
We don’t set any cookies. The game uses your browser’s local storage to remember your progress and settings and, if you have an account, that you’re signed in. This is needed for the game to work as you’d expect. We don’t load fonts, adverts or trackers from other companies.
Who receives your information
We don’t sell your personal information or share it for marketing. Two service providers help us run Pinpoint FC and handle information only on our instructions:
- Cloudflare hosts the website and our server, stores account data in its database, and provides overall visit statistics.
- Resend sends our emails. It receives your email address and the sign-in email we send you.
We may also share information if the law requires it, or to protect the safety of our players or the service.
What’s public
Nothing. There are no public profiles or leaderboards. Your email address and results are never shown to other players. If you share your result, the card you share shows only the daily number, your coloured result pattern and your score.
International transfers
Cloudflare and Resend may process information outside the UK, including in the United States. Where that happens, we rely on safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework or the UK’s International Data Transfer Addendum to standard contractual clauses.
How long we keep it
- Your account, results and reminder choice: until you delete your account.
- Sign-in link records, including the IP address: deleted automatically about a day after the link expires. Links expire after 15 minutes and work only once.
- Signed-in sessions: end when you sign out or after 180 days, and are then deleted.
- Guest progress: stays on your device until you clear it.
- Our providers’ technical records, such as delivery and security logs, are kept by Cloudflare and Resend for limited periods under their own policies.
Your rights
Under UK data protection law, you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that’s wrong;
- delete your information (you can also delete your account yourself from the game menu);
- restrict how we use your information, or stop using it;
- give you your information in a format you can take elsewhere.
You can also withdraw your consent to reminder emails at any time. To do any of these, email privacy@pinpoint.football. We’ll reply within one month.
If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.
Children
Anyone can play as a guest. You need to be 13 or over to create an account. If you think a child under 13 has created an account, email us and we’ll delete it.
Keeping it secure
Information travels to and from our server over an encrypted connection. We store only scrambled copies of sign-in links and sessions, links work once and expire after 15 minutes, and we limit how often they can be requested. No system is perfectly secure, but we take reasonable steps to protect your information.
Changes to this policy
We’ll update this page if the way we handle information changes. If a change is significant, we’ll tell signed-in players in the game or by email.