Privacy Policy
Last updated: 5 October 2026. This policy explains what personal data Goalasso collects when you use goalasso.io or the Goalasso iOS app, why, who else processes it, and the choices and rights you have. Questions go to info@goalasso.io.
Who is responsible
Goalasso, reachable at info@goalasso.io, decides how and why the personal data described here is processed.
What we collect
- If you create an account: your first and last name, email address, an optional username, and your password, stored only as a bcrypt hash. You can add a profile photo; otherwise we generate a coloured avatar from your initials.
- If you sign in with Google or Apple: your name, email address and account identifier from that service. We don't import your Google or Apple profile picture; we generate a coloured avatar instead. Sign in with Apple is available in the iOS app.
- When you play: your scores, best results per mode and some of your answers (for example the names you type in Trophy Hunt), the player you create in Box to Box, and, if you joined a World Cup 2026 prediction league, your league and predictions.
- If you use Goalasso without an account: on your first visit we create a guest record, linked to your browser by the session cookie, so your games can be saved while you play.
- If you write to us: the name, email address and message you send through the contact form reach us by email; they are not stored in our database.
- Technical data: like any website, our servers receive your IP address and browser details with each request. We don't store IP addresses in our database, but our hosting provider may keep them in its logs. Our own server logs record the browser and language of new visitors and the email address of people who use the contact form.
What other players can see
If you have an account, your username (or, if you haven't chosen one, your first name) and your profile picture appear next to your scores on the public leaderboards. World Cup 2026 league pages, with members' names, pictures and predictions, can be opened by any signed-in player.
Why we use it
- To run the games, your account and the leaderboards, and to send account emails. This is necessary to provide the service you asked for.
- To keep the site secure, prevent abuse and fix problems, which is our legitimate interest.
- To measure how the site is used and to show advertising, with your consent where the law requires it.
- To meet legal obligations.
We don't sell your personal data, and we don't send newsletters. Account emails are the verification link, a welcome message and password resets. If you joined a World Cup 2026 prediction league, you may have received emails about it during the tournament.
Cookies and similar technologies
- Session cookie (essential): keeps you signed in, or keeps your guest game, for up to 7 days without activity.
- Storage in your browser (essential and preferences): your language, your cookie choice, daily-challenge status, best scores, recently seen questions, game settings and, if you're signed in, a copy of your account details (name, email, avatar) so the site opens faster are kept in your browser's local storage.
- Google Analytics (measurement): on the website, analytics cookies are used only after you click Accept in our cookie banner; your choice is passed to Google through Google Consent Mode. In the iOS app, Google Analytics measures usage without a banner; advertising storage stays off.
- Advertising: see the next section.
To change your choice on the website, use the Cookie settings link at the bottom of every page; the banner will ask again.
Advertising
The website uses Google AdSense and the iOS app uses Google AdMob to show ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the internet.
- You can opt out of personalised advertising in Google's Ads Settings, and out of other vendors' use of cookies for personalised advertising at aboutads.info or, in Europe, Your Online Choices.
- On the website, ads are personalised only if you click Accept in our cookie banner.
- In the iOS app, users in the UK, the European Economic Area and Switzerland first see Google's consent form; every iPhone user is then asked by Apple whether the app may track them. Change Google's choice under Profile, Settings, Ad privacy choices, and Apple's in iOS Settings, Privacy & Security, Tracking.
- Google explains how it uses data from sites and apps that show its ads on its partner-sites page.
Who processes the data
- Replit: hosts the website and the server.
- Neon: hosts our database, on Amazon Web Services in the United States.
- Twilio SendGrid: sends our emails, including contact-form messages.
- Google: Analytics, AdSense, AdMob and Google sign-in.
- Apple: Sign in with Apple and the App Store.
- Ollama Cloud: runs the AI model that checks some Rank It rankings; it receives football data only, never personal data.
Some pages also load content straight from other servers, which then receive your IP address: fonts from Google Fonts, Box to Box's 3D engine from jsDelivr, player photos from Transfermarkt's image servers, flags from flagcdn.com and flagicons.lipis.dev, GIFs from Giphy on loading and celebration screens, and a profile photo from wherever its owner linked it.
Several of these providers process data in the United States. Where data leaves the European Economic Area, the transfer relies on the safeguards those providers offer, such as the European Commission's standard contractual clauses.
How long we keep it
- Your account and game data are kept until you delete your account.
- Sessions expire after 7 days without activity. Guest records are not yet deleted automatically.
- Messages you send us stay in our inbox for as long as we need them to answer you.
Deleting your account
In the iOS app, open your profile's settings and choose Delete account: the account and its game data are deleted immediately. On the website, email info@goalasso.io from the address linked to your account and we will delete it. If you created a World Cup prediction league, deleting your account also deletes that league.
Your rights
Depending on where you live, and in particular under the GDPR, you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw your consent to cookies at any time. Write to info@goalasso.io. You can also complain to your data protection authority; in France, that is the CNIL.
Children
Goalasso is not intended for children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has created an account, write to info@goalasso.io and we will delete it.
Security
Passwords are stored only as bcrypt hashes, every connection uses HTTPS, and the session cookie can't be read by scripts on the page. No system is perfectly secure, so we can't guarantee absolute security.
Changes to this policy
When we change this policy, we update it on this page and change the date at the top. Our terms of use cover the rules for using the service.