Privacy policy
Last updated: October 2026
This page explains which data we process when you use Derbymates, why we need it and what your rights are. In short: we only process what the game needs.
Controller
The controller under the General Data Protection Regulation (GDPR) is:
The short version
- No tracking, no analytics tools, no advertising, no social media plugins.
- Only strictly necessary cookies: the session cookie and a hint cookie without any identifier. That is why there is no cookie banner.
- Fonts and images are served from our own server.
- Your email address is optional. You need it to sign in on several devices and for Pro.
- Only our payment provider sees full card details, we never do.
- We never sell data.
When you visit the website
When you visit, our host Netlify processes technically necessary data: IP address, date and time, the address requested, browser and operating system. This is needed to deliver the pages and to protect them against attacks and abuse.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable service. The logs are deleted automatically as soon as they are no longer needed for these purposes.
When you play
For your club we store the game data: club name, town, manager name, colours and crest, your decisions, line-ups, transfers and reactions, and your language setting.
To keep you signed in, we set a session cookie containing a random identifier. Our server only stores a hash of it, not the identifier itself. Together with the session cookie we set the hint cookie "dm_s" (details under Cookies).
If you join a league through an invite link, we store in the league's game data which club invited you. We need this for the invite bonus. Other managers cannot see it.
The other members of your league can see your club name, manager name, crest, results, league position, transfers and reactions.
The legal basis is Art. 6(1)(b) GDPR, because the game cannot work without this data. We keep it until you delete your account or until we remove a guest account that has not been used for a long time. Results of past matches stay in the league archive, but your account itself is deleted.
Single-player mode
In single-player mode the whole game runs in your browser. Your save stays in your device's local storage and is never sent to us. You can delete it with "Reset save" in the settings or through your browser.
Account with an email address
If you give us your email address, we send you a sign-in link. It is valid for 30 minutes and can be used once. We use the address for signing in, for messages about your contract (for example confirmations) and for important notices about the game. We only send you marketing if you have expressly agreed to it beforehand.
The legal basis is Art. 6(1)(b) GDPR. We keep the address until you delete your account.
Pro and payment
You pay for Pro through Stripe Managed Payments. The payment is handled by Sold through Link, LLC, a Stripe group company ("Link"). Link processes your payment and billing data as an independent controller, for example to collect the payment, prevent fraud and pay taxes. Link sends you invoices and receipts directly by email. Link's privacy policy at link.com/privacy applies to all of this.
Link passes on the order data we need for your contract: name, email address, billing address and country, plan, order, payment and subscription status, and payment method details such as card type and the last four digits.
The legal basis is Art. 6(1)(b) GDPR and, where we must keep records, Art. 6(1)(c) GDPR. We keep records for as long as tax and commercial law require.
Emails
We send sign-in links and confirmations through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France). Brevo acts as our processor under Art. 28 GDPR and may only use the data to send the emails.
If you signed in with your email address, we send you game alerts: a few hours before kick-off when someone is missing from your starting eleven, and right away when you are outbid in an auction. The legal basis is Art. 6(1)(b) GDPR (part of the game). You can switch off both alerts at any time in the settings or with the link in every mail.
Pro trial hints are advertising. We only send them if you expressly switch them on in the settings (Art. 6(1)(a) GDPR, § 7(2) UWG). We store when you gave your consent. You can withdraw it at any time with effect for the future, in the settings or with the link in every mail. So that no hint is sent twice, we store which hint was sent when and delete these entries after 180 days.
Campaign links
If you come to us through a campaign link (for example from a creator or an ad, recognisable by “?via=” in the address), we count the visit on our server, without an identifier and without storing anything on your device. If you then take over a club, we store the campaign name with your account. This shows us which campaigns bring new players. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is managing our advertising economically. We do not use pixels, click identifiers or advertising cookies.
Cancellation and withdrawal
If you use "Cancel contracts here" or "Withdraw from contract", we store your details with the date and time: name, email address, contract, the date you asked for and, for a cancellation without notice, the reason. We need them to carry out your request, confirm it to you and be able to prove it later.
The legal basis is Art. 6(1)(c) GDPR together with sections 312k and 356a of the German Civil Code (BGB), and Art. 6(1)(f) GDPR. Our legitimate interest is being able to prove what happened. We delete the details once any claims under the contract are time-barred and no retention duty applies.
When you contact us
If you write to us, we process your message and contact details to deal with your request (Art. 6(1)(b) or (f) GDPR). We delete them once everything is settled and no retention duty applies.
Fair play and security
To detect multiple accounts, bots and abuse, we check game and log data where there is a specific suspicion (Art. 6(1)(f) GDPR). Our legitimate interest is a fair and safe game for everyone.
No third parties in your browser
We serve fonts (Inter, Barlow Condensed) and images from our own server. While you play, your browser does not connect to Google, Meta or any other third party. Only the Stripe payment page has its own rules.
Recipients and service providers
- Netlify, Inc., San Francisco, USA: hosting of the website and server functions, as our processor.
- Neon (USA) via Netlify: operation of the database (Netlify Database), as Netlify's sub-processor.
- Sendinblue SAS (Brevo), Paris, France: sending emails, as our processor.
- Sold through Link, LLC and other Stripe group companies: payment handling, as independent controllers.
- Authorities and courts, where the law requires us to share data.
We do not share data for advertising and we do not use AI services to analyse your data.
Transfers to the USA
Netlify, Neon and Stripe are based in the USA or process data there. Netlify and Stripe are certified under the EU-US Data Privacy Framework. Transfers rely on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).
If the decision does not or no longer applies, the European Commission's standard contractual clauses apply under our data processing agreement with Netlify (Art. 46(2)(c) GDPR). Netlify must contractually ensure equivalent safeguards for its sub-processors such as Neon (Art. 28(4) GDPR).
Your rights
You have the right to
- access your data (Art. 15 GDPR)
- have incorrect data corrected (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object (Art. 21 GDPR, see below)
- withdraw consent at any time for the future (Art. 7(3) GDPR)
Just send us an email. You can also delete your account yourself in the settings at any time.
Your right to object
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
Complaints to a supervisory authority
You can complain to a data protection supervisory authority, in particular in the EU country where you live or work (Art. 77 GDPR). The authority responsible for us is:
Required data and automated decisions
You are not obliged to give us any data. Without the game data you cannot play, and without an email address you cannot buy Pro. We do not make automated decisions within the meaning of Art. 22 GDPR and we do not build advertising profiles.
Minimum age
Derbymates is for people aged 16 and over. We do not knowingly process data of younger people.
Changes
We update this policy when the game or the law changes. The version published here always applies.