Privacy Policy

1. Introduction

NotFootball ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, share, and protect information when you use our website and services.

This policy applies to all users of NotFootball, including visitors, registered users, and administrators.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, username, password (encrypted)
• Profile Information: Display name, profile preferences
• Content: Articles, comments, and other content you create

2.2 Automatically Collected Information

• Usage Data: Pages viewed, search queries, time spent on site
• Device Information: Browser type, IP address (hashed), device type
• Cookies: See our Cookie Policy

3. How We Use Your Information

• Provide and improve our services
• Authenticate and secure your account
• Send important service notifications
• Analyze usage patterns to improve user experience
• Prevent fraud and abuse
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data based on:

• Contract: To provide services you've requested
• Legitimate Interest: To improve our services and prevent fraud
• Consent: For optional analytics cookies (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws

5. Information Sharing

We do not sell your personal information. We share data only with the specific service providers ("processors") below, each of whom is contractually restricted to processing data only for the purpose we specify:

• Supabase — database and authentication. Stores your account data, content you author, and activity logs.
• Vercel — hosting, plus (only with your analytics consent) Vercel Web Analytics (visitor/page-view counts) and Vercel Speed Insights (Core Web Vitals / page-load performance).
• Anthropic (Claude API) — we send transfer-rumour and article text to Anthropic's Claude API to generate credibility analysis and draft article content. This is text content only (headlines, rumour text, article drafts) — we do not send your account email, password, or other account identifiers to Anthropic.
• Sentry — error and crash monitoring, so we can find and fix bugs. Runs for all visitors under legitimate interest, with IP addresses, cookies, and auth tokens stripped before anything is sent. Session replay (an additional, optional feature) is only enabled once you give analytics consent. See our Cookie Policy for full detail.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or sale

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in a machine-readable format
• Object: Object to processing based on legitimate interest
• Withdraw Consent: Change or withdraw your cookie/analytics consent at any time

To exercise these rights, contact us at criticalmak@gmail.com or use our data & privacy page to download your data or delete your account. To withdraw cookie/analytics consent specifically, use the control below.

7. Data Retention

We keep different types of data for different lengths of time, depending on why we collected it:

• Activity logs (a record of actions taken on the site): deleted after 30 days.
• Article view records (pseudonymised page-view stats — no direct identifiers; any IP is one-way hashed): deleted after 90 days.
• AI analysis logs (records of AI-assisted content analysis): deleted after 90 days.
• Notifications: deleted 30 days after being read, or immediately once they expire, whichever applies.
• AI batch job records: deleted 90 days after the job finishes (succeeds, fails, or is cancelled).
• Pipeline items awaiting review or rejected: deleted after 14 days.
• Articles you have authored: kept for as long as your account exists. If you delete your account, we do not delete your published articles outright — we remove your name/attribution from them (anonymise) so the content itself is preserved, per our right-to-erasure process below.
• Your account role record: kept until you delete your account, at which point it is deleted along with the rest of your account data.

When you delete your account entirely (see Right to Erasure above), we delete your account, activity logs, and role record immediately, and anonymise your articles, except:

• Data required for legal compliance (e.g., financial records for tax purposes)
• Aggregated, anonymized data used for analytics
• Backup copies (deleted within 90 days)

8. Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Regular security audits and monitoring
• Access controls and authentication
• IP address hashing for privacy

9. Children's Privacy

Our services are not intended for children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by relevant authorities
• Service providers certified under privacy frameworks

11. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes by email or through a prominent notice on our website. Continued use after changes constitutes acceptance.

12. Contact Us

For privacy-related questions or to exercise your rights: