Privacy policy

Scope and operator

This policy covers L-FUT 2026. Configured operator identification and the public privacy contact appear at the bottom. Payment providers, rather than game storage, process card details.

Local career data

Browser storage may contain manager name, team, squad, results, career slots, audio/language settings, technical identifiers, queued events and measurement preferences. This enables local/offline play. Other users of the same browser profile may access local information.

Authentication

Accounts process account ID, email, profile and authentication-provider information. Google/Apple share permitted identity details when selected. Passwords are handled by authentication services, not included in saves, cards or Analytics events. An account is not required to start the demo.

Cloud careers

When available, sync sends the career snapshot, account/slot IDs, revision and update time. A snapshot includes career details and manager name and is used to restore progress/detect conflicts, not publish saves. Account access controls restrict online reads. Local conflict backups need exporting if you want to preserve them outside this device.

Purchases

Purchase records include account ID, payment-session reference, status, environment and dates. Name and confirmed email may be used for the payment customer profile. Stripe handles financial data under its own policies. Financial/security/legal records may require retention after a deletion request.

Measurement

Google Analytics 4 and product telemetry may measure visits, matches, failures and funnel stages using pseudonymous browser IDs, page/campaign, device, language, timestamps and app version. Approximate visitor country differs from the selected team. Technical identifiers can still be personal data; infrastructure logs may include IP/connection data.

Measurement controls

The measurement setting stops new optional events in this browser and clears its pending local queue. It does not delete previously transmitted data or necessary authentication/payment/security records. Clearing all site data may erase both careers and this preference. Export saves first and configure your preference again afterwards.

Notifications and public features

Browser notifications require permission and may process delivery endpoints and technical keys. Revoke permission in browser settings. Voluntary rankings/sharing can expose manager names, teams and performance. Avoid sensitive information in names. Copies outside the service are beyond its technical control.

Purposes and providers

Processing may be necessary for requested/contracted features, legal obligations, legal claims or legitimate security/product interests, subject to applicable rights. Permission-based features require the relevant authorization. Supabase/Lovable infrastructure, the Stripe integration and Google Analytics support operations; selected login providers and external links have separate policies. International processing is subject to applicable safeguards.

Retention and rights

Local information remains until removed/replaced. A synced-slot deletion tombstone is not full account/data deletion. Categories have different retention needs; immediate universal deletion of provider backups is not promised. You may request confirmation, access, correction, sharing information and applicable portability, restriction, anonymization/deletion, consent withdrawal or objections through the configured privacy channel. Identity checks may be needed. Local export/cleanup does not replace a server-data request.

Security, minors and changes

Access controls reduce risks but cannot guarantee absolute security. Protect your email/password, sign out on shared devices and guide minors to avoid unnecessary personal data. Documents, contacts, photos and precise location are not required to start a career. The version date identifies this policy; material changes should be communicated appropriately. Mandatory legal rights are preserved.

Referral rules

Referral validation stores a random browser identifier, invitation token, inviter/invitee account IDs, dates and a compact completed-match record (teams, score and fixture ID). Inviters see only their count, not friends’ identities or emails. We do not access contacts or send invitations/marketing emails. Ordinary email signup confirmation may still be required. These operational and fraud-control records are separate from optional analytics; confirmation can follow reconnection.

Operator and privacy contact