The Football Exchange Limited ("Footex", "we", "our", "us")
Hamilton House, Church Street, Altrincham, England, WA14 4DR
Contact: help@footex-app.com
Effective date: 04/06/26
Last updated: 04/06/26
The Football Exchange Limited is the data controller for personal data collected through the Footex mobile application and the Footex website (footex-app.com). This means we decide why and how your personal data is processed.
We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC165106.
If you have any questions about this policy or wish to exercise any of your rights, please contact us at:
Email: help@footex-app.com
Post: The Football Exchange Limited, Hamilton House, Church Street, Altrincham, England, WA14 4DR
This policy explains what personal data we collect about you when you use the Footex app or website, why we collect it, how long we keep it, who we share it with, and what rights you have over it.
It covers two types of user:
When you use Footex without an account, we assign you a random anonymous identifier (UUID) — a string of letters and numbers that identifies your session across uses of the app. This does not include your name, email address, or IP address.
We use this identifier to record in-app events and gameplay data, such as:
Why we collect this: We process this data to operate the app and to understand how it is being used so we can improve it. We rely on our legitimate interests (Article 6(1)(f) UK GDPR) as the lawful basis for this processing. Our legitimate interest is in understanding gameplay behaviour and improving the app experience. We have assessed that this interest is not overridden by your rights and freedoms, given that the data is not linked to any name or contact information and cannot easily be used to identify you.
How long we keep it: We retain anonymous session data for up to 90 days, after which it is deleted.
When you create an account, we collect:
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Email address | To create and manage your account, and to contact you about your account if needed | Contract (Article 6(1)(b)) |
| Password (stored as a one-way cryptographic hash — we never store your raw password) | To authenticate your identity when you log in | Contract (Article 6(1)(b)) |
| Phone number (optional) | To enable account recovery if you lose access to your email | Consent (Article 6(1)(a)) — this field is optional and you may leave it blank |
| Gameplay statistics | To power your in-app profile, leaderboards, and game features (scores, streaks, win/loss records, question history, game events) | Contract (Article 6(1)(b)) |
| App usage analytics | To understand how the app is used and improve it (screens visited, session duration, feature interactions, in-app events linked to your user ID) — not used for advertising profiling | Legitimate interests (Article 6(1)(f)) |
| Anonymous UUID | If you used the app anonymously before creating an account, your previous anonymous session data may be associated with your new account | Contract / Legitimate interests |
All registered user data is stored in our database hosted by Supabase (see Section 6).
How long we keep it: We retain your account and associated data for the duration of your account. If your account has been inactive for 12 months, we will delete your account and all associated personal data. We will send a notification to your registered email address before doing so.
The Footex app displays advertisements served by Google AdMob, a service provided by Google LLC. AdMob may use device identifiers (including Apple's Identifier for Advertisers, or IDFA) and other data to show you personalised advertisements.
For users in the UK and European Economic Area (EEA): Before any personalised advertising data is collected or used, we will ask for your consent through an in-app consent screen. You can choose to accept or decline personalised ads. If you decline, you will still see ads, but they will not be tailored to your interests based on tracking data.
For all users:AdMob may collect device information, IP address (used to infer approximate location), product interactions (e.g. ad views and clicks), advertising data, crash data, and performance diagnostics. This data is processed by Google in accordance with Google's own privacy policy (policies.google.com/privacy). Google acts as an independent data controller for advertising data.
iOS users — App Tracking Transparency: On iOS, we will ask for your permission to use your device's advertising identifier (IDFA) via Apple's App Tracking Transparency prompt. You can change this permission at any time in your device's Settings → Privacy & Security → Tracking.
The Footex website may display advertisements served by Google AdSense. AdSense operates similarly to AdMob and may also collect device identifiers and usage data for advertising purposes. Consent will be requested before any personalised advertising data is used on the website.
You can change your advertising consent at any time by going to: Profile → Settings → Privacy & Preferences within the Footex app.
You can also opt out of personalised advertising from Google at any time via Google's Ad Settings at adssettings.google.com, or by using the NAI opt-out tool at optout.networkadvertising.org.
The Footex app does not use browser cookies. However, the app and advertising SDK may store small amounts of data on your device (such as an advertising identifier or consent preference) as part of normal app operation. Personalised advertising data stored on or accessed from your device requires your consent, which we request as described in Section 4.
We do not sell your personal data. We share data only with the following trusted service providers and only to the extent necessary to operate the app:
| Recipient | Role | Purpose | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Data processor | Database hosting, authentication, and storage of all user data | EEA (AWS eu-north-1, Stockholm, Sweden) | EU Standard Contractual Clauses (2021/914) + UK Addendum (B.1.0), incorporated into our Data Processing Agreement with Supabase |
| Amazon Web Services (AWS) | Sub-processor (via Supabase) | Physical infrastructure hosting | EEA (Stockholm, Sweden) | As above (covered by Supabase DPA) |
| Google LLC (AdMob / AdSense) | Independent data controller | Advertising | USA | Google's own EU-approved data transfer mechanisms; see policies.google.com/privacy |
We may also disclose data where required by law, court order, or to protect our legal rights.
Your personal data stored in our database is hosted within the European Economic Area (via Supabase on AWS eu-north-1, Stockholm, Sweden) and is not transferred outside the EEA or UK for database storage purposes.
Google LLC (AdMob/AdSense) processes advertising data in the United States. Google relies on its own approved data transfer mechanisms for those transfers, in accordance with its privacy policy at policies.google.com/privacy.
If you have questions about our data transfer practices, please contact us at help@footex-app.com.
We take appropriate technical and organisational measures to protect your personal data. These include:
No system is completely secure. If you believe your account has been compromised, please contact us at help@footex-app.com immediately.
Under UK GDPR (and EU GDPR where applicable), you have the following rights. You can exercise most of these directly within the app or by contacting us at help@footex-app.com. We will respond within one calendar month.
You have the right to be told how your data is used. This privacy policy fulfils that obligation. If we change how we use your data, we will update this policy and notify you.
You have the right to request a copy of all personal data we hold about you, along with information about how it is being used. To exercise this right, contact us at help@footex-app.com or use the "Download my data" option in Profile → Settings (coming soon). We will provide your data in a structured, readable format.
You have the right to have inaccurate personal data corrected. To update your email address or phone number, please contact us at help@footex-app.com. In-app editing of profile details will be available in a forthcoming update.
You have the right to request deletion of your personal data. You can delete your account and all associated data at any time by going to Profile → Settings → Delete Account within the app. This will permanently delete your account credentials, gameplay data, and analytics data from our systems. Please note that residual copies in automated backups will be purged within 30 days as part of our standard backup rotation.
You have the right to ask us to pause processing of your data in certain circumstances (for example, while a dispute about accuracy is resolved). To exercise this right, contact us at help@footex-app.com.
Where we process your data on the basis of contract or consent using automated means, you have the right to receive your data in a structured, commonly used, machine-readable format (such as JSON). Contact us at help@footex-app.com to request a data export.
You have the right to object to processing based on our legitimate interests (such as first-party analytics). If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests. You also have an absolute right to object to your data being used for direct marketing. To object, contact us at help@footex-app.com.
Where we process your data based on consent (your optional phone number, and personalised advertising), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. To withdraw consent for personalised advertising, go to Profile → Settings → Privacy & Ad Preferences. To remove your phone number, contact us at help@footex-app.com.
We do not make decisions about you that produce legal or similarly significant effects using solely automated processing.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office:
ICO website: ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are based in the EU, you also have the right to complain to your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.
We would appreciate the opportunity to resolve any concern directly before you contact the ICO — please reach out to us first at help@footex-app.com.
Footex is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you are under 13, please do not use the app or provide any personal information.
If you believe a child under 13 has provided us with personal data, please contact us at help@footex-app.com and we will delete it promptly.
For users aged 13–17, we encourage a parent or guardian to review this policy.
We do not sell your personal data to third parties.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale or sharing of personal information. As noted above, we do not sell or share personal information for cross-context behavioural advertising. To opt out of personalised advertising, use the controls in Section 4.3.
To exercise any US privacy rights, contact us at help@footex-app.com.
We may update this policy from time to time. If we make material changes, we will notify you via the app or by email to your registered address before the changes take effect. The "last updated" date at the top of this policy will always reflect the most recent revision.
We encourage you to review this policy periodically.
For any privacy-related questions, requests, or concerns:
Email: help@footex-app.com
Post: The Football Exchange Limited, Hamilton House, Church Street, Altrincham, England, WA14 4DR
The Football Exchange Limited is registered in England and Wales. ICO registration number: ZC165106