TRANSPARENCY
Privacy policy
How SquadCraft uses, stores and protects personal data, and how to exercise your rights.
Published 18 October 2026 · Version 1.7
Who operates SquadCraft?
- Service operator
- Oliver Taylor
- Operator type
- Individual
- Country
- United Kingdom
- Correspondence address
- 17–19 Regency St, London SW1P 4BY, United Kingdom
- Support email
- support@squadcraft.co.uk
- Personal data controller
- Oliver Taylor
What this notice covers
This notice explains personal data used to provide SquadCraft, a free football game with fictional players and simulated statistics. Oliver Taylor is the controller. Contact support@squadcraft.co.uk or the correspondence address above for privacy questions and requests.
Information we collect
- Accounts: manager name, email address, password hash, terms version accepted, confirmation that you meet the 18+ account rule, creation time and email-confirmation status. We do not store your password as readable text.
- Teams and league: team name, formation, player selections, saved version and time; if you join the free league, a locked lineup, round-six score, manager name, team name and entry time.
- Support: the name, email and message you submit, submission time, status and case-closure time. Do not send passwords, security links, payment details or sensitive personal information.
- Security: session identifiers, anti-forgery tokens, activity time and rate-limit identifiers derived from an IP address or submitted email. A derived identifier can still be personal data. Account-security links are random tokens; the database stores their hashes, purpose and expiry rather than readable tokens.
These details come from you and your use of the service. The hosting provider may separately collect IP addresses, device/request details and technical logs for operating and protecting its infrastructure. We do not ask for payment-card details or purchase football statistics about real players.
Why we use information and our legal bases
We use account and team information necessary to provide the free service you request, on the basis of performing our agreement with you. This includes account access, saving teams, email confirmation, password recovery and the optional league feature you choose to join. Name and email are required to register; you can explore the builder without an account.
We handle enquiries and proportionate security records on the basis of our legitimate interests in answering requests, operating a reliable service and preventing abuse. Where required, we may retain or disclose limited records to meet a legal obligation or establish, exercise or defend legal claims. These purposes are not permission for marketing. No optional analytics or advertising tags are included in this application.
Fantasy scoring is calculated automatically from fictional game records and the published rules. It has no monetary value and is not a decision about credit, employment or another similarly significant real-world matter. We do not sell personal data or use the game for advertising profiles.
What other users can see
Joining the league is optional. While you participate in the public league, your manager name, team name, round and score are public. Leaving from the dashboard hides this entry; its original snapshot remains private until account deletion, and returning republishes the same entry. Your locked lineup is available privately in your dashboard. Email addresses, password hashes and support messages are not included in the public leaderboard. Choose names that do not reveal information you wish to keep private.
Storage, recipients and international processing
The website is hosted by Namecheap on a server in the United Kingdom, as confirmed by the operator. Application records are held in a private SQLite database outside the website root. Access is limited to the application and authorised administration. Service providers supporting hosting, infrastructure security, backups and any configured transactional email can process data needed for those services. Account emails include recipients and single-use security links; contact notifications can include the submitted message and reply address. Public league details are disclosed only through your requested league participation. Information may also be disclosed where legally required.
UK website hosting is not a promise that every provider support operation, mail system, log or backup is located in the UK. The actual email provider and any overseas processing depend on the services configured by the operator. Contact support for the applicable provider locations, retention information and any transfer safeguards or adequacy arrangements. No assertion is made that all processing remains inside the UK.
How long information is kept
- Accounts: while your account remains open. You can delete an ordinary account through the dashboard by confirming your password. This removes the live account, saved team, league entry, email-confirmation record and remaining security tokens. Administrative accounts require operator-managed removal.
- Support cases: 90 days after the administrator closes the case. An open case is kept while it is being handled and should be reviewed rather than left open indefinitely. Reopening an ongoing case cancels its previous countdown; closing it again starts a new 90-day period. Older reviewed cases without a closure date receive a full 90 days from installation of the retention update.
- Security links: email-confirmation links expire after 24 hours and reset links after 30 minutes. Used tokens are removed. Expired token records and expired rate-limit buckets are removed on the next site request.
- Guest lineups and sessions: a requested guest-lineup handoff is valid for up to two hours. Sessions inactive for over two hours are rejected. Browser preference storage remains until you clear it. Hosting session-file cleanup is separate from these validity checks.
Cleanup of application records runs on incoming site requests, not at a guaranteed clock time. If there are no requests, eligible records remain until the next request. Deleting an account does not automatically remove separately submitted support cases: contact support to request that. The live-inbox schedule does not erase copies already sent by email, hosting logs, provider session files or backups. Those copies follow the relevant provider’s operational retention and rotation arrangements and may require separate handling by the operator. Ask support for the arrangements applying to your request. We do not promise a fixed deletion period for provider systems that this application does not control.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your data, or object to processing based on legitimate interests. Contact the controller using the details above and identify the relevant account or message. We may need proportionate checks to protect your information; do not send your password. Rights have legal conditions and exceptions. Requests should normally be answered within one month, subject to the extensions and conditions allowed by law.
You can complain to the UK Information Commissioner’s Office. You may contact us first to seek a resolution, but you do not have to do so before approaching the ICO.
Cookies and updates
See the Cookie policy for session cookies and browser preferences. If processing changes, this notice will be updated and material changes will be brought to users’ attention where required. No marketing consent is inferred from accepting the game terms.