RadarFooty BackAccountRO

Privacy policy

Version 2026-10-22.1

In short

We keep only what an account needs (your email address, display name and your password as a fingerprint nobody can read), we never sell or give your data away, and you can download or delete it at any time from your account page. The details are below.

Who is responsible

  • The data controller is NOCTIUM S.R.L. (CUI 55445022), Craiova, Dolj, 200354. For any question about your data, write to [email protected].

What we store

  • Your account email address and the username you choose (unique, shown on the site instead of your address).
  • When you created the account, when you confirmed your address and when you last signed in.
  • Your password, ONLY as a salted scrypt fingerprint (a one-way transformation): nobody, us included, can read it.
  • If you sign in with Google: your Google account identifier (a number, so we recognise you next time) and the verified email address. We neither ask for nor receive your Google name.
  • Your confirmation that you are at least 18 (the date you ticked it) and the version of this policy you accepted.
  • Your open sessions (created, last used, expiry) and the links we emailed to confirm your address or reset your password (when they were created and used). Links and sessions are stored only as a cryptographic fingerprint (hash), never in plain text.
  • If you have Premium: the date it is valid until.
  • “My teams”, only while you are signed in: the list of teams you follow and the figures from your last visit, so you see the same on your phone and your computer.
  • For each email we send (confirmation, reset, alert): the time, the kind of email, the address domain and a fingerprint of the address (not the address itself), the email provider's answer and its message number, so we can check whether it went out. Without the email's content; deleted after 14 days.
  • The Arena, ONLY if you play (Premium account): your picks by round (the match, the condition, the probability and points fixed when you saved, the result). They are shown publicly ONLY if you tick “Show me in the standings, with my picks”: the community standings then show your username and your totals (points, green, red, last 5 results), and the window that opens when someone taps your name shows your picks from when you save them, before and after kick-off (those with matches not yet started marked “open”, since you can still change them until kick-off), with the result once the matches are over; we keep the date you last changed it, and if you untick it you disappear within an hour. If you delete your account, the picks remain only as anonymous rows (an internal number with no link to your name or address), so the rounds' history stays correct.
  • If you are an Ambassador: the picks you publish (visible to anyone on your page) and the pick in progress, until you publish or clear it — kept on your account so you see the same one on your phone and computer.
  • Not linked to any account: if a page throws an error in your browser, we receive the error message, the file and line in our code, the page and the browser name — WITHOUT your IP address, account or page content — so we can fix the site; deleted after 14 days.
  • Email alerts, ONLY if you turn them on (from your account page or by saving rules from the combined filter): when you turned them on, the saved rule sets, the matches and your teams' runs already announced (so you never get the same notice twice), the date of each email sent and how many lines it had (not its text). The turn-off link in the email is stored only as a fingerprint (hash).

What we do NOT store

  • Your password in plain text: only its fingerprint. If you sign in with Google, we never receive your Google password and have no access to anything else in your Google account.
  • Payment details: there are no payments on the site for now.
  • Advertising or traffic-analytics cookies: the site uses none.
  • Your IP address is not saved in your account. We use it for 15 minutes (at most one hour when accounts are created) only, as a hash, to limit sign-in attempts and link requests.

Why, and on what basis

  • To give you an account and what it includes, Premium included: performance of our contract (GDPR Art. 6(1)(b)).
  • To prevent abuse (password guessing, mass links sent to other people's addresses): our legitimate interest (GDPR Art. 6(1)(f)).
  • Email alerts: your consent (GDPR Art. 6(1)(a)), given when you turn them on; turn them off at any time from your account or with the link in any alert email, no account needed.

How long

  • Your account and its data: for as long as the account exists. When you delete it, the data is removed from the database immediately.
  • Emailed links: valid for 15 minutes, deleted within a day.
  • Sessions: expire after 30 days or when you sign out.

Who we share it with

  • Our email provider (Brevo) receives your address, only to send you confirmation and password-reset links and, if you turned them on, the alerts.
  • Google, ONLY if you choose “Continue with Google”: you ask Google to confirm who you are; we send Google only the confirmation request, not your data from the site.
  • Cloudflare, the network all requests to the site pass through (protection and speed).
  • Hetzner, which hosts the server, in the European Union.
  • We do not sell or give your data to anyone else.

Cookies

  • “rf_sess”, set only after you sign in: strictly necessary to keep you signed in, expires after 30 days and cannot be read by the page's scripts.
  • “rf_oauth”, only during Google sign-in: ties Google's answer to your browser (protection), expires after 10 minutes and is removed right after.
  • “rf_in”, set together with “rf_sess”: it holds only the digit 1, nothing about you; it tells the pages you are signed in so your name can be shown in the header. Removed when you sign out.

Your rights

  • To see and download all your account data: the “Download my data” button on the account page.
  • To delete your account for good: the “Delete account” button on the same page.
  • To correct your data, object to processing or ask us anything: write to [email protected].
  • To complain to your data protection authority (in Romania: ANSPDCP, dataprotection.ro).

Age

  • Accounts are for people aged 18 or over only.