Privacy Policy — thefinal

Who we are

The controller of your personal data is True Growth OÜ, a company registered in Estonia under registry code 16504010, at Pae tn 25-47, 11414 Tallinn, Harju maakond, Estonia. Full details are on the legal notice page.

For anything in this policy — questions, requests, complaints — write to [email protected]. That single address reaches us for every kind of request; there is no separate queue to find.

We have not appointed a Data Protection Officer, and are not required to: we do not carry out large-scale systematic monitoring, and we process no special categories of data. We also need no EU representative under Article 27 — the controller is itself established in the EU.

What we collect, and why we may

Four groups, nothing else. Each is listed with the legal ground we rely on under Article 6 of the GDPR, because a purpose without a ground is just a preference.

What	Why	Legal ground
Account Email address, password, display name, your age declaration, and which revision of the Terms you accepted and when. If you sign in with Google instead of a password, we receive from your Google account its email address, name, profile-photo address and Google account identifier — the game itself uses only the email address, but Firebase Authentication stores them all.	To create and hold your account, to show your display name on leaderboards, where other signed-in players can see it, and to prove you were told the terms you agreed to.	Performance of a contract — Art. 6(1)(b). Without it there is no account.
Game Your Predictions and Live Moment answers, your Score and Rating, your Followed Club, your leaderboard positions.	To run the game: to resolve Predictions against real match events and rank you. The short code of the club you follow is shown next to your display name on leaderboards, so other signed-in players can see which club you follow. Everything else here is shown only to you.	Performance of a contract — Art. 6(1)(b). This is the service.
Technical IP address, browser and device type, the pages and API paths you requested, timestamps, and error reports when something crashes (which include your account identifier so we can tell one player's broken session from a site-wide outage).	To keep the service up, find and fix faults, and detect abuse such as automated play or multiple accounts.	Legitimate interests — Art. 6(1)(f): operating and securing a service you asked to use. You can object; see your rights.
Analytics Google Analytics 4 events — which pages and screens you open on this site and in the game alike, and in the game also which steps you take: signing up (and whether by password or Google), verifying your email, choosing a club (which club, and whether it is your first or a change), submitting a Prediction Card (which fixture, how many of its questions you answered, whether all of them, how many carry Bold, whether it replaces an earlier card, and whether the fixture was still to come or already live) and making a Live Moment (which fixture, which question, and whether it is Bold); plus two one-off milestones, your first Prediction Card (which fixture, and whether it was still to come or already live) and the first card you make on a later day (which fixture). What you actually predicted — the scoreline, the scorer, the minute — is never sent. To state the two milestones only once, we keep the time of each on your player record in our own database, written only if you have allowed measurement. Firebase Performance Monitoring, which times how fast things load, runs in the game only. In the game both are tied to your account identifier; this site has no account to tie anything to.	To understand which parts of the site and the game are used and where they are slow.	Your consent — Art. 6(1)(a), the same switch as the next row. Nothing here runs until you say yes, and you may withdraw at any time.
Ad measurement (since September 2026) If you arrived from a Google advert we bought for thefinal, the identifier of that click is kept in a cookie on whichever of our two sites you are on. When you then sign up, make your first Prediction Card or come back for another, we pass that milestone to Google Ads together with the click identifier. Google Ads receives the milestone and the click — never your name, email or predictions. We have told Google not to use any of this to personalise adverts, and we show no adverts ourselves.	To see which of the adverts we buy for thefinal bring players who actually play.	Your consent — Art. 6(1)(a), the same switch as the row above: "analytics and ad measurement" is one yes or one no.

We never ask for and never store payment details, because there is nothing to pay for. We show no adverts inside thefinal and never build an advertising profile of you. We do buy adverts for thefinal elsewhere and, only with your consent, measure whether they worked — that is the whole of our advertising. We do not sell or rent personal data to anyone.

Match data — fixtures, line-ups, goals, cards — comes from a sports data provider and is about football, not about you. Nothing about you is ever sent to them.

Cookies & device storage

We store a small amount of data on your device. Some of it is unavoidable — your sign-in token, your saved profile, the offline cache that lets the game work on a weak connection — and it is there whatever you choose. Analytics storage is not, and it only appears if you allow it.

The full list, item by item, is on the Cookie Policy page, along with the control to change your mind.

Who processes it besides us

We run on Google Cloud and Firebase. That means Google processes your data on our instructions, under Google's data processing terms — it does not get to use it for its own purposes. There is one exception, and it is named as such in the table: the ad-measurement signals we pass to Google Ads, which Google handles as a controller in its own right.

Processor or recipient	What it handles
Google Cloud / Firebase Google Ireland Limited & Google Cloud EMEA Limited	Firebase Authentication (your email and password, or your Google sign-in), Cloud Firestore (your account and game data), Cloud Run (serving the site and API), Cloud Logging (technical logs), Error Reporting (crash reports).
Google Analytics 4 & Firebase Performance Google Ireland Limited	Analytics events — only with your consent.
Google Ads Google Ireland Limited	The advertising milestones — that a click on one of our adverts led to a sign-up, a first Prediction Card or a return — with the click identifier, only with your consent. Google Ads is the one recipient that is not a mere processor: for these signals Google acts as an independent controller under its Google Ads data protection terms, which is why it is listed on its own line and why the switch that covers it is yours.
Cloudflare Cloudflare, Inc.	Delivers and protects both sites. Every request passes through Cloudflare before it reaches us, so it handles your IP address, the page you asked for and your browser's user agent — this is how the site is served to you and it is not optional. Separately, only with your consent, Cloudflare Web Analytics measures page performance; it sets nothing on your device and does not profile you across sites.
Google reCAPTCHA Enterprise Google Ireland Limited	Checks that requests to the game come from the real app rather than an automated script, so that nobody can run up our costs or scrape other players' scores. It runs on every visit and is not covered by the measurement switch, because switching it off would leave the service undefended — see necessary cookies.

If we ever add a processor we will list it here before it starts processing anything, and if it involves a new category of data or a new purpose we will tell you directly rather than quietly editing this table.

Where your data is held

In the European Union. Our servers run in Google's Belgium region (europe-west1) and the database is in Google's multi-region European location (eur3). We did not pick those by accident and we do not move them casually — the database location, in particular, is permanent once chosen.

One exception, and only if you consent to analytics: Google Analytics may transfer some data to the United States. Google relies on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses for those transfers. Decline analytics and this does not apply to you at all.

A second qualification, and this one applies to everybody: since 4 August 2026 both sites are served through Cloudflare, whose network is global. Your request is handled by whichever Cloudflare location is nearest you, which may be outside the EU, and Cloudflare is a US company. Cloudflare relies on the EU–US Data Privacy Framework and on standard contractual clauses. What reaches Cloudflare is the request itself — your IP address, the address you asked for, your user agent — not your account or game data, which stay in the European locations named above.

How long we keep it

Concrete periods, not "as long as necessary":

Account and game data — for as long as your account exists. When you ask us to delete it, we do so within 30 days. One record is the exception, and it is the next line.
Record of a deletion — when we erase an account we keep a single record of it: your account identifier and the date you asked. We keep it for as long as the service runs, because it is what stops the deletion being undone — signing in again would otherwise re-create the account we had just erased. It holds nothing else about you, no name, no address, no game history, and nothing reads it except the check that refuses to bring the account back.
Dormant accounts — deleted after 24 months with no sign-in. We will email you before that happens.
Technical logs and error reports — 30 days, then discarded automatically.
Analytics and ad measurement — 14 months in Google Analytics, then deleted by Google; the click cookie lasts 90 days on your device; conversion signals passed to Google Ads are kept by Google under its own terms. The two milestone timestamps on your player record stay as long as your account does, and we delete them earlier on request if you withdraw consent.
Consent record — 12 months on your device, then we ask again.

Your rights

Under the GDPR you may ask us to:

Show you what we hold about you, and a copy of it (Art. 15).
Correct anything wrong (Art. 16).
Delete your account and data (Art. 17).
Export your data in a machine-readable form (Art. 20).
Restrict what we do with it while a dispute is resolved (Art. 18).
Object to processing we base on legitimate interests (Art. 21).
Withdraw consent to analytics and ad measurement, at any time — for this site from the Cookie Policy page, for the game from the switch on your profile page. Withdrawing does not undo what was lawfully collected before.

Email [email protected] from the address on your account. We reply within one month, as Article 12(3) requires; if a request is genuinely complex we may take longer and will tell you why within that first month. We do not charge for this.

If you think we have handled your data badly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live. We would rather you told us first, but that is your choice, not a precondition.

US state privacy rights

If you live in California or another US state with a comprehensive privacy law, you have rights to know what we collect, to delete it, to correct it, and not to be treated worse for exercising them. Use the same address: [email protected].

We do not sell personal information. With your consent we pass the advertising milestones described above to Google Ads so that we can measure our own adverts; we do not target you with adverts and we do not disclose your information for cross-context behavioural advertising as the CCPA/CPRA defines it. Declining or withdrawing the measurement switch — on the Cookie Policy page for this site, on your profile page in the game — stops any further passing; what Google already received is held under its own terms and we cannot recall it. That switch is the opt-out. We do not process sensitive personal information for inferring characteristics.

Children

thefinal is for people aged 16 and over. You confirm your age when you register. We do not knowingly collect data from anyone younger, and if we find out we have, we delete the account and its data.

If you are a parent or guardian and believe your child has registered, write to [email protected] and we will remove it.

Images of footballers

This policy is about your data. One kind of personal data on thefinal is not yours, and it is fairer to say so here than to leave it out: the site shows photographs of professional footballers, alongside their names and shirt numbers, on squad lists and prediction screens.

The photographs come through our football data provider, SportMonks. We import them, re-encode them — which discards any camera or location information the original file carried — and serve them from our own domain, so your browser never contacts the provider and the provider learns nothing about you. We show a player's name, shirt number and picture and nothing else about them. We do not analyse faces, match people between images, or infer anything from a photograph.

We do not import photographs of players our provider reports as under 18. Where no date of birth is given we cannot make that check, which is one of the reasons the channel below exists.

Any player, or anyone acting for them, can have their photograph removed — without giving a reason and without proving anything. So can any club or competition whose crest or logo we show. Write to [email protected]; the full procedure, including how quickly we act, is on the image rights & takedown page.

Security

Traffic is encrypted in transit (HTTPS everywhere) and data is encrypted at rest by Google Cloud. Passwords are handled by Firebase Authentication and stored hashed — we never see your password and cannot recover it for you; we can only help you reset it.

Access to production data is limited to what the services themselves need. No system is perfect, and we will not pretend otherwise: if a breach occurs that is likely to put your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours and tell you directly when the law requires it.

Changes to this policy

When we change this page we bump the version at the top and record what changed in the changelog below. Small changes — clearer wording, a new processor doing something we already disclosed — move the minor number and take effect when published.

Substantive changes — a new category of data, a new purpose, a new legal ground, a transfer somewhere new, or anything that reduces your rights — move the major number, and we tell you before they take effect rather than after.

Changelog

Version	Date	What changed
`4.1`	2026-09-19	The site started showing club crests, competition logos and photographs of footballers. Nothing about your data changed — no new collection, no new recipient, no new cookie, and the images are served from our own domain so no third party sees your browser. Added a section saying what we do with footballers' photographs, and a new image rights & takedown page with an address that reaches us quickly.
`4.0`	2026-09-10	We started buying adverts for thefinal and measuring whether they work — a new purpose and a new recipient, hence a major revision. The one measurement switch now covers ad measurement as well as analytics: with your yes, the identifier of the advert click that brought you here is kept in a cookie, and your sign-up, first Prediction Card and first return are passed to Google Ads with it. Google Ads is listed as a recipient in its own right. No adverts are shown inside thefinal, no advertising profile is built, and Google is told not to personalise. Everyone is asked again, because a "yes" to analytics alone did not cover this. The game gains a switch on the profile page, so an answer given there can be changed there.
`3.2`	2026-09-08	Added two one-off milestone events to the analytics list: your first Prediction Card, and the first card you make on a later day. To state each only once, your player record keeps the time of both — written only if you have allowed analytics, so nothing is kept for anyone who declined. Same processor, purpose and consent switch as every other analytics event; withdrawing consent stops the events, and the two timestamps stay only so that allowing analytics again does not count you twice.
`3.1`	2026-09-08	From this date the game's analytics events describe game steps as well as screens: sign-up and its method, email verification, choosing a club, submitting a Prediction Card and making a Live Moment — each with the fixture, club or question it concerns, as listed in full in the table above. What you predicted is never sent. Same processor, same purpose, same consent switch: nothing analytical runs until you allow it, and withdrawing stops it.
`3.0`	2026-09-06	Said plainly what happens after we delete an account: we keep one record of the deletion — your account identifier and the date you asked — for as long as the service runs, because without it signing in again would re-create the account we had just erased. This is not new behaviour being introduced, it is behaviour that the previous revision's flat "deleted within 30 days" did not qualify. Nothing new is collected, and the record holds nothing beyond those two fields.
`2.4`	2026-08-27	Leaderboards now show your display name and the short code of the club you follow instead of an anonymous handle, so other signed-in players can see both. Nothing new is collected, and leaderboards are not readable without signing in.
`2.3`	2026-08-07	Turned Google Analytics on for this marketing site, which until now measured nothing at all. It is the same measurement already used inside the game, so arriving here and then playing counts as one visit rather than two — and it still runs only if you allow analytics. Nothing new is collected in the game, and this site has no account to link anything to. Because any answer you gave here was given while nothing was running, answers recorded before today no longer count on either site and we will ask you once more.
`2.2`	2026-08-07	Removed the Prediction Point balance and spending history from the game data we hold: the currency was removed from the game itself, and the remaining historical balance records are being deleted. Nothing new is collected.
`2.1`	2026-08-05	Added sign-in with Google as an alternative to a password, and listed what it brings: the email address, name, profile-photo address and account identifier from your Google account. Same purpose, same legal ground, same retention as the rest of your account data.
`2.0`	2026-08-04	Added Cloudflare, which from this date serves and protects both sites — so it handles every request, including your IP address, and its network is global. Added Cloudflare Web Analytics, which runs only if you allow analytics. Added Google reCAPTCHA Enterprise, which checks that requests come from the real app. Recorded the transfer position for Cloudflare alongside the existing one for Google Analytics.
`1.0`	2026-07-29	First published.