Goalazone is an independent, free fan project. This notice explains what personal data we collect, why, who can see it and how you control it, in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
Who is responsible
The Goalazone team is the personal information controller for the data described here. Questions or requests: [contact email].
What we collect
- Account: your email address and how you sign in (email link, Google or Facebook). If you sign in with Google or Facebook, we only use your name to suggest a display name.
- Profile: display name, jersey colour and number, favourite club and region (all optional except the display name).
- Games: your match predictions and points, your penalty shootout, crossbar challenge and sipa scores, your daily trivia answers (and how long each took), and your Fantasy PFL team name, squads and private leagues (other players see a gameweek's squads once it locks).
- Quests and XP: the days you visit the Plaza, counts of what you do there (ball touches, goals, emotes, chat messages sent, not their text), your quest progress, badges, XP history and the headwear you wear.
- Club houses: the club you pick (that makes you a member, listed on the club page and in its club house), and, if staff make you a club manager, the news posts you write and the club house text you set.
- Sponsor screen: to report to advertisers, the game server counts how many people are in the Plaza while each ad is on the sponsor screen, and clicks on a sponsor's link. Viewers are stored only as a one-way code per ad, never as your name or account, so advertisers see totals only.
- Plaza: your avatar's position, chat messages and emotes are sent live to other players in the room. Chat is not stored, except a message someone reports, which we keep for moderation along with the names of the reporter and the sender.
- Tournaments: which tournaments you register for, your check-in, results, and, for paid entry, the photo of your payment receipt (only you and Goalazone staff can see it).
- Goala Coins: your coin balance and history (what you earned and spent), the items you own and wear, and for coin packs the order and the photo of your payment receipt, which only you and Goalazone staff see. When you treat fans to food (libre), everyone in the Plaza sees your display name and what you bought.
- Shoutouts: your message, the amount you donated and the photo of your payment receipt. The message shows on the Plaza board with your display name; the amount and receipt are seen only by you and Goalazone staff. “Chip in” donations through the QR code don't go through Goalazone at all.
- Advertisers: if you request a sponsor ad, your business name, ad content and image, your sign-in email (so we can arrange payment), and the payment reference you give us. We never handle card details.
- Technical: sign-in cookies, and standard server logs (such as IP address and browser type) kept by our hosting providers for security.
Why we use it
- To run your account and the features you use (sign-in, profile, Plaza, predictions, mini-games).
- To show leaderboards and your avatar to other fans.
- To keep the community safe: handling reports and stopping abuse, spam or cheating.
We don't sell your data or use it for marketing. The Plaza sponsor screen shows the same paid ads to everyone; they aren't targeted and don't track you.
What other people can see
Your display name, jersey colour and number, level, headwear, badges and the club you picked appear in the Plaza, on club pages and on leaderboards. Your predictions become visible to others once a match kicks off. If you play in a tournament, your display name appears in its player list and bracket. Your email is never shown to other fans; only Goalazone admins can see it, to manage accounts.
Services we use
We use trusted providers to host Goalazone. They process data only on our instructions: Supabase (database, sign-in and file storage, Singapore region), Vercel (website hosting) and Fly.io (Plaza game server, Singapore region), plus an email provider to send sign-in links. Some of these may process data outside the Philippines.
Cookies
We only use cookies needed to keep you signed in. There are no advertising or analytics cookies.
How long we keep it
- Your account, profile, predictions and scores: until you delete your account.
- Reported chat messages: until staff handle the report, then 12 months (to spot repeated abuse).
- Chat suspensions: until 30 days after they end.
- Staff activity records: 12 months.
- Ad requests and payment references: as long as we need them for our accounts.
- Tournament entries and results: as long as the tournament is listed. Payment receipts: deleted with the tournament record, within 12 months of the tournament.
- Shoutouts and their receipts: as long as we need them for our accounts (you can ask us to delete yours).
Reports, suspensions and activity records are deleted automatically when their time is up.
Your rights
Under the Data Privacy Act you can:
- Access and download your data: Profile → Your data → Download.
- Correct it: edit your profile at any time.
- Delete it: Profile → Your data → Delete my account removes your profile, predictions and scores permanently.
- Object to processing, or ask any other question: contact [contact email].
- Complain to the National Privacy Commission (privacy.gov.ph) if you think we've mishandled your data.
Children
If you are under 18, please use Goalazone with the permission of a parent or guardian. Parents can contact us to review or delete a child's account.
Security
Connections are encrypted, database access is restricted so each fan can only change their own data, and staff tools require a separate password sign-in. No system is perfectly secure; if we learn of a breach affecting you, we'll notify you and the National Privacy Commission as the law requires.
Changes
If we change this notice, we'll update the date above, and tell signed-in fans about important changes.
See also the Terms of use.