Privacy policy

Last updated: 11 November 2026

Trivia Match FC is a football trivia game at triviamatchfc.com. It is run by Flavr Web Dev Ltd, a company registered in England and Wales (company number 14994358), registered office 161 Cicero Crescent, Milton Keynes, Buckinghamshire, MK11 4DR. We are the data controller. Contact: support@flavrapps.com.

The short version

You can play without an account. We do not ask for your name.
If you sign in, we keep your email address, the nickname you choose and your scores.
We count visitors without cookies and without storing IP addresses.
If adverts are shown, the advertising companies named below may use cookies, and only in the way you agree to in the consent message.
You can delete your account in the game at any time: Account, Delete my account.

What we collect and why

Data	Why we use it	Lawful basis	Kept for
A random device id, made in your browser and kept in its storage	To let you resume a match and to give each device one Daily Match a day	Legitimate interests: running the game fairly	With your matches (below)
Your matches: the questions you were asked, the answers you typed, your score	To run the match, show your result and build the leaderboard	Contract (signed-in players); legitimate interests (guests)	Guest matches: up to 12 months. Signed-in matches: until you delete your account
Email address (only if you sign in)	To send your sign-in code and recognise your account. We send no marketing email	Contract	Until you delete your account
If you sign in with Apple or Google instead of an emailed code: an account identifier from Apple or Google, and your email address. With Apple this may be a private relay address that Apple forwards to you. We don't ask for your name	To sign you in	Contract	Until you delete your account. When you do, we also ask Apple to revoke the game's Sign in with Apple access
Nickname (only if you set one)	Shown on the public leaderboard next to your score	Contract	Until you change it or delete your account
Sign-in codes and sessions, stored as hashes	To sign you in and keep you signed in	Contract	Codes: 10 minutes. Sessions: until you sign out or delete your account
A salted hash of your IP address	To limit abuse (too many requests or sign-in attempts). The IP address itself is not stored	Legitimate interests: security	Up to 2 days in rate-limit records; up to 30 days on a match record, then removed
Counts of your play, per device, account and hashed IP address: Practice matches started, questions served, and how fast and how accurately answers come back	To stop the question bank being copied by automated play: the limits on matches, and the check described under "Checks against automated play"	Legitimate interests: security, and protecting our content	Up to 3 weeks
Purchases (only if you buy something): what you bought, when, and a payment reference	To give you what you paid for, such as no adverts, and to keep tax records	Contract; legal obligation	6 years after the purchase, as tax law requires
If you invite friends or open an invite link: which account invited which, the invite code, when, the device id, a hashed IP address and a hash of your browser's settings	To give the inviting player their reward, and to stop fake referrals	Legitimate interests: running the offer fairly	Until the inviting account is deleted. If the invited friend deletes their account, the record stays without any email address, so one device cannot count twice
Error reports from the game: the error message, the game version and your browser or device type. No account data	To find and fix bugs	Legitimate interests: keeping the game working	Up to 30 days
Emails you send us	To reply and fix problems	Legitimate interests	Up to 2 years

We do not collect your name, date of birth, location or contacts. We do not make decisions about you by automated means that have legal or similar effects.

Visitor statistics

We count how many people visit and how many matches are played. We do this without cookies and without keeping IP addresses:

Each visit adds a scrambled value made from your IP address, your browser's description of itself and a random key that exists for one day only.
When the day ends, the key and the scrambled values are deleted, leaving one number: how many visitors that day.
Nothing links your visits on different days, and the figures cannot be turned back into IP addresses.

We do not use Google Analytics or any other third-party analytics.

Error reports

If the game hits an error, it sends us a short report: the error message, the game version and your browser or device type. It holds no account details. We use it only to fix bugs, and keep it for up to 30 days.

Checks against automated play

When play looks automated (very fast answers, perfect or near-zero accuracy over many questions, or a script instead of a browser), the game may ask for a quick check before the next Practice match, and may pause Practice for a while. The check is Cloudflare Turnstile, run by Cloudflare, Inc. It looks at your browser and connection to tell people from bots, and usually passes without a click. Cloudflare uses that information to provide the check, under its Turnstile privacy addendum. Most players never see it.

Sign-in email

Sign-in codes are sent by Amazon Simple Email Service (Amazon Web Services EMEA SARL), from its London region. Amazon handles your email address and the message on our instructions, to deliver it.

Adverts

The game may show adverts to players who have not paid to remove them. Some are our own or come from sponsors we deal with directly: these are plain images and text, and use no cookies and no tracking.

Other adverts may come from an advertising network. Where we use one, it is one of:

Google (AdSense and ads for games, Google Ireland Limited)
AdinPlay (Venatus Media Limited) or Ezoic, each working with its advertising partners

Before an advertising network sets or reads anything on your device, you are shown a consent message. In the UK, the EEA and Switzerland it lets you agree, refuse or choose in detail, and you can change your mind at any time from the "Privacy and cookie settings" link in the game. If you refuse, you may still see adverts, but they are not based on your profile. If you agree, the network and its partners may use cookies and similar identifiers, your IP address and data about your device to choose and measure adverts. They are independent controllers of that data, and their own privacy policies apply. See our cookie policy for the detail.

Adverts in our iPhone and Android apps come from Google AdMob (Google Ireland Limited). On iPhone, Apple asks your permission before any app tracks you; without it, or if you refuse consent in the app's consent message, adverts are not personalised. On Android, your device's advertising ID is used only as your consent choice allows.

We never give advertisers your email address, nickname or scores.

Payments

Payments on the website are taken by Stripe (Stripe Payments Europe, Limited and Stripe Payments UK Limited). You give your card details to Stripe, not to us: we never see or store your card number. Stripe tells us that a payment succeeded and gives us a reference, your email address and, for sponsors, billing details. Stripe uses its own cookies on its checkout page for fraud prevention. See Stripe's privacy policy.

If you buy in one of our apps, the purchase is handled by Apple or Google, and a service called RevenueCat tells us whether your purchase is active. We receive an anonymous purchase reference, not your payment details.

Who we share data with

We do not sell your data. We share it only with companies that help us run the game, and only what each needs:

Hetzner Online GmbH (Germany): the server the game runs on
Cloudflare, Inc.: domain name service, the network the site is served through, the check against automated play (Turnstile), and encrypted backups
Amazon Web Services: sign-in email
Stripe, and RevenueCat for app purchases: payments
Apple: Sign in with Apple, and purchases in the iPhone app
Google: Sign in with Google, adverts in the apps (AdMob), and purchases in the Android app
The advertising network in use, if any, as described above and subject to your consent choices

We may also disclose data if the law requires it, or to protect the game and its players from fraud or abuse.

Where data is kept

The game's database is kept on a server in Germany, with encrypted backups. Some of the companies above are based in, or may process data in, the United States or other countries outside the UK. Where they do, the transfer is covered by UK adequacy regulations (including the UK-US data bridge) or by standard contractual clauses approved for use in the UK.

Security

Connections to the game are encrypted. There are no passwords to steal: sign-in is by a one-time code sent to your email, and codes and session tokens are stored only as hashes. Access to the server is restricted, and backups are encrypted. No system is perfectly secure; if a breach is likely to put you at risk, we will tell you and the regulator as the law requires.

Children

The game is suitable for a general audience, but accounts are for people aged 13 or over. We do not knowingly keep an account for a child under 13. If you believe a child under 13 has signed in, email support@flavrapps.com and we will delete the account.

Your rights

Under UK data protection law you can ask us to:

give you a copy of your data
correct it
delete it
limit or stop how we use it, including anything we do on the basis of legitimate interests
give it to you in a form you can move elsewhere

Where we rely on consent, such as for advertising cookies, you can withdraw it at any time.

Deleting your account

In the game, open Account and choose "Delete my account". This deletes your account, email address, nickname and sessions straight away, and takes your scores off the leaderboard. If you signed in with Apple, we also ask Apple to revoke the game's access to your Apple Account. Match records are kept without any link to your account. Backups that still hold the deleted data are overwritten within 30 days. If you cannot sign in, email support@flavrapps.com from the address on the account and we will delete it for you. Purchase records are kept for as long as tax law requires.

Guests can remove the device id by clearing this site's data in their browser.

Questions and complaints

Email support@flavrapps.com. We reply within one month. If you are not happy with our answer, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Changes

If we change this policy we will change the date at the top. If a change affects how we use data we already hold about you in an important way, we will tell signed-in players by email or in the game before it takes effect.