This is a draft policy for an independent concept build of a fantasy game on the A-League Men. It describes what the game collects, why, and who can see it. A public launch would need a policy prepared by the operator for its own jurisdiction; nothing here is legal advice.

Your email address and a display name. A password, stored only as a one-way hash and never in a form anyone can read. Your team's name and badge, your favourite club and country if you choose them, your squads, transfers, chips and captains, the leagues you create or join, players you watch or keep notes on, and anything you send us through Contact or Report a name.

We receive your name, your email address, whether the provider has confirmed that address, and an identifier the provider gives us for your account. We use them to create or find your account and nothing else. We never receive your password for that service, and we do not keep the provider's access token, so the game cannot post, read your contacts or act on that account in any way.

A session when you sign in, so you stay signed in (for 30 days, or until you sign out). Failed sign-in attempts against an email address, kept for 15 minutes to slow down guessing. The emails we send you — address confirmation, password resets, and deadline reminders if you turn them on — and when we sent them.

Only what the game needs to work: a session cookie that keeps you signed in, short-lived cookies that carry an invite link or a Google or Facebook sign-in across the few screens it takes, and ones that remember how you like to view your team (pitch or list, and the overlay). There are no advertising or tracking cookies, and no analytics.

Other managers see your display name, your team's name and badge, its points and rank in the leagues you share, and your team for every gameweek whose deadline has passed — never your selections for the coming gameweek before its deadline. League standings and teams can be opened by anyone with the link. Your email address is never shown to other managers.

The game runs on Vercel (hosting) with its database on Neon, both in Sydney, Australia. Emails are sent through Resend. If you sign in with Google or Facebook, that service handles the sign-in under its own policy. We do not sell your information or share it with anyone else, and we do not use it for advertising.

For as long as you have an account. While the game is a concept the season may be reset, which can remove teams and leagues.

You can change your name, team details, email address, password and email preferences on Team Details at any time. To see what we hold about you, or to have it corrected, write to us. You can delete your account and everything tied to it from Team Details at any time; see Deleting your data.

hello@statted.co. Signed in, you can also use Contact.