Privacy Policy
Last updated: 27 September 2026
This Privacy Policy explains how personal data is collected and used when you play Matchday, visit matchday-manager.app, or buy a Manager+ subscription or MD Coins. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
1. Who we are
Matchday is operated by Moneberge OÜ, a private limited company registered in Estonia, which is the controller of your personal data.
- Registry code: 14716340
- Registered address: Andrekse tee 41-2, Tallinn, Estonia
- Privacy contact: privacy@matchday.fm
We have not appointed a Data Protection Officer, as we are not required to. All privacy questions and requests go to the address above.
2. What data we collect
2.1 Data you give us
- Account data: email address, username or manager name, and a password (stored only as a secure hash) or the identifier from a sign-in provider you choose.
- Game data: your clubs, squads, tactics, careers, match results, trophies, MD Coins, in-game messages and settings.
- Support messages: anything you send us by email or through the game.
2.2 Data created when you pay
Payments are processed by Stripe. We never see or store your full card number. We receive and keep:
- a Stripe customer ID and subscription ID;
- subscription status, plan, renewal and cancellation dates;
- purchase history (amounts, currency, dates, items bought);
- billing country and, where needed, postal code, plus the tax evidence required to charge the correct VAT (see section 2.3);
- card brand, last four digits and expiry date, as shown to you in the billing portal.
2.3 Data collected automatically
- Technical data: IP address, browser and device type, operating system, language, and timestamps, kept in server and security logs.
- Approximate location: country or region derived from your IP address, used to show correct prices, apply the right VAT rate, and keep tax evidence as required by EU VAT rules. We do not collect precise (GPS) location.
- Usage analytics (only with your consent): pages and screens viewed, features used, session length and similar interaction data, collected through Google Analytics. See section 7.
2.4 Data other players can see
In multiplayer mode and in public competitions, your manager name, club name, crest, results, rankings and any public profile details are visible to other players. Do not use your real name as your manager name if you do not want it shown.
3. Why we use your data and our legal basis
| Purpose | What it involves | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the game | Creating your account, saving progress, running matches and competitions, showing your club to other players | Contract (6(1)(b)) |
| Payments and subscriptions | Processing Manager+ subscriptions and MD Coin purchases, managing renewals, refunds and entitlements | Contract (6(1)(b)) |
| Tax and accounting | Determining VAT, issuing invoices and receipts, keeping accounting and VAT records | Legal obligation (6(1)(c)) |
| Service messages | Account, security, billing and important service emails | Contract (6(1)(b)) |
| Security and fair play | Preventing fraud, abuse, cheating and multiple-account exploits; protecting accounts and systems | Legitimate interests (6(1)(f)) |
| Support | Answering your questions and handling complaints | Contract or legitimate interests |
| Analytics | Understanding how the game is used so we can improve it | Consent (6(1)(a)) |
| Product news (optional) | Occasional emails about new features and offers | Consent (6(1)(a)); you can unsubscribe any time |
| Legal claims | Establishing, exercising or defending legal claims | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and you can object at any time (section 9). Where we rely on consent, you can withdraw it at any time without affecting processing done before withdrawal.
We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.
4. Who we share data with
We use a small number of service providers. They process data on our instructions under data processing agreements, except where noted.
| Provider | Role | Location and safeguards |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Payment processing, subscription billing, customer portal, VAT calculation (Stripe Tax). Stripe also acts as an independent controller for fraud prevention and its own legal obligations, under the Stripe Privacy Policy. | EU; transfers to Stripe, Inc. (USA) under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited | Google Analytics 4 usage analytics (only with your consent) | EU; transfers to Google LLC (USA) under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Meta Platforms Ireland Limited | Meta Pixel: measuring visits, sign-ups and purchases (amount and currency) that come from our Facebook and Instagram ads (only with your marketing consent) | EU; transfers to Meta Platforms, Inc. (USA) under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited | Google Ads tag: measuring visits, sign-ups and purchases that come from our Google ads (only with your marketing consent) | EU; transfers to Google LLC (USA) under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Supabase, Inc. | Database, authentication, file storage and backend hosting | Data hosted in EU (Ireland); Standard Contractual Clauses for any access from outside the EEA |
| Lovable (app hosting, delivered via Cloudflare's global network) | Hosting and delivery of the web app | Global edge network with EU locations; Standard Contractual Clauses for transfers outside the EEA |
| Supabase Auth email service | Sending account and service emails (sign-up confirmation, password reset) | Data hosted in EU (Ireland); Standard Contractual Clauses for any access from outside the EEA |
We may also disclose data to professional advisers (accountants, lawyers) under confidentiality, to authorities where required by law, or to a buyer or successor if the business is sold or reorganised, in which case this policy continues to apply.
5. International transfers
We aim to keep your data in the European Economic Area. Where a provider transfers data outside the EEA, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework for certified US companies) or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account and game data | While your account is active. Deleted within 30 days after you delete your account, except backups, which are overwritten within a further 30 days. |
| Inactive accounts | If you have not signed in for 24 months, we may delete the account after emailing you a warning at least 30 days in advance. |
| Invoices and credit notes | We email an invoice for every purchase and keep invoices (your name, email, country, item and amount) for 7 years, as Estonian accounting law requires, even after account deletion. |
| Payment, invoice and accounting records | 7 years from the end of the financial year, as required by the Estonian Accounting Act. |
| VAT evidence for digital services (including location data used to determine VAT) | 10 years from the end of the year of the transaction, as required by EU VAT rules for the One-Stop-Shop scheme. |
| Google Analytics data | 14 months, after which it is automatically deleted by Google. |
| Server and security logs | Up to 90 days, longer only if needed to investigate a specific security incident. |
| Support correspondence | Up to 3 years after the matter is closed. |
| Marketing consent records | For as long as you are subscribed, plus 3 years as proof of consent. |
7. Cookies and similar technologies
We use browser storage and cookies. Strictly necessary items are always on. Analytics is used only if you accept it in the consent banner, and you can change your choice at any time via the "Manage cookie preferences" button below.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| Authentication session (browser local storage) | Matchday / Supabase | Keeps you signed in; strictly necessary | Until you sign out or the session expires |
| Consent preference | Matchday | Remembers your cookie choice; strictly necessary | 12 months |
| _ga | Google Analytics | Distinguishes users (analytics, consent required) | Up to 2 years |
| _ga_<container-id> | Google Analytics | Maintains session state (analytics, consent required) | Up to 2 years |
| _fbp | Meta | Measures visits from Facebook/Instagram ads (marketing, consent required) | Up to 3 months |
| _fbc | Meta | Stores the ad click identifier when you arrive from a Meta ad (marketing, consent required) | Up to 3 months |
| _gcl_au | Google Ads | Stores the ad click identifier when you arrive from a Google ad (marketing, consent required) | Up to 3 months |
| Stripe cookies (e.g. __stripe_mid, __stripe_sid) | Stripe | Fraud prevention during checkout; strictly necessary for payment | Up to 1 year |
We use Google Analytics with IP data handling as configured by Google Analytics 4, without Google Signals or advertising features, and we do not use analytics data to show you ads. Until you consent, Google Analytics tags are not loaded. With your separate marketing consent we also load the Meta Pixel and the Google Ads tag, which send Meta and Google the pages you visit, when you sign up or buy (with the amount paid), your browser details and IP address to measure our Facebook, Instagram and Google ads. They are not loaded unless you accept marketing cookies, and you can withdraw at any time below.
8. Children
Matchday is not directed at children under 13, and you must be at least 13 to create an account. If you are under the age at which you can consent to data processing yourself in your country (between 13 and 16 in EU member states), you may only use the features that rely on consent with permission from a parent or guardian.
You must be 18 or have a parent's or guardian's permission to make purchases. If we learn that we have collected data from a child below the permitted age without the required consent, we will delete it. Parents can contact privacy@matchday.fm.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten"), subject to legal retention duties such as accounting and VAT records;
- restrict processing in certain circumstances;
- data portability, receiving data you gave us in a structured, machine-readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, for example for analytics or marketing emails.
You can request deletion of your account and personal data by emailing privacy@matchday.fm — we delete it within 30 days — and manage your subscription and payment details in the Stripe customer portal linked from the game. For anything else, email us at the same address. We respond within one month; this may be extended by two further months for complex requests, in which case we will tell you. We may ask you to confirm your identity before acting on a request.
Right to complain
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, info@aki.ee, or to the data protection authority in the EU country where you live or work. We would appreciate the chance to address your concern first.
10. Security
We protect data with encryption in transit (HTTPS/TLS), encryption at rest provided by our hosting providers, hashed passwords, row-level access controls in the database, least-privilege access for administration, and regular backups. No system is perfectly secure; if a breach affects your data and poses a high risk to you, we will inform you without undue delay, and we will notify the supervisory authority where required.
11. Changes to this policy
We will update this policy when the game or our providers change, for example if we add in-app advertising or release native mobile apps. The "Last updated" date shows the current version. For material changes we will notify you in the game or by email before they take effect.
12. Contact
Moneberge OÜ
Andrekse tee 41-2, Tallinn, Estonia
privacy@matchday.fm