Privacy

The short version

If you only read the site: a count of which pages get read, which contains nothing that identifies you and which you can switch off in one click, and your email address if you type it into a form. If you make a Studio account: what you need to use it, which is your sign-in, your profile and the boards you build. If you pay for a plan: your plan and its status, with the payment itself handled by Stripe. There are no advertising trackers and no third-party analytics scripts.

Newsletter email

We store your email address, the page or form you subscribed from, and the date. The source is recorded so we can tell which content is worth writing more of.

A Studio account, and an e-book you buy, also get these emails now and then: coaching tips, new playbooks and what is new in the Studio. We say so where you make the account and where you buy the book. One click on the unsubscribe link in any of them, or a word to us, stops them; your receipts, the books you buy, and your plan and team emails still reach you.

Your Studio account

To use Total Football Studio, on the web or in the iPhone and iPad app, you sign in with your email and a password, with Google, or with Apple. We store your email address, the profile you fill in (the name you sign boards with, your club, kit, crest, handle, bio and links), the boards, sequences and settings you make, and your squad if you save one.

If you buy an e-book without signing in, we use the email you pay with to put the book into the account for that email, and make a free account for it if there is none. That account has no password; you reach it by signing in with Google or Apple on that email, or with a sign-in link we send to it. Ask us and we delete it, like any other account.

Your squad, including any player photographs, is private to your account: the photographs are kept where nobody else can read them, and a face never appears on a board you share or publish unless you switch it on for that board. Your handle, the name and club you sign with, and anything you choose to share or publish are shown to the people you share it with, or publicly if you publish it.

The Mac and Windows app

The desktop app makes a random code for each install, the first time it opens. When you sign in, we store that code against your account with the computer's name, whether it is a Mac or a Windows PC, and when it was added and last used. That is the list under Settings > Computers, where you can remove any computer; on the free plan it is how the app counts its two computers. The code is not taken from your hardware and a reinstall makes a new one. The app writes a small log on your computer to help with support; it stays there unless you send it to us.

Payments

Paid plans are paid through Stripe, on our own checkout page. Your card details go straight to Stripe and never reach our servers. Stripe holds your billing name and address, a company name if you give one, your payment method and your invoices. We keep your Stripe customer and subscription references, your plan, whether it is active, and when it renews, so the Studio knows which tools to open. Stripe also uses payment data to prevent fraud; its own privacy policy covers that.

To keep the free trial to one per person, we keep a fingerprint of the card used to start a trial. It is a code Stripe gives us that identifies the card without revealing its number.

Teams and account emails

The owner of a team plan can invite a coach by email address or handle. We store that address against the seat and send it one email with the invite. If the person already pays for a plan, the owner is shown how many days it has left and what they are worth, because that amount moves to the team when they accept. Account emails, such as a welcome, a team invite or a note that someone joined your team, are sent through ZeptoMail.

Cookies and browser storage

Signing in keeps your session in your browser’s storage, which is what keeps you signed in; the Studio also keeps your work there as you make it. Both are needed for the Studio to work. No other cookie is set.

Referral links. If you arrive through a member’s referral link (an address of the form /@handle), their handle travels in the page address while you browse, and nothing is stored on your device. If you make an account on that visit, we record on the account which member referred you, so they can be credited if you start a paid plan within 12 months. The member never sees your name, email or handle. Your price is the same either way. The lawful basis is our legitimate interest in running the referral programme; you can ask us to remove the record at any time. Visits to a referral link are counted as a daily total per link, with no cookie, address or anything else about the visitor.

The affiliate programme

When someone subscribes through a member’s link, we record that the referral happened, the plan, what the first payment was worth before any tax and the commission. The member who referred you sees a numbered row with those figures; they never see your name, handle, email or account.

To stop commissions being earned by fraud, we keep three signals with each referral: a keyed hash of the IP address used at checkout (the address itself is not stored and cannot be recovered from the hash), the card fingerprint Stripe gives us (a code for the card, never the number), and the domain of the email address when it is a private one, not public webmail. They are compared with the member’s own and with their other referrals, and read by a person before a payout. Nothing is decided automatically. The lawful basis is our legitimate interest in preventing fraud.

If you are a member of the programme, we hold your commissions and payouts to pay you and because tax law requires the records. When automated payouts are switched on, Stripe collects your identity and bank details directly; we never see them.

Analytics, and why there is no cookie banner

We count which pages get read so we know what to write next. The counting uses no cookies and nothing it collects identifies you. You can switch the counting off in one click using Do not count my visit at the bottom of any page, and if your browser sends a Global Privacy Control or Do Not Track signal we obey it automatically without you doing anything.

Each record contains:

• the page you viewed, and how long the tab was actually in front of you
• which links you clicked, where those leave the site or are a call to action
• the website that referred you, as a domain name only
• the channel that brought you, on the first page of a visit only: a campaign tag on our own link, the name of the app whose built-in browser opened the page (such as Instagram), or the fact that you arrived from an advert, never the advert’s own identifier
• the steps you took in the studio and at checkout, such as opening the plans or a payment being declined with the bank’s reason code; never what you built, any amount you typed, your card, name or email
• your country, and whether you are on mobile, tablet or desktop
• a random session identifier, described below

Just as importantly, here is what is not recorded: no cookies of any kind, no IP address, no browser fingerprint, no full user-agent string, no name, and no identifier that survives your visit or follows you to another website.

The session identifier is a random number generated in your browser and held in session storage, which your browser erases when you close the tab. It exists so we can tell that three page views were one visit rather than three people. It cannot be used to recognise you if you come back, and it is never linked to your email address even if you subscribe.

One thing does outlive the visit, and only if you create an account during it: the channel of that visit (for example “instagram” or “google”, the campaign tag if there was one, and the page you arrived on) is saved on your new account, the same way a referral is. It tells us which channels bring coaches who stay, so we can spend less on the ones that do not. It is never shared, the session identifier is not saved with it, it is deleted with your account, and nothing is saved if you opted out of analytics or your browser sends Global Privacy Control or Do Not Track.

Because no cookies are used, no device storage is read for tracking purposes, and no personal data is collected, the lawful basis is our legitimate interest in understanding which articles are worth writing. You can object at any time with the opt-out above. Analytics records are kept for 14 months and then deleted.

Server logs

Our host processes standard server logs (IP address, user agent, requested URL) for security and abuse prevention, on the basis of legitimate interest. Those logs are not combined with your email address or with the analytics described above.

Why, and on what basis

A newsletter email is used to send the newsletter you asked for, and nothing else. The lawful basis is your consent, which you can withdraw at any time. For a Studio account or an e-book buyer who did not subscribe, it is our legitimate interest in telling the coaches who use our products about related ones, and you can object at any time, free, with the same one click. We do not sell, rent or share the list.

Your account, your plan and your payments are processed to provide the Studio you signed up for, which is the performance of our contract with you. Invoices are kept because tax law requires it. A team invite is sent in the legitimate interest of the team owner who asked for it, and preventing repeat free trials is in our legitimate interest in stopping abuse.

Where it is stored

Accounts, boards and subscriber records are held in Supabase (PostgreSQL). The site is hosted by Netlify. Payments are processed by Stripe, and account emails are sent through ZeptoMail. Each may process data outside your country; each operates under standard contractual clauses for transfers out of the EEA and UK.

How long

Newsletter addresses: until you unsubscribe, plus a short period to honour the unsubscribe. Every newsletter carries a one-click unsubscribe link. Your account and everything in it: until you ask us to delete it. Invoices and payment records, and the referral and payout records of the affiliate programme: for as long as tax law requires, even after an account is deleted. The fraud signals on a referral are deleted with the referral.

Your rights

You can ask for a copy of what we hold about you, have it corrected, or have it deleted outright. Write to the address below and we will action it. If you are in the EEA or UK you also have the right to complain to your data protection authority.

Who runs this site

Total Football is operated by NAURRA AI LTD, a company registered in Cyprus, number HE 493756, at 10 Kyriakou Matsi, LILIANA COURT, 4th Floor, Nicosia 1082, Cyprus. NAURRA AI LTD is the data controller for everything described above.

Contact

For anything on this page, including access and deletion requests, email totalfootball@naurra.ai.