Legal

Privacy Policy

Last updated: 3 September 2026

This policy explains what personal data Punter League (“we”, “us”) collects, why, and what rights you have. It applies to punterleague.gg. We handle personal data in line with Singapore’s Personal Data Protection Act 2012 (PDPA); if you are in the UK or EEA, we also aim to meet the standards of the UK/EU GDPR.

Operator: Punter League, Singapore. Data‑protection contact: support@punterleague.gg.

1. What we collect

You give us:

Account details — username, email address, country, chosen language, and a password (stored only as a secure hash, never in plain text).
Support messages — anything you send to support@punterleague.gg.

Created as you play:

Game data — your predictions, points, and leaderboard position.

Collected automatically:

Technical data — IP address, browser and device type, pages viewed, referring page, and timestamps, kept in server logs to run the site, keep it secure, and prevent abuse.
Security data — records of failed sign‑in attempts and blocked IP addresses, used to stop brute‑force attacks.
Cookies — see section 4.

From third parties:

Google reCAPTCHA runs on the sign‑up and login forms to tell humans from bots. Google receives your IP address and interaction data and uses it under Google’s Privacy Policy. We only see a pass/fail result.
Google Analytics — only if you accept analytics cookies (section 4).

We do not collect payment information (the game is free), and we do not knowingly collect data from anyone under 18.

2. Why we use it, and our legal basis

Purpose	Data	Basis (PDPA / GDPR)
Create and run your account; score predictions; show the leaderboard	Account + game data	Performance of our agreement with you / consent
Send the email‑verification link (and, in future, password‑reset emails)	Email address	Performance of our agreement with you
Keep the site secure and prevent abuse (reCAPTCHA, rate limiting, IP logging, blocking disposable email domains)	Technical + security data	Our legitimate interests in protecting the service
Understand how the site is used so we can improve it	Analytics data	Your consent (analytics cookies)
Comply with the law and enforce our Terms	Any of the above	Legal obligation / legitimate interests

3. Who we share it with

We do not sell your personal data or share it for advertising. We pass it only to a small number of trusted companies that help us run the site, and only so they can do that job:

Amazon Web Services — hosts the site and sends your account emails, such as the verification link.
Google — checks that sign‑ups and logins are real people and not bots (reCAPTCHA); and, only if you accept analytics cookies, provides anonymised visitor statistics (Google Analytics).
Porkbun — forwards any email you send to support@punterleague.gg into our inbox.
Bunny — delivers the site’s fonts. It does not set cookies or track visitors.

These companies act on our instructions and may not use your data for their own purposes. Some of them process data outside Singapore — see section 5. We get football fixtures and results from football‑data.org, and never send them any of your data.

We may also disclose data if the law requires it, or to enforce our Terms or protect people’s safety.

4. Cookies

Essential (always on — the site does not work without them):

session cookie — keeps you logged in;
CSRF token — protects forms from cross‑site attacks;
locale — remembers your language choice.

Analytics (off until you agree via the cookie banner):

Google Analytics 4 cookies (for example _ga, _ga_*) — measure page views and traffic sources so we can improve the site. IP addresses are anonymised, and we use Google Consent Mode, so no analytics cookies are set until you accept.

You can change your choice any time with the “Cookie settings” link in the site footer, or by clearing cookies in your browser.

5. International transfers

Your data may be processed outside your country — for example on AWS servers in Singapore and by Google in the United States. Where data leaves Singapore we take the steps required by the PDPA to ensure a comparable standard of protection; for UK/EEA users, our providers rely on mechanisms such as the EU Standard Contractual Clauses.

6. How long we keep it

Account and game data — for as long as your account exists, and up to 90 days after you ask us to delete it, then permanently removed or anonymised.
Server logs — typically up to 90 days.
Sign‑in security logs — pruned automatically once no longer needed for abuse prevention.
Google Analytics — per Google’s retention settings; we use the shortest practical option.

7. Your rights

Under the PDPA you can ask us to:

give you a copy of the personal data we hold about you, and how it has been used;
correct data that is inaccurate or incomplete;
withdraw consent to any processing based on consent (for example analytics).

If the UK/EU GDPR applies to you, you also have rights to erasure, restriction, portability, and to object to certain processing, and you can complain to your local data‑protection authority.

To exercise any of these, email support@punterleague.gg from the address on your account. We do not yet offer self‑service account deletion — email us and we will delete your account and personal data (past predictions may be retained only in anonymised, aggregated form that cannot identify you).

8. Security

We protect your data with HTTPS encryption, hashed passwords, bot protection, rate limiting, blocked‑IP controls, and restricted access. No online service is completely secure, so we cannot guarantee absolute security, but we take it seriously and will notify you and the relevant authority of a data breach where the law requires.

9. Children

Punter League is not intended for people under 18. If you believe a child has given us personal data, contact support@punterleague.gg and we will delete it.

10. Changes to this policy

We may update this policy. Material changes will be posted here with a new “Last updated” date; where required we will also notify you.

11. Contact

Questions or requests: support@punterleague.gg