1. What we collect
Account data. Your email address, whether you have verified it, your plan, the date you signed up, and either a password or a Google account identifier. Passwords are stored only as an Argon2id hash — we cannot read your password, and neither can anyone who steals the database.
Session data. When you log in we store a hash of your session token, its expiry, and the browser user agent string, so you can stay signed in and we can show you where your account is open.
Security data. We record failed login attempts along with the IP address or account they came from, so we can block brute-force and credential-stuffing attacks. These records are short-lived and used for nothing else.
Sign-up data. Until you confirm your email, a pending registration holds your address, your password hash and a hashed confirmation code. It is deleted automatically when it expires.
Usage data. Standard server logs, and Google Analytics if you consent to it. We also keep a daily count of which players are searched most — that is a running total per player name, with nothing attached to who searched.
Payment data. None. Our payment provider handles the transaction as merchant of record; card numbers never reach our servers and we never store them.
2. Why we collect it, and on what basis
- To run your account and keep you logged in — necessary to perform our contract with you.
- To take payment and manage your subscription — necessary to perform our contract with you.
- To send account email such as verification and service notices — necessary to perform our contract with you.
- To defend the site against attacks and abuse — our legitimate interest in keeping the service secure.
- To understand how the site is used through analytics — only with your consent, which you can withdraw at any time.
3. Who else sees your data
We do not sell your personal data and we do not share it for advertising. We use a small number of providers to run the service, and each of them only gets what it needs to do its job:
- Google — only if you choose to sign in with Google. We receive your email address and a stable account identifier.
- Resend — delivers our transactional email, and therefore processes your address and the message.
- Google Analytics — usage measurement, loaded only if you accept analytics cookies.
- Cloudflare — sits in front of the site as CDN and protection, so it processes connection data including your IP.
- Our payment provider — handles checkout, billing and tax as merchant of record, under its own privacy policy.
4. How long we keep it
Account data lives as long as your account does. Sessions expire on their own and are deleted. Security records and pending registrations are cleared automatically once they are no longer useful. When you delete your account we remove your personal data, except anything we are legally required to keep — invoicing and tax records, which our payment provider holds under its own obligations.
5. Your rights
You can ask us to show you the personal data we hold about you, correct it, delete it, or export it, and you can withdraw consent for analytics at any time. Write to [email protected] from the address on the account and we will act on it.
If you are in Argentina, the Agencia de Acceso a la Información Pública oversees these rights under Law 25.326. If you are in the EU, the UK or another region with equivalent rules, you keep the rights those rules give you, including the right to complain to your local authority.
6. Where your data is processed
Frelytics runs on servers in Europe and uses providers based in the United States and the European Union. Using the service means your data may be processed in countries other than yours.
7. Children
Frelytics is not for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, tell us and we will delete it.
8. Security, changes and contact
Passwords are hashed with Argon2id, session tokens are stored hashed, the session cookie is HttpOnly and Secure, and the account database is kept separate from the statistics databases so that sharing sports data never means sharing credentials. No system is perfectly safe, and we don't claim otherwise.
If we change this policy we will post the new version here and update the date at the top. Questions or requests: [email protected].