Legal & Privacy Center
The Gaffer's Ledger — Terms of Service, Privacy Policy, & Fair Play Disclaimers
Privacy Policy & Data Transparency
Effective Date: August 10, 2026
We believe in complete transparency regarding the information collected when you use The Gaffer's Ledger. Below is an exhaustive breakdown of what data we capture, why we need it, and how your privacy is protected under data privacy standards (including GDPR, CCPA, and UK Data Protection Act guidelines).
When signing in with Google, we request basic profile permissions: Email Address, Display Name, Profile Photo URL, and unique Google ID.
When signing in with Discord, we request basic identity permissions: Email Address, Discord Username, Avatar URL, and unique Discord ID.
When using passwordless email sign-in, we collect only your Email Address to dispatch a secure one-time magic link token via Supabase Auth.
We store your chosen manager handle, club allegiance, card collection, coin balance, auction bids, matchday predictions, and career mode progress to persist your game state.
Zero Password Storage
We NEVER ask for, receive, handle, or store passwords. Authentication is powered entirely by Supabase Auth using industry-standard OAuth 2.0 or passwordless magic link email tokens.
Cookies & Essential Sessions
We use strictly essential HTTP-only authentication cookies and session tokens provided by Supabase Auth necessary to maintain your signed-in state across pages. We do NOT use third-party advertising cookies, cross-site tracking pixels, or commercial marketing trackers.
Zero Third-Party Data Selling
We do NOT sell, rent, trade, or monetize your personal data. Your information is never shared with third-party advertisers, data brokers, or marketing platforms. All user data resides securely in PostgreSQL databases managed by Supabase on Vercel and AWS infrastructure.
User Rights & Right to Erasure
You retain full rights over your personal data under applicable data protection laws. You may request a complete export of your account data or request permanent deletion of your account (Right to Erasure / Right to be Forgotten) at any time via your Profile Page or by contacting developer support.