Privacy policy

Who is responsible

The controller is Zoran Radojević, Luxembourg, who runs HandHub Stats. Contact for everything about your data: stats@handhub.eu.

Your account

Your e-mail address; your password, which Supabase Auth keeps only as a one-way hash (nobody can read it back); when you signed up, activated the account and last signed in.

Why: to run the account you asked for (Article 6(1)(b) GDPR).

Your devices

For every browser you sign in with: the name of the browser and the operating system, when it was first and last used, and the session that keeps it signed in. Supabase Auth also records the browser string of each session and the IP address the sign-in came from, which is our hosting server’s, not yours.

To slow down password guessing and misuse of our e-mails, every sign-in, sign-up, password check, second-factor code and link request is counted for one day under a keyed one-way hash of your IP address and of the e-mail address or account, which cannot be turned back into either. Your IP address is also passed on to Supabase Auth for its own limits.

Why: the limit of 3 devices, the list of devices in "My account", and keeping accounts safe (Article 6(1)(b) and (f) GDPR).

Your access and codes

The periods of your access (free trial, codes, extensions by us), the codes you used, and failed code attempts (deleted after one day by a nightly clean-up, to stop guessing).

Why: to give you the access you are entitled to and to prevent abuse (Article 6(1)(b) and (f) GDPR).

Scout

If your account has Premium and you use Scout: the players on your watchlist, your notes on players, the clubs you chose and the player searches you saved. Only you can read them; we look at them only to fix a fault you report to us.

Why: to run the feature you use (Article 6(1)(b) GDPR). They are deleted with the account.

After an account is deleted

You can delete your account yourself in "My account", confirmed with your password, or ask us at stats@handhub.eu. We keep an account until it is deleted.

Everything above is deleted with the account, except a one-way hash (SHA-256) of the e-mail address that only records that its free trial was used, so the trial is given once per address (Article 6(1)(f) GDPR). When we sign a device out, its random session number and the reason are kept 30 days so that browser can be told why.

Encrypted backups of the accounts are kept 14 days, so a deleted account is gone from them within 14 days. Only we hold the key.

E-mails

We send only the e-mails your account needs: the activation link and the password reset link. No newsletters, no advertising.

Who processes data for us

Supabase (database and sign-in; servers in the EU, Frankfurt), Netlify (hosting and delivery of the site; it handles the IP address and the requested address of every visit), Resend (sending our e-mails; it keeps delivery logs and stores account data in the USA) and GitHub (runs our nightly jobs and keeps the encrypted backups, which it cannot read). The site's fonts are served by the site itself.

Each works under its data processing terms. Transfers outside the EU rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

Cookies

One cookie, set only when you sign in: it keeps you signed in, cannot be read by scripts, and goes when you sign out or the session ends. It is necessary for the account, so no consent banner is shown. No analytics, advertising or tracking cookies.

Players and referees

The statistics name players and referees and show their match data, as published by the federations. We show only the year of birth. Anyone named can ask us to correct their data or object to its use at stats@handhub.eu (Article 6(1)(f) and Article 21 GDPR).

Payments

Nothing is paid today, so we hold no payment data. Before packages are sold, the payment provider will be named here.

Your rights

You can ask to see your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a common format. Write to stats@handhub.eu; we answer within one month.

You may complain to a data protection authority: in Luxembourg the CNPD (Commission nationale pour la protection des données), or the authority of the country where you live.

Changes

We update this page when what we do changes, and tell account holders of important changes by e-mail or on the site.