Privacy policy (GDPR)

Account: name, email, password (hashed), language and alert preferences. Billing: Stripe customer id (card data stays with Stripe). Usage: followed players, technical logs.

Contract performance (service delivery), consent (newsletter, non-essential cookies), legitimate interest (security, fraud prevention).

Account: until deletion. Email logs: 12 months. Newsletter consent proof: 3 years after unsubscribe. Account deletion: anonymized hash only.

Stripe (payments), Brevo (transactional email and newsletter), API-Football (sports data), TheSportsDB (club logos), Cloudflare (Turnstile, CDN, Web Analytics — cookieless audience measurement, no individual tracking), Emergent Labs Inc. (hosting).

We use Cloudflare Web Analytics, which sets no cookie and tracks no individual: it only aggregates page views, referrers and countries. That is exactly why it was chosen over Google Analytics, and why no prior consent is required for this measurement.

Access, rectification, erasure, portability, objection. Exercise them from your account area or at contact@rookieradar.eu. No data protection officer is appointed: the company does not fall within the mandatory appointment cases (GDPR article 37). You may complain to the CNIL.