What we know about you, and what we do with it.

Who we are

DANCER DIGITAL LTD operates the CLUBVERSE™ game and is the controller of the personal data described here.

You can reach us about privacy through the Feedback button on any signed-in screen or through the Discord; both are on the support page.

What we collect

We collect only what the game uses. In practice that is:

• Account: if you register with an email address and password, we keep the email address; the password is stored only as a one-way hash by Supabase. If you sign in with Apple, Discord, Google or Microsoft instead, the provider gives us your email address, a display name and, where you allow it, a profile picture, together with an identifier for your account with them. We do not receive your password.
• Waiting list: if you join it, the email address you give and the fact that you consented to hear from us.
• Sponsorship enquiries: if you use the form on the sponsorship page, your name, company, email address, what you are interested in, your budget if you give one, and your message; if you were signed in, it is linked to your account. We use it only to reply to you about sponsorship.
• Profile picture: if you upload one, the picture, after we have shrunk it and removed the hidden data a camera adds (location, device, time). If you choose Gravatar instead, we keep only the choice; our server asks Gravatar for the picture each time using a one-way hash of your email address. We also record when you accepted the picture terms.
• Your play: your club, its squad, finances, tactics, results, and every decision you make in the game. This is the game state and it is what other managers see, so it is the least private thing here.
• Messages: what you write in in-game chat and to other managers, with when you wrote it.
• Feedback: what you type into the Feedback button, together with the page you were on, your browser’s user-agent string and your screen size, so we can reproduce the problem. If you were signed in, it is linked to your account.
• Bot check: the email sign-in and sign-up forms run Cloudflare Turnstile, which looks at your browser and connection (including your IP address) to tell a person from a script. Cloudflare returns a pass or fail; we do not receive or store what it looked at.
• Technical: our hosting provider records ordinary server logs, including IP addresses, for security and to keep the service running. We use your IP address in memory to limit how often the feedback form can be submitted; it is not written to our database for that purpose.

We do not use advertising trackers, third-party analytics, or fingerprinting. The only cookies we set are the ones that keep you signed in, and, for one minute after a sign-in or sign-up that did not go through, one that refills the email address and name you typed.

What we use it for

We use this data to:

• run the game: sign you in, keep your club, play your matches, show your results to the world;
• let other managers play against you, including seeing your display name and your club’s public record;
• send you email about the game: a waiting-list confirmation, and, if we add them, matchday or digest emails you can turn off;
• answer feedback and fix bugs;
• keep the service secure and prevent abuse;
• meet legal obligations.

Our legal bases, where the law asks for one, are performance of our agreement with you (running the game), our legitimate interests (security, improvement, answering feedback), consent (marketing email, which you can withdraw), and legal obligation.

What other people can see

CLUBVERSE™ is a public world. Without signing in, anyone can see clubs, results, league tables, match reports and the names of the managers running clubs. Your display name, your profile picture if you set one, and the record of the club you manage are therefore public. Your email address is not.

In-game chat is visible to the people you send it to. Feedback is visible only to us.

Who we share it with

We do not sell personal data and we do not share it for anyone else’s marketing. The data is processed by the services we build the game on:

• Supabase, which hosts our database and handles sign-in;
• Railway, which hosts the site and serves its pages;
• Resend, which sends our email;
• Gravatar (Automattic), only if you choose to show your Gravatar: our server sends it a hash of your email address to fetch the picture, under Automattic’s privacy policy. Nothing is sent from your browser, and other managers never see the hash;
• Stripe, only if you buy Pro or give it as a gift: Stripe takes the payment and holds the card details under its own privacy policy; we receive whether the payment went through, what was bought and when it runs out, never the card number;
• Apple, Discord, Google or Microsoft, whichever you sign in with, under their own privacy policies;
• Cloudflare, which runs the bot check on the email sign-in and sign-up forms (Turnstile), under Cloudflare’s privacy policy;
• Discord, if you join our server, under Discord’s policy.

These providers act on our instructions. Some of them may process data outside the country you live in; where that happens, transfers rely on the safeguards those providers offer, such as standard contractual clauses.

We may disclose data where the law requires it, or to protect the rights and safety of managers or the game.

How long we keep it

Account data is kept while your account exists. An uploaded profile picture is deleted the moment you replace it or go back to initials, and when an admin takes it down. When you ask us to delete your account we remove your email address, your password hash and your profile picture; your club stays in the world, and your display name may remain on its history as a record, unless you ask for that to be removed too.

Game state is part of a shared world and is kept for as long as the world runs, including after you leave, because other managers’ histories depend on it. A world reset removes it.

Feedback is kept until it has been dealt with, and then for a reasonable period so we can see whether a problem comes back.

Waiting-list addresses are kept until you are invited or ask to be removed.

Sponsorship enquiries are deleted automatically two years after we last updated them, or sooner if you ask.

Your rights

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to receive it in a portable form, and to withdraw consent where we relied on it. You may also complain to your data protection regulator; in the UK that is the Information Commissioner’s Office.

To exercise any of these, contact us as described above. We will respond within the time the law allows, usually a month.

Children

The game is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, tell us and we will remove it.

Security

Data is stored with access controls that limit each account to its own data and to what the game makes public. Passwords are kept only as one-way hashes by our sign-in provider, never in a form anyone can read back. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.

Changes to this notice

We will update this page when what we collect or do changes, and change the date at the top. A change that matters will also be announced in the Discord and on the status page.