Privacy
Last updated: 9 October 2026
This policy explains, in plain language, what personal data Matchday collects, why, who sees it, how long we keep it and how you can exercise your rights under Singapore's Personal Data Protection Act 2012 (PDPA).
Who we are
Matchday is operated by [ORGANISATION LEGAL NAME] ([UEN / REGISTRATION NUMBER]), [REGISTERED ADDRESS]. We are the organisation responsible for the personal data described here.
Data protection officer
Our data protection officer handles access, correction, deletion and withdrawal-of-consent requests and any privacy complaint. Contact: [DPO EMAIL].
What we collect
Your account details (name and email address from your sign-in provider), organisation memberships and roles, notification preferences and notifications, casual games, friends and presets you create, sign-in session records (times, expiry and the sign-in method used), billing records for organisations you own, and the actions you take in the service, which are recorded in an audit history. Organisers also enter competition data such as team, participant and official names. We do not store payment card numbers; our payment provider does.
Why we use it
To sign you in and keep your account secure, enforce permissions and plans, run competitions and calculate standings, publish what organisers approve, send the notifications and emails you ask for, process billing, investigate support and security issues, keep an audit history, and keep the service reliable. We rely on your consent or on the service you asked us to provide. You can withdraw consent at any time (see Your rights).
What is public
Competition names, schedules, team and participant names, standings, brackets, results, sponsor and branding information become public when an authorised organiser publishes them. Draft data is not public. Organisers should avoid entering unnecessary personal data in fields that may be published. Your account email address is never published.
Who we share it with, and overseas transfers
We use service providers who handle personal data on our behalf, some of them outside Singapore. Our identity provider Auth0 (United States) handles sign-in and holds your login credentials. Our hosting and web delivery provider Vercel (United States and global edge network) serves the website. Our application servers and database run on Oracle Cloud Infrastructure in the United States (Phoenix, Arizona), and the website's server functions run in Vercel's United States (San Francisco) region. Sentry (United States) receives error diagnostics. Our email provider delivers notification emails and sees your email address and the message. Our payment provider, Stripe, processes payments for organisations. We choose providers that give contractual protection comparable to the PDPA's standard, and share only what each needs. We may also disclose data when the law requires it or to protect users and the service.
How long we keep it
We delete data when we no longer need it. The schedule below is applied automatically every few hours. Audit history is append-only and cannot be edited, so when you delete your account it is kept but no longer identifies you.
| Data | How long we keep it |
|---|---|
| Sign-in sessions (including expired or signed-out sessions) | Deleted 30 days after they expire or are revoked |
| Scoring access attempt and rate-limit records | Deleted 30 days after the attempt |
| In-app notifications and the emails queued for them | Deleted 180 days after they are created |
| Billing webhook receipts from our payment provider | Deleted 400 days after receipt. Subscription and entitlement state is kept while the organisation exists |
| Identity-provider event records (used to prevent replays) | Deleted 90 days after receipt |
| Casual games started without an account | Deleted 30 days after they are created |
| Your account profile | Kept until you delete your account, then replaced with anonymous values straight away |
| Audit history and published competition records | Kept to protect the integrity of results and security history. After you delete your account they show Deleted user rather than your details |
Your rights
You can ask to access the personal data we hold about you, to correct it, to delete it, and to withdraw consent. Access: sign in and use Download my data on your account page for a JSON copy. Deletion: use Delete my account on the same page; your details are replaced with anonymous values immediately and you are signed out everywhere. Correction: update your name where the product allows it, or email the data protection officer for anything else. Withdrawal of consent: switch notifications off in your notification settings, or email the data protection officer; we will tell you what the withdrawal means for the service. If you cannot use the account page, email the data protection officer and we will respond within 30 days. If you are the only owner of an organisation with published or live competitions we cannot delete your account until those competitions are finished or archived, because there is no ownership transfer yet; the data protection officer can help. Deleting your account also leaves your login record with Auth0 until removed on request, so ask the data protection officer if you want that removed too.
Cookies and local storage
We use essential cookies to keep you signed in and secure, and optional storage only with your consent. See the cookie policy for the full list and how to change your choice.
Security
We use role-based access, protected sessions, scoped scoring credentials, encryption in transit, audit records and other safeguards. No online service is perfectly secure. Keep your credentials private and tell us promptly if you suspect misuse. If a data breach is likely to cause you significant harm we will notify you and the Personal Data Protection Commission as the PDPA requires.
Changes to this policy
Material changes will be shown on this page with a new date.