Legal
Privacy policy
How CazzyFooty handles your personal data. Effective 15 September 2026.
Who we are
CazzyFooty organises casual football games in Norwich: we book the pitch, bring the kit, fill the teams and take payment. CazzyFooty is the data controller for the personal data described in this policy, which means we decide how it is used and are responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions or requests about your data: email info@cazzyfooty.com.
What we collect
When you create an account
Your email address, the name other players will see, and your password. You can also give a postcode and choose whether you would like emails about new games. We never store your password itself — only a scrambled version (a scrypt hash) that cannot be turned back into it.
If you sign in with Google
Google tells us your name, email address and profile picture, and whether Google has verified that email address. We store those, Google's identifier for your account, and when you last signed in with it. We never see your Google password or anything else in your Google account.
Your profile and preferences
Anything you choose to add in your settings: full name, phone number, address, ability level, preferred position, and the days, times, formats, levels, distance and price that suit you. All of it is optional.
If you join a game as a guest
The name other players will see, your email address, and when you accepted our terms. Instead of a password, we give your device a random code in a cookie and show you a private link containing the same code; we store only a scrambled version of it. Anyone with your private link can see and cancel your place, so keep it to yourself.
If you organise a game
The games you create and anything you enter about them, and any pitch you add, with its address, and the email address of anyone you keep a place for. To pay you, Stripe collects your identity details and your bank details on its own pages — they never reach us. We give Stripe your email address to start your account, and from Stripe we keep your Stripe account reference, whether your account is ready to be paid, and a record of each payout: the amount, the fees taken off it and Stripe's reference.
When you join a game
Which games you join, when you joined, and whether and when you cancelled — or were taken out of the game by its organiser or by us.
If a place is kept for you, or you use a join coupon
When an organiser or CazzyFooty keeps a place in a game for you, we store the email address they typed, who kept it, until when, and whether you took it up or said no. If you have an account with that email address, the place shows under your games. If you use a join coupon, we record that you used it and the payment it went towards. The private links to both contain a code made from our own secret; we store nothing that could be used to recreate them.
If you are removed from a game or blocked
When a game's organiser or CazzyFooty takes you out of a game, we record that your place was taken away rather than given up, and by which of the two. If you are blocked (see the terms), we keep one record of it: who is blocked, whose games it covers, who made it, the game it was made from and when. The organiser who blocked you sees your name in a list of the people they have blocked, and CazzyFooty can see the same. Lifting a block deletes that record. Nothing about a removal or a block is shown to other players.
If you use the Match Suggester
The day, time, pitch area and town you suggest, and the date you suggested it. A suggestion is not attached to you — we keep no name, account or address against it, whether or not you were signed in, and anyone can see the slots and how many votes each has.
A vote is different if you are signed in. We record which slots your account has voted for, so that your votes follow you between devices and so that we can tell you when a match you asked for is on. Nobody else sees who voted for what: the page shows only how many votes a slot has.
Voting while signed out stays anonymous. So that one person cannot vote twice for
the same slot, we put a random code in a cookie on your device
(cf_voter) and store only a one-way scramble of it against your vote.
It identifies the device, never you. If you then create an account or sign
in on that device, those votes become your account's — that is how
what you voted for before signing up is not lost. Until then we cannot work back
from a vote to a person.
Closing your account unhooks your votes rather than deleting them: the slot was still wanted, so it keeps its count, but nothing points at you any more.
When you pay
Card payments are handled by Stripe. Your card details go straight to Stripe and never reach us. From Stripe we keep the amount, Stripe's fee, whether the payment succeeded or was refunded, Stripe's reference numbers, the card brand and its last four digits (or the payment method's name, such as Link or Apple Pay), and a link to your Stripe receipt. We never have your full card number, expiry date, security code or bank details.
When you use the site
Each time you sign in we record the time, your browser and your IP address against that sign-in, which is how you stay signed in and how your settings page can sign out your other devices. Like any website, our servers also log each request they receive — your IP address, the page requested, the time and your browser — which we use only to keep the site secure and to fix problems.
We do not use analytics, advertising or tracking of any kind, and apart from Stripe on the payment page, nothing on our pages is loaded from anyone else's servers.
Why we use it
UK law requires us to have a lawful basis for each use of your data. Ours are:
| What we use it for | Lawful basis |
|---|---|
| Creating your account, signing you in and keeping you signed in | Contract — it is needed to provide the service you signed up for |
| Booking your place, taking payment, refunds and cancellations, and contacting you about a game you have joined | Contract |
| Showing your name to the other players in a game you have joined, and to its organiser | Legitimate interests — players knowing who they are playing with |
| Letting you organise games, and paying you what they take through Stripe | Contract |
| Keeping a place in a game for someone an organiser or we name, and letting them take it up; join coupons | Legitimate interests — organisers and players arranging who plays |
| Counting Match Suggester suggestions and votes, deciding which pitches to book, and telling you when a match you voted for is on | Legitimate interests — running games where players want them |
| Security: sign-in records, server logs, limiting repeated attempts, and Stripe's fraud checks | Legitimate interests — keeping accounts, payments and the site safe |
| Keeping records of payments | Legal obligation — tax and accounting law |
| Emailing you about new games, if you ask us to | Consent — turn it off at any time in your settings |
We do not make decisions about you by automated means alone.
Who can see it
We never sell your personal data or share it for anyone else's marketing. It is seen only by:
- Other players in the same game — the name you chose to show, and only once they have a place in that game themselves. Never your email, phone number or anything else.
- The organiser of a game you join, if a player organises it — the name you chose to show. Never your email, phone number or anything else. If you organise a game, your own name is not shown on it.
- An organiser who keeps a place for you — the email address they gave us, whether you have taken the place up or said no, and, once you join, your name. They see nothing else about you, and nobody but them and us sees the address.
- The CazzyFooty team — to run games we can see who has signed up to each one, with their name, email address, phone number (if given) and payment status, the places kept and join coupons given out, and the players blocked.
- Anyone who visits the site — the Match Suggester's slots and their vote counts are public. Nothing there identifies who suggested or voted for one.
- Stripe — processes payments. Stripe receives what you enter into its payment form, plus the amount, which game it is for and our reference for you. If you organise games, Stripe also receives your email address and collects the identity and bank details it needs to pay you. Stripe uses it under its own privacy policy, including to prevent fraud.
- Google — only if you choose to sign in with Google. Google tells us who you are; we send Google nothing about you.
- IONOS — our hosting provider, whose servers the site and its database run on.
Our WhatsApp group is separate from this site. We send WhatsApp nothing about you, and joining is up to you. If you join, the group's other members and its admins see your WhatsApp name and phone number, and WhatsApp uses them under its own privacy policy.
We may also disclose data if the law requires it, or to establish or defend legal claims.
Where it is stored
Our website and database are hosted by IONOS in the United Kingdom. Stripe and Google may process data outside the UK, including in the United States; when they do, the transfer is protected by the safeguards UK law requires, such as adequacy regulations or approved contract terms.
Cookies
We use only cookies that are strictly necessary for the site to work, which is why we do not ask you to accept them. None of them track you across other websites.
| Cookie | What it does | How long it lasts |
|---|---|---|
cf_session |
Keeps you signed in | 30 days, or until you sign out |
cf_csrf |
Checks that a form was really sent by you, not by another website | 12 hours |
cf_flash |
Carries a short confirmation message, such as “Your profile has been updated”, to the next page | 60 seconds |
cf_oauth |
Set only while you sign in with Google, to check the reply belongs to the sign-in you started | 10 minutes |
cf_guest |
Remembers your guest bookings on this device, if you join as a guest | 180 days |
cf_votenudge |
Remembers that we have already offered you an account after a vote, so that we ask once and not every time. Holds no information about you, and is gone when you close the browser | The browsing session |
cf_voter |
Set when you first suggest or vote on the Match Suggester, so that one device counts once per slot. Holds a random code, not who you are | 365 days |
| Stripe cookies | Set by Stripe on the payment page only, to prevent fraud | See Stripe's cookie policy |
How long we keep it
- Your account — for as long as it is open, together with its sign-in records.
- If you close your account — we sign you out everywhere and stop showing you to other players straight away, but keep the record so that past games and payments stay accurate. If you want it deleted rather than closed, ask us and we will delete everything we are not legally required to keep.
- Payment and booking records — six years, as tax and accounting law requires. This applies to guests too.
- Guest details — for as long as we keep the bookings they belong to, or until you ask us to delete them.
- Kept places and join coupons — for as long as we keep the booking records of the game they are for.
- Match Suggester suggestions and votes — until we have acted on them or they are no longer useful for deciding where to book. A suggestion is never attached to you. A vote is, while you have an account: ask us and we will unhook yours, and closing your account does it for you.
- Server logs — our web server's request logs are deleted after 14 days. Our application's own logs are kept only for as long as we need them to fix problems and keep the site secure.
How we protect it
- Everything travels over an encrypted (HTTPS) connection.
- Passwords, sign-in codes and guest codes are stored only in scrambled form, so even a copy of our database could not be used to sign in as you.
- We never store card numbers, security codes or bank details.
- Changing your email address, your password or closing your account needs you to confirm who you are first.
If a data breach ever put you at risk, we would tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected — much of it you can change yourself in your settings;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw your consent to emails about new games at any time.
To use any of these rights, email info@cazzyfooty.com. It is free, and we will reply within one month.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Age
You must be 16 or over to create an account or join a game as a guest. We do not knowingly collect data about anyone younger; if you think someone under 16 has signed up, tell us and we will delete their data.
Changes to this policy
If we change this policy we will update this page and the date at the top. If a change significantly affects how we use your data, we will tell you before it takes effect.
Contact us
Email info@cazzyfooty.com with any question about this policy or your data.