Privacy

My Matchday Report is a free web app with no account required. Used anonymously, we keep only a handful of anonymous, cookieless tallies (described below) and store no personal data on our servers — your personal data stays in your own browser. If you choose to create an optional account, a minimal set of data is stored to sync it across your devices — see If you create an account.

What we collect on our servers

Only anonymous, aggregate counts — never tied to you. Specifically, running totals of:

• how many reports have been generated in total (the number shown in the footer)
• how often each club is picked
• how often the share button is used

These are just numbers that increase by one when an action happens. We set no cookies, store no IP addresses, do no profiling, and collect nothing that could identify you or your device — we can't even tell which actions came from the same person.

What's stored in your browser (localStorage)

• The name you typed on the team picker (optional)
• Your chosen club
• The match IDs you've ticked as attended
• A cached copy of the fixture JSON for ~30 minutes, to avoid refetching

You can wipe all of it by clearing site data for this domain in your browser settings.

If you create an account

Accounts are entirely optional — every feature above works without one. Signing in (via an emailed magic link, no password) lets your data follow you across devices. If you do, the following is stored server-side, linked to your account:

• your email address (used only to send the sign-in link)
• your display name and favourite club, if you set them
• the match IDs you've ticked as attended
• reports you explicitly save (stored as the same encoded snapshot a share link contains)

This data is processed by Supabase, our database and authentication provider, and is never sold or shared with anyone else. Signing in stores a session token in your browser's localStorage (not a cookie) so you stay signed in on that device.

If you add a passkey for Face ID / fingerprint sign-in, only the passkey's public key is stored with the auth provider — your biometrics never leave your device.

Anonymous use is unchanged: if you never sign in, nothing above applies and no requests are made to Supabase from the browsing and report pages at all. (The one exception is profile pages — viewing someone's public profile fetches that profile's public data, whether or not you're signed in.) Signing out keeps your local browser data intact. You can delete all your synced data yourself at any time with the Delete account data button on the account page — it permanently removes your attended matches, profile and saved reports. A minimal sign-in record (your email address) remains with the auth provider afterwards; to have that removed too, use the contact route below.

Public profiles (optional)

Your account is private by default — nobody can see it, look you up, or tell that it exists. If you choose to switch on a public profile (on the account page, by picking a handle and ticking "Public profile"), the following becomes visible to anyone with your profile link:

• your handle and display name
• your favourite club
• the matches you've ticked as attended, and stats derived from them
• who you follow and who follows you — but only the ones whose own profiles are public

Signed-in users can follow each other from profile pages. Follow connections are only ever shown between two public profiles: if your profile is private, following someone is never displayed anywhere, and accounts that follow you stay invisible until they go public themselves.

Your email address is never public. Saved reports are never public. You can switch your profile back to private at any time on the account page — the page stops being visible immediately, and so do all your follow connections. Deleting your account data removes the public profile and follow connections along with everything else.

Cookies

We don't set any. The hosting provider (Netlify) may set basic operational cookies for serving the site — see their privacy policy.

Third parties

• Supabase — only contacted if you sign in to an optional account, or when a profile page loads someone's public profile data (see above). The browsing and report pages never connect to it for anonymous visitors.
• Cloudflare Web Analytics — anonymous, cookieless traffic metrics (page views, referrers, country, device type). It sets no cookies, does no cross-site tracking, and collects no personal data. See Cloudflare's privacy policy.
• football-data.org — fixture data is fetched server-side during our build process; your browser never talks to them directly.
• Google Fonts & cdnjs — fonts and chart libraries are loaded from public CDNs. Your IP is visible to those CDNs as part of the HTTP request.
• Buy Me a Coffee — only loaded if you click the tip link in the footer.

Sharing a report

When you generate a share link, the URL contains an encoded snapshot of your selections (your club, the name you entered, and a bitmap of ticked fixtures). Anyone you give that URL to can see the same report. The URL is not sent to us — it lives only in whatever app you paste it into. If you're signed in, you can also save that same snapshot to your account to re-open it later.

Changes

If this policy changes materially we'll update the date at the top.

Contact

Open an issue on the project's GitHub repository.