Privacy policy — Nations Cup: Leagues & Finals
Last updated: 2026-11-07
Who we are
Nations Cup: Leagues & Finals ("the app") is an independent football reference and free score-guessing game published by the developer named on its store page ("we"). Contact: contact@nationsleague27.com.
Unofficial fan app. Not affiliated with, endorsed or sponsored by UEFA. Names used for identification only.
The short version
The reference part (tables, results, history, squads, stadiums, quiz) works without any profile. The "Guess the score" game needs only a nickname and your birth year. There is no money anywhere in the app: no stakes, no purchases and no paid entry. Contacts for prizes are optional and stored only with a separate consent. We do not sell your data. You can delete everything at any time, in the app or on the web.
The app is intended for users aged 13 and over.
Data you give us
Required for the game: nickname (shown in rankings and friends leagues) and birth year (used only to check your age).
Optional: favourite national team; country (2-letter code — suggested from your device region, editable; shown as a flag next to your nickname and used for the country ranking and the countries table).
Optional contacts for prizes (16+ only): e-mail, Telegram username, WhatsApp number, Instagram username and phone number (with country code). They are stored only if you tick "I agree to be contacted about prizes" and are used only to contact you if you win a prize in a future partner contest. They are never shown in rankings or to other players. Untick the box or clear the fields to delete them.
Game data: your score guesses, points, quiz progress, badges, collected cards and the friends leagues you created or joined.
Data created automatically
A random install identifier (for example g_7Hk2…) is created on your device. It links your game data to your profile without an e-mail or password; our server stores only a one-way hash of it. It is not your advertising ID.
Our game server (https://score-game.kasup096.workers.dev, Cloudflare Workers and D1 database) receives your requests with this identifier. Standard logs (IP address, time, request) are kept by the hosting provider for security for a short period; IP addresses are used only in hashed form for rate limiting.
Match reminders and the favourite nation are stored on your device only. Reminders are local notifications: no push token is created and nothing is sent to us.
Ages
The app is for people aged 13 and over. If you enter a birth year meaning you are under 13, no profile is created and nothing about you is sent to our server; you can only use the app as a guest on your device, and ads are requested as child-directed with the strictest content rating.
13 to 15: profile with nickname and birth year only; we do not collect contacts; ads are always non-personalised and requested as "under the age of consent".
16 and over: all features; personalised ads only with your consent (and, on iOS, your App Tracking Transparency permission).
Advertising (Google AdMob)
The iOS and Android apps show ads from Google AdMob (banners on list screens, an occasional full-screen ad between screens, an optional rewarded ad for a quiz hint). The web version shows no ads.
Before any ad is requested we show Google's consent message (User Messaging Platform) where the law requires it: in the EEA, the UK and Switzerland (GDPR consent) and in US states with privacy laws (opt-out of the sale / sharing of personal information). You can change your choice at any time in More → Privacy & ads. On iOS we ask for tracking permission (ATT) only after that and never for users under 16.
Google may process your device advertising ID, IP address (approximate location), device and app information and ad interactions to serve, limit and measure ads. Without consent or permission only non-personalised ads are shown. Ads are not directed at children. Gambling and betting ad categories are blocked. More: https://policies.google.com/technologies/partner-sites
What we use data for and legal bases
To run the game (points, rankings per edition, month and all time, country ranking, countries table, friends leagues), to keep your progress, to protect the service against abuse and cheating, and — only with your consent — to contact you about a prize. Legal bases (GDPR / UK GDPR): performance of our service (art. 6(1)(b)), legitimate interests in security (art. 6(1)(f)), consent for prize contacts and personalised ads (art. 6(1)(a)).
Sharing
Other players see only your nickname, your country flag, points, number of exact scores and rank. Contacts are never shown.
Service providers processing data on our behalf: Cloudflare (hosting and database) and Google (AdMob). If a partner contest with prizes is ever run, its official rules will name the partner; we pass a winner's contact to the partner only if the rules say so and only after you confirm. Football data comes from API-Football; no personal data is sent to it. Stadium photos come from Wikimedia Commons (credited on screen). We do not sell personal data.
Storage and deletion
Game data stays on your device and, when the online service is on, on our server until you delete it, or for 24 months after your last activity, after which it is deleted automatically.
In the app: Play → My profile → Edit → "Delete my contacts" (contacts only) or "Delete account and data" (everything: profile, guesses, league memberships, contacts — on the device and on the server, immediately). Friends leagues you created pass to the longest-standing member or are deleted if empty.
Without the app: open https://score-game.kasup096.workers.dev/delete and follow the steps. Or write to contact@nationsleague27.com from the e-mail you saved as a contact.
Your rights
You can access, correct, export and delete your data, withdraw consent at any time and object to processing. Most of this is available directly in the app. Residents of US states with privacy laws can opt out of the sale or sharing of personal information through More → Privacy & ads. For anything else write to contact@nationsleague27.com. You can also complain to your data protection authority.
Security
All traffic is encrypted (HTTPS). Contacts for prizes are encrypted at rest. Install identifiers are stored only as hashes.
Changes
We will update this policy when features change and show the date of the last update here.
Delete my account and game data — works without the app.
Score game server — details
“Guess the exact score” game in Nations League. Free game: points and rankings only. No money, no stakes, no betting. Server: Cloudflare Workers + D1 (EU/US data centres).
Data we collect
| Data | Why | Visible to others |
|---|---|---|
| Random player key generated by the app (stored only as a hash) | Recognise your device without sign-in | No |
| Nickname | Rankings | Yes |
| Country (from your device region, editable) | Country rankings, flag next to the nickname | Yes |
| Birth year | Age check (under 13 cannot create an account; under 16: no contacts stored) | No |
| Favourite team, app language (optional) | Personalising the game | No |
| Score predictions, points, private leagues, friends | The game itself | Points and rank only |
| Prize contacts — Telegram, WhatsApp, Instagram, e-mail, phone (all optional) + your consent and its date | Only to reach winners of sponsor prizes, only with the checkbox “I agree to be contacted about prizes” | Never. Encrypted, admin-only |
| IP address / device id hash (short-lived counters) | Rate limiting and anti-abuse | No, kept up to 2 days |
What we do not do
We do not sell data, do not show contacts to other players, do not use them for advertising, and do not track you across apps through this game server.
Retention and deletion
Data is kept until you delete it or after 24 months without activity. Delete everything anytime in the app (Play → Profile → Delete my data) or on the web: delete my data. You can remove only your prize contacts in the profile at any time.
Security
HTTPS only. Prize contacts are encrypted at rest (AES-256-GCM). The player key is stored as a SHA-256 hash.