Privacy

Privacy Policy

This policy explains what personal data Transfer Tracker collects, why we collect it, who we share it with, and the rights you have over it. Transfer Tracker is a Score90 product.

We process personal data under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Our audience is global, so this policy is written to satisfy UK and EU standards.

The controller of your data

The data controller responsible for your personal data is Proper Sports Media Limited (company 16006002), trading as Transfer Tracker, a Score90 product. You can reach us at:

Proper Sports Media Limited (company 16006002) Registered office: 179 Southwark Bridge Road London SE1 0ED United Kingdom admin@transfertracker.ai

The Transfer Tracker iPhone app is published on the App Store by Score 90 AB, a Proper Sports Media group company, on behalf of Proper Sports Media Limited. Proper Sports Media Limited is the data controller for the app as well, and this policy covers it.

Last updated: 20 October 2026.

The data we hold, and the lawful basis for it

We keep the personal data we hold to the minimum needed to run the product. The table below sets out exactly what we collect, why we use it, and our legal basis under Article 6 of the UK GDPR.

Email address

To authenticate your account (a sign-in link, a 6-digit sign-in code, Google or Apple sign-in). If you sign in with Apple and choose to hide your email, we receive Apple’s private relay address instead.

Contract: Art 6(1)(b)

Name & avatar

To personalise your account, where provided by your Google or Apple profile.

Contract: Art 6(1)(b)

Follows (clubs, players, leagues)

To deliver the personalised feed you asked for.

Contract: Art 6(1)(b)

Your alerts inbox (the player, club or deal an alert was about, what changed, when we sent it, and whether you have read it)

To show you the alerts you missed in one place, on any device you sign in on.

Contract: Art 6(1)(b)

Share links (a random code, the page you shared, where you shared it, for example WhatsApp or X, and, if you are signed in, the same scrambled account id our analytics uses) and visits made through them

To count how often shared links are opened and which pages people share, so we can improve sharing. Your name and email are never attached to a share link, and a link never reveals who shared it.

Legitimate interests: Art 6(1)(f)

Usage analytics (page and card views, sign-up method, follows, shares), plus IP address, device and analytics cookies

To understand how the product is used and improve it, via Google Analytics 4.

Consent: Art 6(1)(a) + PECR reg 6

Product usage linked to your account (pages viewed, sessions, shares and product interactions), stored against a scrambled (hashed) account id, signed-in users only

To understand how members use the product over time, fix problems and improve it, via our own cookieless analytics.

Legitimate interests: Art 6(1)(f)

Functional local storage (e.g. tt-follows)

To remember your follows on your own device, including when signed out.

Legitimate interests: Art 6(1)(f)

What we do not collect: we do not collect special-category data (such as health, religion or political views), and we do not collect payment data: there are no payments on Transfer Tracker. Beyond the approximate location Google Analytics derives from an IP address, we do not collect location data.

No personal data is sent to the Anthropic API: the AI layer processes football rumour and club text only.

Football data about players. Transfer Tracker publishes football information about professional players, drawn from licensed football-data providers and public sources, including public social media follower counts. This is processed under our legitimate interest in providing football news and analysis about public figures in their professional capacity.

How we use cookies

Essential cookies and local storage are always on, because the product cannot work without them. Google Analytics 4 only loads after you accept analytics cookies. Until then, no analytics cookies are set and no usage data is sent to Google. You can change your choice at any time using the “Cookie preferences” link in the footer. For a full, itemised list of every cookie and storage key we use, see our Cookie Policy.

Separately, we measure how the site is used with our own cookieless analytics. It stores nothing on your device: no cookies, no local storage, and no lasting identifier. Our server turns your IP address and browser type into an anonymous code that changes every day and cannot be reversed, then discards the raw values immediately. For signed-out visitors that is the whole story: we keep aggregate statistics only (pages viewed, approximate country, device type, and product interactions) and no profile of you is built. If you are signed in, events are additionally linked to a scrambled (hashed) version of your account id so we can see how members use the product over time and improve it. Analytics is never linked to your email or name, and the raw account id itself is never stored with it. Both run on our legitimate interest in understanding and improving our own product; you can object to the account linkage at any time (see “Your rights” below).

Our widget on other websites. Some publishers embed the Transfer Tracker widget on their pages. When it loads, it sends us one anonymous count that the widget was viewed, with the publisher’s page address and the club it shows. It sets no cookies, stores nothing on the visitor’s device and sends no identifier, so we cannot recognise the visitor. We use these counts to understand where the widget is used.

Alerts. If you follow a player, club or league, we keep a record of the alerts we send you so you can read them later in your inbox. You can turn alerts off at any time in your preferences, and your inbox is deleted when you delete your account.

Processors & international transfers

We do not sell your personal data. We share it only with the service providers (processors) that help us run the product:

• Supabase: authentication, database and hosting of your user data, plus our first-party aggregate analytics.
• Vercel: hosting of the frontend and server logs.
• Google: Analytics (only after you accept analytics cookies).

Our football-data providers receive no user data from us: we only consume football data from them.

Some of these providers process data outside the UK: Vercel and Google are US-hosted, and our Supabase data is hosted in Ireland (EU, AWS eu-west-1). Where data is transferred internationally, we rely on the UK International Data Transfer Agreement (IDTA), or EU Standard Contractual Clauses with the UK Addendum, as appropriate. Signed data-processing agreements with these providers are CONFIRM: signed DPAs in place with Supabase, Vercel and Google.

How long we keep it

• Account data: kept while your account is active, and erased when you delete your account using the self-service tool below. We also plan to auto-delete or anonymise accounts after 24 months of inactivity: CONFIRM: 24-month inactivity auto-deletion (planned, not yet live).
• Analytics data: retained in Google Analytics for CONFIRM: GA4 retention, proposed 14 months.
• First-party usage analytics: kept for a maximum of 13 months, then deleted automatically. When you delete your account, the account id used to create the link is erased, so any remaining usage records can no longer be connected to you.
• Alerts inbox: kept while your account is active and deleted with your account.
• Share link records: kept for a maximum of 13 months, the same as our first-party usage analytics.
• Records from retired game features: the Scout progress, badges, missions, transfer calls, predictions and recaps made before these games closed on 13 October 2026 are archived. They are no longer used or shown to anyone, are included in your data download and deleted with your account, and the archive itself will be deleted on CONFIRM: game archive deletion date.
• Deletion-audit log: a minimal record (a hashed user id and a timestamp only) kept for 12 months.

Your rights & how to exercise them

Under the UK GDPR you have the right to: access your data; data portability (receive a copy in a portable format); erasure (delete your data); rectification (correct inaccurate data); restriction of processing; objection to processing; and to withdraw consent at any time.

Access, portability and erasure are self-service. When you are signed in, the “Your data” panel lets you download a copy of your data and delete your account directly. You can only ever read or delete your own records.

To exercise any of the other rights, such as rectification, restriction, objection (including objecting to product usage being linked to your account) or withdrawing consent beyond cookies, email admin@transfertracker.ai and we will action your request within one month, as required by the UK GDPR.

To withdraw your analytics consent, re-open the “Cookie preferences” link in the footer and choose Reject. This also clears the analytics cookies from your device.

Age of use

Transfer Tracker is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please email admin@transfertracker.ai and we will delete it.

Changes to this policy

We may update this policy from time to time, for example if we change a service provider or add a feature. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be made clear.

How to complain

If you have a concern about how we handle your personal data, please contact us first at admin@transfertracker.ai so we can try to put it right.

You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk. Our ICO registration number is CONFIRM: ICO registration number.

Open the live page. Open on transfertracker.ai