Privacy policy — Nations Cup: Leagues & Finals
Last updated: 2026-11-07
Who we are
Nations Cup: Leagues & Finals ("the app") is an independent football reference and free score-guessing game published by the developer named on its store page ("we"). Contact: [email protected].
Unofficial fan app. Not affiliated with, endorsed or sponsored by UEFA. Names used for identification only.
The short version
The reference part (tables, results, history, squads, stadiums, quiz) works without any profile. The "Guess the score" game needs only a nickname and your birth year. There is no money anywhere in the app: no stakes, no purchases and no paid entry. Contacts for prizes are optional and stored only with a separate consent. We do not sell your data. You can delete everything at any time, in the app or on the web.
The app is intended for users aged 13 and over.
Data you give us
Required for the game: nickname (shown in rankings and friends leagues) and birth year (used only to check your age).
Optional: favourite national team; country (2-letter code — suggested from your device region, editable; shown as a flag next to your nickname and used for the country ranking and the countries table).
Optional contacts for prizes (16+ only): e-mail, Telegram username, WhatsApp number, Instagram username and phone number (with country code). They are stored only if you tick "I agree to be contacted about prizes" and are used only to contact you if you win a prize in a future partner contest. They are never shown in rankings or to other players. Untick the box or clear the fields to delete them.
Game data: your score guesses, points, quiz progress, badges, collected cards and the friends leagues you created or joined.
Data created automatically
A random install identifier (for example g_7Hk2…) is created on your device. It links your game data to your profile without an e-mail or password; our server stores only a one-way hash of it. It is not your advertising ID.
Our game server (https://score-game.kasup096.workers.dev, Cloudflare Workers and D1 database) receives your requests with this identifier. Standard logs (IP address, time, request) are kept by the hosting provider for security for a short period; IP addresses are used only in hashed form for rate limiting.
Match reminders and the favourite nation are stored on your device only. Reminders are local notifications: no push token is created and nothing is sent to us.
Ages
The app is for people aged 13 and over. If you enter a birth year meaning you are under 13, no profile is created and nothing about you is sent to our server; you can only use the app as a guest on your device, and ads are requested as child-directed with the strictest content rating.
13 to 15: profile with nickname and birth year only; we do not collect contacts; ads are always non-personalised and requested as "under the age of consent".
16 and over: all features; personalised ads only with your consent (and, on iOS, your App Tracking Transparency permission).
Advertising (Google AdMob)
The iOS and Android apps show ads from Google AdMob (banners on list screens, an occasional full-screen ad between screens, an optional rewarded ad for a quiz hint). The web version shows no ads.
Before any ad is requested we show Google's consent message (User Messaging Platform) where the law requires it: in the EEA, the UK and Switzerland (GDPR consent) and in US states with privacy laws (opt-out of the sale / sharing of personal information). You can change your choice at any time in More → Privacy & ads. On iOS we ask for tracking permission (ATT) only after that and never for users under 16.
Google may process your device advertising ID, IP address (approximate location), device and app information and ad interactions to serve, limit and measure ads. Without consent or permission only non-personalised ads are shown. Ads are not directed at children. Gambling and betting ad categories are blocked. More: https://policies.google.com/technologies/partner-sites
What we use data for and legal bases
To run the game (points, rankings per edition, month and all time, country ranking, countries table, friends leagues), to keep your progress, to protect the service against abuse and cheating, and — only with your consent — to contact you about a prize. Legal bases (GDPR / UK GDPR): performance of our service (art. 6(1)(b)), legitimate interests in security (art. 6(1)(f)), consent for prize contacts and personalised ads (art. 6(1)(a)).
Sharing
Other players see only your nickname, your country flag, points, number of exact scores and rank. Contacts are never shown.
Service providers processing data on our behalf: Cloudflare (hosting and database) and Google (AdMob). If a partner contest with prizes is ever run, its official rules will name the partner; we pass a winner's contact to the partner only if the rules say so and only after you confirm. Football data comes from API-Football; no personal data is sent to it. Stadium photos come from Wikimedia Commons (credited on screen). We do not sell personal data.
Storage and deletion
Game data stays on your device and, when the online service is on, on our server until you delete it, or for 24 months after your last activity, after which it is deleted automatically.
In the app: Play → My profile → Edit → "Delete my contacts" (contacts only) or "Delete account and data" (everything: profile, guesses, league memberships, contacts — on the device and on the server, immediately). Friends leagues you created pass to the longest-standing member or are deleted if empty.
Without the app: open https://score-game.kasup096.workers.dev/delete and follow the steps. Or write to [email protected] from the e-mail you saved as a contact.
Your rights
You can access, correct, export and delete your data, withdraw consent at any time and object to processing. Most of this is available directly in the app. Residents of US states with privacy laws can opt out of the sale or sharing of personal information through More → Privacy & ads. For anything else write to [email protected]. You can also complain to your data protection authority.
Security
All traffic is encrypted (HTTPS). Contacts for prizes are encrypted at rest. Install identifiers are stored only as hashes.
Changes
We will update this policy when features change and show the date of the last update here.
This website
The website nationsleague27.com shows the same reference data as the app and lets you play the same games. It sets no advertising or analytics cookies. If you create a player or sign in, your secret player key is kept in your browser's local storage (it never leaves your device except to authenticate your requests to the game server) together with a random device identifier used only for registration limits; you can remove both by logging out or clearing site data. The game server (Cloudflare Workers) receives your requests with that key; standard server logs are kept by the hosting provider for security for a short period. Pages are served by Cloudflare Pages.
Contact: [email protected].