Privacy Policy

Last updated 23 September 2026

Feudal Football asks for very little about you: an email address, and whatever you build in the game. This page explains exactly what we hold, why we hold it, who else touches it, and what you can make us do with it.

1. Who is responsible for your data

The data controller is Jimmy Wigerstedt, a sole trader based in Uppsala, Sweden, operating Feudal Football. For anything in this policy, including any request about your own data, write to [email protected].

2. What we collect

We never see your card details. Card numbers go straight to Stripe and are never stored on our systems. We do not collect your real name, postal address, date of birth or phone number, and we do not ask for access to your contacts, photos or location.

3. Why we use it, and on what legal basis

• To run your account and the game (create your House, save progress, settle matches, sign you in). Legal basis: performance of our contract with you.
• To take payments and keep required records. Legal basis: performance of our contract, and our legal obligation under Swedish accounting law.
• To send you service messages, such as email confirmation and password resets. Legal basis: performance of our contract.
• To keep the game secure and fair, including detecting abuse, cheating, bots and fraud, and diagnosing faults. Legal basis: our legitimate interest in protecting the service and its players.
• To understand which links bring players to the game, using the referral tag. Legal basis: our legitimate interest in knowing whether our own promotion works.
• To measure whether the ads we buy work, using the measurement tags described in section 8. Legal basis: your consent, where the law requires it for storing or reading anything on your device. Where no such consent is required, our legitimate interest in not wasting money on advertising that brings nobody.

We do not sell your personal data, and we do not share it with data brokers. We do not build advertising profiles from it ourselves, and nothing you do inside the game is sent to an advertising platform. Section 8 sets out the one place this stops being the whole story: on our two marketing pages X and Meta see the visit, and when you open the page where you choose your club, and again when you seal the charter for a new House, Meta is told once that a visitor got that far. All of it happens before you have an account.

4. Who else processes it

We keep the list short on purpose. Each of these acts on our instructions, under a contract that requires them to protect your data.

Our football match data comes from a third-party sports data provider. We send that provider nothing about you. It does not know that you exist.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. Transfers outside the EEA

Some of the providers above are based in, or store data in, countries outside the European Economic Area, including the United States. Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision, so your data keeps an equivalent level of protection. You can ask us for details of the safeguards used.

The same is true of the two advertising measurement tags in section 8: both X and Meta are United States companies, and what those tags see goes there. Each is certified under the EU–US Data Privacy Framework, which is the adequacy decision that covers the transfer.

6. How long we keep it

• Account and game data: for as long as your account exists. If you delete your account, we remove it. Backups that already contain it are overwritten on their normal cycle, within 30 days.
• Payment and accounting records: seven years after the end of the financial year, because Swedish accounting law requires it. This is a legal obligation we cannot waive, and it survives account deletion.
• Server and security logs: a short rolling window, normally no more than 90 days, unless a specific entry is needed for a security investigation.

7. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, subject to the accounting records above, which we must keep;
• export your data in a portable, machine-readable format;
• restrict or object to processing we base on legitimate interest.

Write to [email protected] from the address on your account and we will answer within one month. There is no charge.

If you think we have handled your data badly, please tell us first so we can fix it. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se), or to the supervisory authority where you live.

8. What is stored on your device

Inside the game itself there are no advertising or tracking cookies. What the game stores on your device is only what it needs to work, with one exception that is listed last:

• Your sign-in session, so you are not asked to log in every time you open the game.
• The referral tag, if your link carried one, so it survives until you finish registering.
• Local game preferences and cached game data, so the app opens quickly.
• Two sent markers for Meta. These are the only items the game does not need. Each is a single flag with no identifier in it, and together they exist so that each of the two messages to Meta described below is sent only once from this browser.

Clearing your browser storage removes all of it and signs you out.

Our two marketing pages are a different matter, and we would rather spell it out than bury it. Those pages are the public front page at feudalfootball.com and the “add to home screen” page you reach from it. They carry measurement tags for the two places we buy ads, so that we can tell whether an ad we paid for actually brought anyone. Inside the game there are two exceptions, described under Meta below, and both happen before you have an account. Nothing is sent once you are playing.

• X (Twitter). This one is a full advertising tag. It loads code from X, and it stores identifiers on your device, including ones that let X recognise the same browser across other websites carrying the same tag and match it to an X account. This is cross-site advertising tracking, and calling it anything softer would be misleading.
• Meta (Facebook and Instagram). This one is deliberately cut down. We request a single invisible image from Meta and nothing more. No Meta code runs on our pages, and nothing from Meta is written to your device by us. We chose this on purpose, accepting that it tells us far less about which ads work, because it is the version that leaves the least behind. Meta may still recognise you from cookies it already set on its own domain when you visited Facebook or Instagram, which is outside our control. Browsers that block third-party cookies, such as Safari and Firefox, prevent that. We make four more requests of the same kind, each at most once per browser, all before the screen that asks you to create an account: one when the page where you choose your club has loaded and is ready to use, one when you have picked a country, one when you have picked a club, and one when you have sealed the charter for your House. They tell Meta that a visitor got that far, which is how we learn whether an ad found people who wanted to play, whether the page loaded fast enough for them, and which step lost them. They carry no email address, no name, not which country or club you picked, and nothing about the House you chose.

Both tags see your IP address, which page you are on, the page you came from and your browser type, because any request to another server does. Neither one is given your email address, your name, your account or anything about your House.

9. Advertising

We do not show you advertising. There are no ads in the game, and we do not sell space on our pages to anyone. What section 8 describes is the opposite direction: we buy ads on X and Meta, and those two tags tell us whether the ads we paid for worked.

The honest consequence is that X, as the operator of its own tag, may use what it sees to build an advertising profile of the browser it saw. We do not receive that profile, we cannot see it, and we do not buy or sell audience data. But we are not going to claim that putting the tag there has no effect on you, because it does.

For these tags X and Meta decide for themselves what they do with what they collect, so they are not simply working on our instructions the way the providers in section 4 are. That makes each of us responsible for our own part. Their own policies govern their part: X’s privacy policy and Meta’s privacy policy.

You can stop both of them without waiting for us. Blocking third-party cookies, using Firefox or Safari with their default tracking protection on, or using any content blocker will prevent these tags from working, and nothing on our pages or in the game will break if you do. We do not detect it, and we do not treat you differently for it.

10. Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes, by our authentication provider, and are never visible to us. Access to the production database is limited to the operator. No system is perfectly secure, but if a breach ever affects your rights we will notify the supervisory authority, and you, as the GDPR requires.

11. Children

Feudal Football is for adults. You must be 18 or older to hold an account, and the game is not directed at children. We do not knowingly collect data about anyone under 18. If you believe a child has registered, write to us and we will delete the account.

12. Changes to this policy

We will update this page when what we do changes. The date at the top always shows the current version. If a change matters to you, for example a new provider or a new purpose, we will give notice in the game or by email before it takes effect.

13. Contact

Jimmy Wigerstedt
Uppsala, Sweden
[email protected]