Privacy notice

This notice describes what Socostars actually does with data today. It describes the current build of the site, not a planned one.

1. Accounts are optional, and nothing is behind them

Every page, every fixture, every model figure and every follow works with no account at all. An account exists for one reason: to carry the clubs, players and competitions you follow to your other devices, and to give server-side alerts somewhere to be delivered. Nothing on Socostars is paywalled by it.

If you do create one, we hold exactly this:

• Your email address — stored as you typed it for display, plus a lowercased copy that carries the uniqueness rule so the same address cannot become two accounts.
• Your name and profile picture — only when you sign in with Google and only because Google sends them to identify you.
• A password digest — when you choose a password, never the password itself. What is stored is a scrypt hash with its own random salt, so the same password on two accounts produces two different rows and the original cannot be recovered from the database.
• Your follows — the entity keys you have starred, in one jsonb column on your own row.
• Timestamps — when the account was created, last updated and last seen. Last-seen is used to keep the service running, not to build a profile.

There is no advertising component, no analytics vendor, no third-party tracking script and no data broker in this stack. We do not sell or share account data with anyone.

2. Data stored on your device

Two preferences are saved in your browser's localStorage so the interface remembers them between visits:

• socostars.watchlist — the matches and clubs you star.
• socostars.coverage — which of the indexed leagues you have enabled.

These values never leave your browser and can be cleared at any time from your browser settings.

3. Cookies

The application sets no cookies at all unless you sign in. If you do sign in, one cookie is set:

• socostars_session — a signed token that says which account is signed in. It is HttpOnly, so no script on the page can read it; SameSite=Lax, so it is not sent on cross-site requests; Secure on the deployed site, so it is never sent over plain HTTP; and it expires after 30 days. Changing your password invalidates every cookie issued before the change, on every device, immediately.

A short-lived socostars_oauth cookie exists for the ten minutes of a Google sign-in handshake, to prove the callback belongs to the browser that started it. It is removed as soon as the handshake finishes or fails. There are no advertising, analytics or preference cookies anywhere on this site.

Signing out clears the session cookie. If advertising or analytics are ever enabled, this notice must be updated first and any consent requirement handled before those tools load.

4. Third-party requests

To display fixtures, results, tables, rosters and news, the site requests data from the providers below. Our own server makes the provider calls and caches the answers, so in most cases the provider sees this site's server rather than your browser:

• football-data.org (v4) — the primary source for fixtures, kickoff times, full-time scores, standings, each club's registered squad and the recorded scorer table. The API token is held in this site's server environment and is never sent to the browser; requests are made through our own serverless route and edge-cached.
• API-Football (v3.football.api-sports.io) — fixtures, registered squads, injuries and head-to-head where football-data.org does not cover the competition. Its key is likewise held server-side only.
• News publishers — the news centre, the dashboard news flash and every club page read publishers' own public feeds (BBC Sport, Sky Sports, The Guardian, ESPN) and the Google News index through this site's own /api/news route. Only the publisher's headline, its published description, its timestamp and a link back to its article are shown and cached; articles are never copied, rewritten or republished, and a source that does not answer is shown as unavailable rather than filled in. The GDELT public index is off by default and can be enabled by the operator as an extra source.
• openfootball football.json league data (served from GitHub's raw content host)
• ESPN public soccer scoreboards
• Wikipedia / Wikimedia APIs — including each club's published current-squad list, which is requested through this site's own serverless route so your browser never contacts Wikipedia directly
• TheSportsDB public API
• a Transfermarkt-derived public dataset (served from GitHub's raw content host)
• football-data.co.uk — the free results, match-statistics and expected-goals CSV archive (fetched at build time by this site's own build step; no request is made from your browser, and no odds columns are imported)

Each card in the interface names the provider it came from. We do not re-publish those feeds beyond the browser session, except for generated files that are cached on our own host so a page loads instantly.

5. Hosting

The site is served by Vercel, which keeps standard access logs (including IP address, timestamp and requested URL) for security and operations. Those logs are controlled by Vercel, not by this application.

6. Your rights

Your follows and alert settings are preferences, not personal data, and they live in your browser: clearing site data removes them completely and immediately, with no account involved.

If you have an account, you can delete everything it holds. Ask the operator using the contact route below and the account row — email, name, picture, password digest and follows — is removed in full, because it is a single row rather than a set of records spread across tables. This is a manual step today: self-service deletion is not wired up yet, and the account page says so rather than offering a button that cannot deliver.

If you are in a jurisdiction with additional statutory rights, contact the operator of this deployment using the contact route below.

7. Changes

Any material change to how data is handled will be reflected on this page, with the date above updated.