Match XI

Privacy Policy

Last updated: 4 November 2026

This policy explains what data MATCH XI handles, why, where it goes, how long we keep it and what you can do about it. Most of the game works without an account, and then almost nothing leaves your phone.

Who we are

MATCH XI is offered by De vibecoders, Nieuwlandstraat 47-b, Tilburg, the Netherlands (KvK [PLACEHOLDER: KvK number], VAT NL005378032B09) ("we", "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). We have not appointed a data protection officer; for anything about your data, email support@match-xi.app.

In short

  • No account is needed to play. Without one, your games stay on your phone.
  • With an account we store your email address, the names you choose and your results, in the EU.
  • We do not sell your data, do not track you across other companies' apps or websites, and do not use your device's advertising identifier.
  • Ads are not personalised. Analytics only runs if you allow it.
  • You can delete your account in the app at any time.

Playing without an account

Your Draft history, games in progress, best scores and settings (such as your analytics choice) are stored on your phone. Without an account they are not sent to us, and deleting the app deletes them. Even without an account, the app downloads game content from our server, may show ads (see Advertising), sends crash reports (see Crash reports) and checks for app updates (see App updates). If you later sign in on that phone, the Drafts and Daily Challenge attempts you played there without an account are added to your account.

Your account

When you create an account we store: your email address and the sign-in method you used; a random account ID; the username and display name you choose (both optional); the avatar you pick; and when your account and profile were created and changed. If you sign up with email, your password is stored only in hashed form by our sign-in provider; you can also sign in with a one-time code that we email to you. We use this to create and run your account. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Sign in with Apple or Google

With Sign in with Apple, Apple confirms who you are and gives us your email address, or a private relay address if you choose to hide it. We do not save the name Apple may offer. We store a token from Apple only so we can revoke the Apple sign-in when you delete your account. With Google, Google confirms who you are and gives us your email address; our sign-in provider may also receive the name and profile picture on your Google account, which we do not show in the app. Apple and Google handle your sign-in under their own privacy policies.

Games and results

When you play while signed in, we store your Draft runs (your picks, settings, the game's random seed and your score), your Daily Challenge entries, your games in Online Draft, Friend Rooms, Last One Standing and other shared modes (including your answers there), your XP and level, and the medals you earn. Our server replays each result to check that it is genuine; only checked results are ranked or count for XP and medals. This check is automatic. It decides only whether a result counts in the game; it has no legal or similarly significant effect on you, and you can contact us if you think a result was judged wrongly. We also keep short-lived counters of how often an account makes certain requests, to stop abuse. Legal basis: performance of our contract, and our legitimate interest in fair competition and a secure service (Art. 6(1)(f) GDPR).

What other players see

Anyone using the app, with or without an account, can open your public profile and see: your shown name, your avatar, your level, the medals you have earned and a summary of your checked results (such as verified Drafts, best Draft score, Daily Challenges completed and Friend Room wins). On leaderboards, Daily boards and in shared games they see your shown name, avatar, score and rank. Your shown name is your display name, or your username if you have no display name, or "Manager" plus four characters if you set neither. In Online Draft, a finished, checked Draft of yours can be used as another player's opponent under your shown name. Other players never see your email address, account ID, sign-in method or purchases. Avatars are illustrations we provide; you cannot upload a photo.

If you report a player's name, the app opens an email to support@match-xi.app with the screen you were on. You type the name yourself; the app adds no account or device data.

Purchases

You can buy MATCH XI+ (a monthly or annual subscription), Remove ads, single Draft leagues and The Football Bundle. Apple handles every payment through the App Store; we never see your card or bank details. We use RevenueCat (RevenueCat, Inc., USA) to confirm what you bought. RevenueCat receives your MATCH XI account ID and the purchase details Apple shares (product, transaction, dates and status). We store the same purchase status with your account so the app can unlock what you bought on any phone you sign in on. Apple also sends us notices when a subscription renews, ends or is refunded. Legal basis: performance of our contract, and our legal obligation to keep financial records (Art. 6(1)(c) GDPR).

Advertising

The free version shows ads around some minigames: an ad after a game ends, and ads you choose to watch for a reward. Ads come from Google AdMob (Google Ireland Limited). Before any ad loads, Google's consent form asks for your choice where the law requires it; you can change it at any time in Profile > Ad privacy choices. Every ad request asks for non-personalised ads only, is marked as coming from a user under the age of consent, and is limited to ads suitable for general audiences. To show and count an ad and to prevent fraud, Google receives technical data such as your IP address, device type, operating system, app version and how you interact with the ad. We do not ask for permission to track you, do not use your advertising identifier and do not give Google your account, email address or game data. Google uses this data as an independent controller under its own privacy policy (policies.google.com/privacy). If you buy Remove ads or MATCH XI+, the app no longer requests ads. Legal basis: your consent where the law requires it (Art. 6(1)(a) GDPR), otherwise our legitimate interest in funding a free game (Art. 6(1)(f) GDPR).

Analytics

If you allow it, the app sends usage events to PostHog (PostHog, Inc.), stored in the EU, so we can see which parts of the game work and which do not. Events come from a fixed list (for example that a game was started or finished) and are linked to a random ID that is created on your phone, is not your account ID and is replaced when you sign out. There is no session recording, no location from your IP address and no advertising identifier. In the App Store version nothing is sent until you tap Allow, which we ask once, after your first finished game. You can change your choice at any time in Profile > Analytics. Legal basis: your consent (Art. 6(1)(a) GDPR).

Crash reports

If the app crashes or hits a serious error, a report is sent to Sentry (Functional Software, Inc.), stored in the EU (Germany). It contains technical information such as the error, the app version, your device model and iOS version. Before sending, the app removes email addresses, account IDs, IP address, tokens and your device's name, and the report is not linked to your account. Legal basis: our legitimate interest in an app that works (Art. 6(1)(f) GDPR).

App updates

The app checks for and downloads small updates through Expo (650 Industries, Inc., USA). Expo receives technical data needed to deliver the update, such as your IP address, the app version and your device platform. Legal basis: our legitimate interest in delivering fixes quickly (Art. 6(1)(f) GDPR).

Support email

If you email support@match-xi.app, we receive your email address and what you write. Our mailbox runs on Google Workspace. We use your message only to help you. Legal basis: our legitimate interest in answering you, or performance of our contract when it is about your account or a purchase.

Who we share data with

We do not sell your data. When you tap Share, your iPhone's share sheet opens with an image or short text of your result and you choose where it goes. Beyond that, these providers process data for us, on our instructions and under a data processing agreement that requires them to protect it at least as well as this policy does:

  • Supabase (Supabase, Inc.): database, sign-in (including sign-in code emails) and server functions, stored in the EU (Ireland).
  • Sentry (Functional Software, Inc.): crash reports, stored in the EU (Germany).
  • PostHog (PostHog, Inc.): analytics, only if you allow it, stored in the EU.
  • RevenueCat (RevenueCat, Inc., USA): purchase status.
  • Expo (650 Industries, Inc., USA): app updates.
  • Google Workspace (Google): our support mailbox.

Apple (App Store payments, Sign in with Apple) and Google (Google sign-in, AdMob ads) act as separate controllers under their own privacy policies. We may also share data where the law requires it, for example with a court or authority.

Data outside the EU

Where a provider processes data outside the European Economic Area (for example RevenueCat and Expo in the USA), the transfer is protected by the EU-US Data Privacy Framework where the provider is certified, or otherwise by the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards. Data travels encrypted, and our database lets each player read and change only their own private data.

How long we keep data

  • Account, profile and game data: as long as you have an account.
  • Abuse-prevention counters: they cover the last hour or day only.
  • Crash reports and analytics events: not linked to your account, kept no longer than needed to fix problems and improve the game, and deleted automatically by the provider.
  • Purchase records (product, dates, status and the account ID, never payment details): as long as needed for refunds, fraud prevention and accounting, and up to seven years where Dutch tax law requires it.
  • Support emails: as long as needed to help you.
  • Data stored only on your phone: until you delete the app.

Deleting your account

You can delete your account in the app: open Profile, open your account settings, tap Delete account and confirm. You may be asked to sign in again first. Your account, profile, uploaded Drafts, scores, XP, medals, entries and leaderboard places are removed from our systems immediately; remaining copies in backups are gone within 30 days. If you used Sign in with Apple, we revoke that sign-in with Apple. This cannot be undone. Finished shared games keep their results so other players' results stay correct, with you shown as "Deleted manager". Purchase records may be kept as described above. Deleting your account does not cancel a subscription: cancel it in your iPhone's Settings > your name > Subscriptions. If you cannot open the app, email support@match-xi.app from the address linked to your account.

Your rights

You have the right to access your data, to have it corrected or deleted, to receive a copy in a portable format, to restrict processing, and to object to processing based on our legitimate interests. Where we rely on your consent (analytics, ads), you can withdraw it at any time in Profile > Analytics or Profile > Ad privacy choices; this does not affect what happened before. To use your rights, email support@match-xi.app; we reply within one month. You may also complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live.

Do you have to give us data?

No. An account is optional. Without one you can still play every game on your phone, but you cannot appear on boards, play shared modes, earn XP or keep your progress across phones. If you buy something, Apple needs your payment details and we need your purchase status to unlock it.

Children

MATCH XI is meant for players aged 13 and over. If you are under 13, please do not create an account. If you are under 16 and live in the Netherlands (or another EU country with a similar rule), a parent or guardian must agree where we rely on your consent, for example for analytics. If you believe a child under 13 has given us personal data, email us and we will delete it.

Changes

We update this policy when MATCH XI changes what it does with data, for example before push notifications or a new provider are added. The date at the top shows the current version. If a change matters for you, we also tell you in the app.

Contact

Questions about this policy or your data: support@match-xi.app, or write to De vibecoders, Nieuwlandstraat 47-b, Tilburg, the Netherlands.