Privacy policy

1. Who is responsible

Legends XI is a personal project by Guilherme Abrantes, made in Portugal. It is not a company. He is the data controller under the GDPR, and he answers that email address.

2. What we collect, and when

None of this is collected by default. Each row happens only when you do the thing in the first column.

When	What gets stored
While you play without an account	Your team and campaign progress are stored on the server, in a session row — along with your IP address and your browser. No name, no email, no account: the row deletes itself after 120 minutes without you coming back.
When you ask to create an account	The name, the display name other people see, the email and the encrypted password are held for 15 minutes, waiting for the code we email you. If you never enter it, they delete themselves — and no account is ever created.
When you confirm the code	That is when the account is created: the name you typed, the display name, your email, and your password, encrypted (we cannot read it either).
While you are signed in	Your IP address and your browser, attached to the session. And the moment of your last activity in the game — a single instant, which keeps getting replaced; we do not keep a history of those instants. Only whoever runs the game sees the exact time; the other people in a championship of yours see only an approximate indication (see the "When you play an online championship" row).
When you submit a Daily Challenge	The nickname you type, the result, and a code derived from your IP (see next section).
When you play with an account	Campaign and duel results, for your profile and the leaderboards.
When you play an online championship	Your whole squad, your money, your training and whatever you ask the scout — all tied to that championship, and deleted with it. Any transfer you make is visible to the other people in that championship, by design: that is how the market works. The other people in it also see an approximate indication of the last time you were in the game ("now", "2h ago", "3d ago") — never the exact time.
When your championship match happens	That there was a match, against whom, in which round and which competition — so we can email you about it. Turn this off any time, in your profile or through the link in every such email.
When someone makes an offer for a player of yours, or counters an offer of yours	Who it was, for whom, and how much — so we can email you about it. Turn this off any time, in your profile or through the link in every such email.
When you ask for the supporter badge	The photo of the transfer receipt you send, the amount you say you transferred, and any note you write. The photo is re-encoded on the server when it arrives, which strips every piece of metadata it carried — including where it was taken, which phone photos store without anyone noticing. Only whoever runs the game sees it, and it is deleted 30 days after your request is decided: the record of the donation stays, the image does not.
When you share a team	The eleven and the result. No name at all — the link does not say who made it.
Every time you open a page	The server access log: IP, page requested, and time.

The display name is the only one that shows to other people — in leaderboards, the market, duel history, and the supporters page, along with the date of your first donation, if you support the project and choose to appear there. The name you typed at registration never leaves here.

3. The code derived from your IP — what it is, and what it is not

The Daily Challenge counts one submission per person per day. So that we know you have already submitted without storing your IP address, we store a code computed from it with a secret server key (SHA-256).

We do not call this "anonymous", because it is not. Anyone holding the server key could, given time, walk through every possible address until they hit yours. The law calls this pseudonymisation and still treats it as personal data — and so do we.

4. On what legal basis

What	Why	Legal basis
Account and session	Without them there is no profile, no leaderboard, no duels.	Performance of a contract (art. 6(1)(b))
Email verification code	Confirming the address is really yours before the account is created.	Performance of a contract (art. 6(1)(b))
Password reset email	So you can get back in.	Performance of a contract (art. 6(1)(b))
Notice that your championship match happened	So you know you can go watch it, without having to come check yourself.	Legitimate interest (art. 6(1)(f))
Notice of a market offer or counter-offer	So you know an offer or counter-offer is waiting for you, without having to come check yourself.	Legitimate interest (art. 6(1)(f))
IP code in the Daily Challenge	A fair game: one submission per person per day.	Legitimate interest (art. 6(1)(f))
Access logs and rate limits	Keeping the site up and defended against abuse.	Legitimate interest (art. 6(1)(f))

5. How long we keep it

Unconfirmed registration: 15 minutes. After that the name, email and password delete themselves, having never been an account.
Account: as long as you have one. Delete it and it is gone.
Session (IP and browser): 120 minutes of inactivity.
Password reset code: 60 minutes.
Daily Challenge: kept, so past leaderboards stay true — but anonymised if you delete your account.
Access logs: rotated by size. In practice, days.
Backups: 7 days for the one on the server, 30 for the one in the archive.

6. Who we share it with

Nobody, for money. Only the parties the site needs to exist:

Who	What for	Where
Amazon Web Services (EC2 and S3)	Hosts the site and the database, and stores the backups.	Ireland (EU)
Resend	Sends the registration verification code, the password reset email, and the match and market notices. Receives your email address and the contents of those messages.	Sends from Ireland (EU). Sending logs are held in the USA.
Bunny Fonts	Serves the site typeface. Your browser fetches the file from them, and your IP is visible to them in that request.	European Union
Cloudflare (Web Analytics)	Counts page visits — no cookies, and no profile built from your IP.	Cloudflare, Inc. (USA); under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses.

Visit measurement, done by Cloudflare Web Analytics, which uses no cookies; no advertising; and no sale or exchange of data with anyone.

One thing does leave the European Union, and it is only fair to say so plainly: Resend is a US company (Plus Five Five, Inc., San Francisco). The emails go out from servers in Ireland, but the record that a message was sent to you — and your address — is stored in the United States, under the European Commission's Standard Contractual Clauses, which is the mechanism the GDPR provides for such transfers.

This page used to say "nothing leaves the European Union". That stopped being true in August 2026, when email sending moved to Resend, and the sentence was corrected rather than left there lying. The previous provider, Amazon SES, was entirely European — but refused us permission to send to any address other than our own, which made it impossible to create an account on this site.

7. Cookies

legends-xi-session — holds your session, and your half-finished draft if you have no account. The game does not work without it.
XSRF-TOKEN — stops another site making requests in your name.
lxi-idioma — remembers your choice between Portuguese and English, made when you click PT|EN. It only exists because of that click, and lasts a year.

Visit measurement uses Cloudflare Web Analytics, which uses no cookies at all — it adds nothing to this list, which is exactly why it was chosen.

That is all three. The first two are strictly necessary; the third only exists because you clicked to choose a language, which the law exempts too. That is why no banner gets in your way: it is only required for cookies you could do without — and we have none of those.

8. Your rights

Know what we hold about you.
Correct it — name, email and display name all change in your profile, without asking anyone. One exception: the display name can change again only 7 days after the last time.
Delete it — there is a button in your profile. What it does is in the next section.
Take your data with you, in a format something else can read.
Object to the processing we do on legitimate interest.

Ask by email and we answer within 30 days. If you think we handled your data badly, you can complain to the Portuguese authority, the CNPD — cnpd.pt.

9. Deleting your account: exactly what happens

Your account, your campaign results and your duels are deleted.
Your Daily Challenge submissions stay, but the nickname becomes “Jogador apagado” and the code derived from your IP is destroyed.
If you played an online championship with other people, your progress in it disappears — but your display name keeps showing up in their campaign, because it was recorded when the championship began and does not update itself. It is always the game name, never the real one. Write to us if you want it swapped for “Jogador apagado” there too.

Why not delete that row too? Because it would rewrite old leaderboards: whoever came second that day would become first months later. The score stays; the person does not.

Submitted without an account? Then there is no account to delete — and we have no way to confirm that a nickname is yours. Write to us and we will delete the row you point at. It is also why we tell you not to use your real name in the Daily Challenge.

10. Age

There is no minimum age to play. The whole game — draft, campaign, Daily Challenge, leaderboards, catalogue — works without an account, and without an account we keep no name and no email — only the session that holds the game, which deletes itself.

To create an account you must be 13, or have permission from whoever is responsible for you. Thirteen is the threshold Portuguese law sets (Law 58/2019, under art. 8 of the GDPR).

We do not ask anyone their date of birth, not even to check this age. Asking a child for one more piece of data to prove they are a child makes the very problem the age limit is meant to solve worse. If you know of an account belonging to someone under 13, write to us and we will delete it.

11. The footballers in the catalogue

The game stores the name, nationality and birth year of real footballers, with a rating for what each did in that competition. These are published sporting facts, used under legitimate interest, to inform and entertain. We store nothing about anyone’s private life.

If you are one of the players and want your entry out of here, write to us.

12. Security

Passwords are stored encrypted with bcrypt. We cannot read them, which is why we can never tell you yours — only replace it.
The whole site is served over HTTPS.
There are daily backups: one on the server itself, and another in a separate Amazon archive (S3), also in Ireland.

Like any small project, we cannot promise you absolute security. What we can promise is that we do not keep what is not needed — the one defence that never fails.

13. If this changes

The date at the top changes whenever the text does. If the change is substantial — new data, a new purpose, a new third party — we say so inside the game before it takes effect, not quietly.

Talk to us

To exercise any of the rights above, or just to ask anything at all about this:

legendsxifut@gmail.com