Matchday XILog in

Matchday XI — Privacy Policy

Last updated: September 29, 2026

1. Who We Are

Matchday XI ("we," "us") operates the Matchday XI football prediction platform at https://matchdayxi.app/. For privacy-related questions, contact: eduonyiaedu@gmail.com.

2. What Data We Collect

  • Account information: email address, display name, password (stored securely, never in plain text).
  • Usage data: your selected favorite team, submitted predictions, points earned, login dates (for streak tracking), private competition memberships/creations, when you use the app (session activity, for usage statistics), and whether you shared or saved a prediction card.
  • Notification data: if you turn on notifications, the push address your browser gives us for this device. It is removed when you log out on that device or delete your account.
  • Technical data: IP address, device/browser information, collected for security and service-reliability purposes.

We do not currently collect payment or financial information, as paid features are not yet active.

3. How We Use Your Data

We use your data to:

  • Operate your account, predictions, and leaderboard standings.
  • Calculate login streaks and prize eligibility.
  • Communicate service updates, including matchday reminders.
  • Maintain security and prevent abuse (e.g. duplicate-account detection).
  • Improve the Service over time.

4. Legal Basis for Processing

We process your personal data on the basis of your consent (given at account creation) and as necessary to perform our contract with you (i.e. providing the Service you signed up for), consistent with the Nigeria Data Protection Act 2023.

5. Third Parties We Share Data With

  • Hosting and database infrastructure providers (used to run and store the Service) — these providers process account and usage data on our behalf as data processors, under their own security and confidentiality obligations.
  • Sports data providers (used to retrieve fixture schedules and official lineups) — these providers do not receive your personal account information; data flows one-way from them into the Service, not the reverse.
  • Bot-protection provider (Cloudflare Turnstile, on the sign-up and log-in forms) — checks that a real person, not an automated script, is creating or signing in to an account. It processes technical data from your browser for that check only.
  • Push notification services (run by your browser's maker — e.g. Google, Apple, Mozilla or Microsoft) — if you turn on notifications, the text of each notification is delivered to your device through that service.
  • Email delivery provider (Resend) — sends operational emails to the Matchday XI team, including end-of-season data exports that contain players' usernames and email addresses. Sign-in emails are sent by our authentication provider (Supabase).
  • Google, only if you choose to sign in with Google — we receive your name and email address from your Google account.

We do not sell your personal data to third parties.

6. Data Retention

We retain your account and usage data for as long as your account remains active, and for a reasonable period afterward as needed for legal, security, or record-keeping purposes. You may request deletion at any time (see Section 8).

7. Cookies & Similar Technologies

The Service uses a small number of first-party cookies necessary for login and core functionality. One of these holds a random device identifier (it contains nothing about you or your device) so we can recognise when several accounts are used from the same device — used only for fair play in prize draws and prizes (duplicate-account detection), never for advertising, and never shared. Accounts found this way are not blocked; they may be excluded from prizes, subject to review. We do not use third-party advertising or tracking cookies.

8. Your Rights

Under the Nigeria Data Protection Act 2023, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and associated data.
  • Object to certain processing of your data.
  • Withdraw consent at any time (which may limit your ability to use the Service).

To exercise these rights, contact us at eduonyiaedu@gmail.com.

9. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect data from anyone under this age. If you believe a minor has created an account, contact us for removal.

10. Data Security

We take reasonable technical and organizational measures to protect your data, including secure password storage and access controls. No system is completely secure, and we cannot guarantee absolute security.

11. International Data Transfers

Our hosting and database infrastructure may store or process data outside Nigeria. Where this occurs, we take steps consistent with NDPA requirements to ensure an adequate level of protection for transferred data.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated through the Service.

13. Contact

For privacy questions or to exercise your data rights: eduonyiaedu@gmail.com