Privacy Policy
Last updated: 2 August 2026
This policy explains what 321 Football collects, why, and what you can do about it. It is written to be read, not to be survived. If anything here is unclear, write to us at support@321football.com and we will answer in plain language.
Who is responsible
321 Football ("we", "the app") is operated by the developer reachable at support@321football.com. For users in the European Economic Area and the United Kingdom, we are the data controller for the data described below. For users in Türkiye, the same role is described as veri sorumlusu under KVKK.
What we collect
We collect what the game needs to work. The app shows ads; how they work and what they involve is set out in full under *Advertising* below.
If you play as a guest
| Data | Why |
|---|---|
| A device identifier we generate | To return you to the same guest account on this device |
| A device secret (stored as a one-way hash) | So nobody else can claim your guest account |
| Your chosen language | To show the app in the right language |
| Match results and answer times | To run the match and show scores |
Everything in this table is processed on our own servers. We never read your phone's IMEI or MAC address under any circumstances. Your device's advertising ID is available only to ad networks, and only if you allowed it — see *Advertising*.
If you create an account
In addition to the above:
| Data | Why |
|---|---|
| Email address | Sign-in and account recovery |
| Password (stored as an Argon2id hash, never in plain text) | Sign-in |
| Username | To show you to other players |
| Country (only if you choose one) | Country leaderboard |
| Favourite club (only if you choose one) | Shown on your profile |
If you sign in with Google
Google sends us an identity token. We verify it on our server and read only your Google account identifier and email address. We never receive your Google password. Google's own processing is covered by Google's privacy policy.
If you join through a friend's invite
The Invite friends screen creates a permanent invite code for your account. Sharing it is entirely optional.
| Data | Why |
|---|---|
| Your invite code | To link you to the person who invited you |
| Who invited whom | To credit the reward to the right account and limit abuse |
This link exists only for the reward: we do not reveal your identity to the person you invited, and we never show anyone the list of people you invited. Deleting your account anonymises this record too.
If you send us feedback
The Feedback screen inside the app lets you send a suggestion or report a bug. This is entirely optional.
| Data | Why |
|---|---|
| The text you write | So we can understand the suggestion or bug |
| Your reply email address (only if you type one) | So we can get back to you; you may leave it blank |
| App version, platform and language | So we can find out under which conditions the bug happens |
Only we read this text; it is never shown to other players and has nothing to do with advertising.
What we deliberately do not collect
GPS location, contacts, photos, microphone, camera, health data and browser history. The app asks for local network access only when it is configured to reach a development server on the same Wi-Fi; the public release connects to our own servers over HTTPS and does not request it.
Usage analytics
We use Google Analytics for Firebase to understand which parts of the app are used. The purpose is product improvement: which game mode is played, how many matches are abandoned, and where players get stuck.
What is collected
| Data | Note |
|---|---|
| App opens, session length, screens viewed | Shows how many people play and where they stop |
| Match start and end, and the game format played | To measure which mode works |
| That a rewarded ad was watched | To audit whether the reward was actually granted |
| Your interface language | To see how many players come from which country |
| A random app instance identifier | Generated by Google; not tied to your name or email |
What is not collected
Your account is not joined to analytics. We do not write your user ID to Analytics; your email address, username, friend list, match history and the answers you submit never reach the analytics system. Analytics data is not used for ad targeting.
If you want to reset the installation identifier, uninstalling and reinstalling the app is enough.
Advertising
The game is free to play and ads pay for it. The ads are served by third-party ad networks, not by us. That means there is a flow of data from your device straight to the network while an ad is being shown, and that flow does not pass through our servers.
What the ad network can see
| Data | Note |
|---|---|
| The device advertising ID (IDFA on iOS, AAID on Android) | Only if you allowed it. You can reset or switch it off in your device settings |
| IP address | Determines which country or city the ad is shown in; held briefly by the network |
| Device model, OS version, screen size, language | So the ad renders correctly |
| Whether an ad was shown, seen and tapped | The network pays out on these counts |
| App name and version | Which app the ad appeared in |
No account data is shared with the ad network: your email address, username, password, friends list, match history and answers never reach it.
Consent: targeted ads only if you want them
- On iOS the app shows Apple's *App Tracking Transparency* prompt. If you
choose "Ask App Not to Track", your advertising ID is not read and you see contextual ads only — chosen by the app you are in, not by an interest profile. Nothing in the game changes; no feature is withheld.
- In the European Economic Area, the United Kingdom and Switzerland a consent
prompt appears before any ad network is initialised. Without consent, no personalised ads are shown and no advertising identifier is written to or read from your device. You can withdraw consent at any time under *Profile → Settings → Ad preferences*.
- In Türkiye personalised advertising relies on explicit consent under
Article 5/1 of the KVKK; you can withdraw it from the same screen.
- No user who indicates they are under 18 is shown personalised ads. Those
accounts get contextual ads only, and the advertising ID is never read.
Limiting it from device settings
- iOS: Settings → Privacy & Security → Tracking
- Android: Settings → Google → Ads → Delete advertising ID
These settings apply to your whole phone, not just to our app.
Why we are allowed to process it (GDPR Article 6)
- Performance of a contract — running the game you asked to play: account,
matches, leaderboards, friends.
- Legitimate interests — keeping the service secure, preventing abuse and
multi-accounting, and fixing faults. We limit this to what is necessary and you can object (see *Your rights*).
- Consent — where we ask for it explicitly, such as connecting Game Center.
You can withdraw consent at any time.
We do not rely on consent for the basic operation of the game, because you cannot play without an account of some kind.
Who else sees it
We do not sell personal data for money.
Our own team: authorised team members may view your account details (username, email, match records) to handle support requests, review reports and investigate abuse. Access is permission-based and every action is logged.
Beyond that, data goes to three places:
1. Infrastructure providers (server hosting, database, error logs). They act as processors: they may only act on our instructions and may not use the data for their own purposes. 2. Ad networks — only the technical data listed under *Advertising*, and only if you allowed it. Ad networks also process for their own purposes, which makes them separate controllers rather than processors; their own privacy policies apply. 3. Store providers (Apple, Google) — for purchases only.
California (CCPA/CPRA) notice: the data flow to ad networks for personalised advertising may count as a "sale" or "share" under California law. You have the right to opt out: turn it off under *Profile → Settings → Ad preferences*, or write "Do Not Sell or Share My Personal Information" to support@321football.com. If you opt out you keep using the app exactly as before; you simply see contextual ads.
Other players see your username, your score in matches you play together, your answer times in those matches, and your country if you set one. They never see your email address or your device identifier.
Where it is stored
The service is hosted in the European Union. If we ever move data outside the EEA, we will do so under the European Commission's Standard Contractual Clauses or an adequacy decision, and we will say so here.
How long we keep it
| Data | Retention |
|---|---|
| Account data | Until you delete your account |
| Guest account data | 12 months after your last match |
| Match history | Until you delete your account |
| Security logs (IP address, failed sign-ins) | 90 days |
| Question reports you send | 24 months, so we can audit data corrections |
| Feedback you send (suggestions, bug reports) | 24 months; unread items are never deleted |
Deleting your account removes your personal data. Match records are kept in an anonymised form (no username, no account link) so that opponents' scores and rankings stay correct — a match cannot be un-played for the other person.
Your rights
Wherever you live, you can ask us to:
- See what we hold about you
- Correct anything that is wrong
- Delete your account and data
- Export your data in a portable format
- Object to or restrict processing based on legitimate interests
You can delete your account from inside the app: Profile → Account → Delete account. It takes effect immediately; there is no waiting period and you do not have to email anyone.
If you are in the EEA or UK you may complain to your local data protection authority. If you are in Türkiye you may apply to the KVKK. If you are in California, you additionally have the right to know, delete, correct and to opt out of "sale" or "sharing" — we do neither, so there is nothing to opt out of.
To exercise any right, write to support@321football.com. We answer within 30 days.
Children
The app is not directed at children under 13 (under 16 in some EEA countries). We do not knowingly collect data from them. If you believe a child has created an account, write to us and we will delete it.
Security
Passwords are hashed with Argon2id. Device secrets are stored only as hashes. Provider API keys are encrypted with AES-256-GCM. Sessions expire and can be revoked. Traffic between the app and our servers uses HTTPS.
No system is perfect. If we suffer a breach that puts your rights at risk, we will notify the competent authority within 72 hours and tell affected users without undue delay.
Changes
If we change this policy in a way that affects you, we will show a notice in the app before the change takes effect. The date at the top always reflects the current version.
Cookies and web advertising
This section applies only to our marketing site (321football.com); the mobile app does not use cookies.
We show ads on the site through Google AdSense. Google and its third-party vendors use cookies and similar identifiers to serve and measure ads. Google may use advertising cookies to show you ads based on your visits to this site and other sites across the internet.
You can turn off personalised advertising through Google Ads Settings, and manage third-party vendor cookies at aboutads.info. You may also block cookies entirely in your browser; the site keeps working without ads.
For visitors from the European Economic Area, the United Kingdom and Switzerland, advertising cookies are not used for personalisation without consent.
We use no analytics or tracking cookies beyond those required for the site to function.