Privacy Policy

1. Who we are

Game2Join Ltd is responsible for your personal information. In data protection law we are the “controller”, which means we decide what is collected and why.

We are registered in England and Wales, company number 17427723. Our registered office is 10 Oakleigh Avenue, Edgware, England, HA8 5DT.

For anything about your personal information — including any of the rights in section 10 — email support@game2join.com. We do not have a data protection officer; we are not required to have one.

2. What we collect

When you create an account: your name and email address, and your confirmation that you are 18 or over with the date you gave it. We do not ask for or store your age or date of birth. We have never asked for a phone number or a postal address, and there is nowhere in our system to put one.

Optionally, and only if you choose to: a photo, your playing level and your spirit of the game. Skipping them costs you nothing.

When you use the app: the games you create or join, including the venue and time; whether you are playing in a game you organise; ratings and Man of the Match votes you give; anyone you block; and any report you file, including what you write in it.

When you pay or get paid: see section 3.

When you contact us through the support or contact form: your name, email address and whatever you write. That is sent to our support inbox as an email. It is not stored in the app.

Automatically, and briefly: your IP address, used to limit how often the contact form and checkout can be submitted from one connection, so they cannot be flooded. It is held in the server’s memory for a few minutes and never written to our database.

Some things about you are worked out rather than collected: your rating and the number of ratings behind it, your games played, and your Man of the Match count.

3. Why we use it, and our legal basis

Data protection law requires a specific legal basis for each purpose. Ours are:

Running your account and the games you join — creating your account, showing you games, putting you on a game, telling the organiser you have joined. Basis: performing our contract with you.

Taking payment and paying organisers — holding and taking your payment, refunding you, and transferring an organiser their money. Basis: performing our contract with you.

Keeping financial records — what was paid, refunded and transferred. Basis: a legal obligation we have as a UK company.

Emails and notifications about your games — booking confirmations, kick-off reminders, and telling you when a game is cancelled or you are refunded. Basis: performing our contract with you. These are part of the service and cannot be switched off while you have a game booked, because not receiving them would leave you turning up to a game that is not happening.

Other, occasional emails that are not about a specific booking. Basis: our legitimate interests in running the service. You can turn these off in your account settings or from the unsubscribe link in the email, and turning them off changes nothing about the emails above.

Keeping games safe and civil — reports, blocking, suspending accounts, and the ratings other players see. Basis: our legitimate interests — specifically, that people paying to play with strangers can see who they are paying and can report and avoid someone who behaved badly. We think that outweighs the limited privacy impact, because the information involved is a name, a photo and a rating, shown only to people already in the same game or considering paying that organiser.

Confirming you are 18 or over. Basis: our legitimate interests in running an adults-only service, using the least information that answers the question — a yes, and the date, rather than your date of birth.

Stopping abuse of our forms — the IP-based limits described in section 2. Basis: our legitimate interests in keeping the service working and keeping real messages from being lost in automated noise.

Answering you when you contact us. Basis: our legitimate interests in replying to people who write to us.

Your name and email address are required to have an account — without them we cannot create one, because we would have no way to sign you in or tell you a game was cancelled. Everything in the second paragraph of section 2 is genuinely optional.

4. Payment information

We use Stripe to process payments. We never see or store your card number — it goes directly to Stripe. What we hold is a record of the payment: the amount, the currency, whether it was taken or refunded, and Stripe’s own reference for it.

If you organise games and take payment, you create a Stripe account through us. Stripe asks you directly for the details it needs to pay you and to meet its own legal checks. We do not see those details; we hold only the account reference Stripe gives us and whether the setup is finished.

5. Who can see your information

As a player, your name and photo are visible only to people you share a game with — other players in the same game, and that game’s organiser. If you organise a public game, your name and photo are also visible to any other signed-in user, whether or not they have joined that game — so someone deciding whether to pay you can see who they’re paying. This lasts: once you have organised a public game, you stay visible to signed-in users afterwards, including after that game has finished or been cancelled. This does not apply to a private game, and it does not apply to you if you have never organised a game. Nobody’s name and photo are visible to a visitor who is not signed in.

6. Who else handles your information

We do not sell your information and we do not share it for advertising. These companies handle it so that we can run the service:

Supabase — our database, our login system, and where your photo is stored.

Vercel — hosts the app and runs its server code. Their server logs briefly record requests, which includes your IP address.

Stripe — payments, refunds and organiser payouts.

Resend — sends our emails. They handle your email address and the contents of the email.

Cloudflare — when you sign up, log in, or ask to reset your password, a check runs to tell a person apart from an automated program. Cloudflare receives your IP address and information about your browser. It does not receive anything you typed into the form — not your email address, not your password, not your name.

If you open the map to drop a pin when creating a game — and only if you open it — three more are involved, because the map is not ours: the OpenStreetMap Foundation serves the map images, Cloudflare serves the map’s pin graphics, and when you drop a pin, OpenStreetMap’s Nominatim service is sent those coordinates to turn them into an address. Each of them receives your IP address as part of the request. If you type the venue name yourself instead of opening the map, none of this happens.

We may also share information where the law requires it.

7. Where your information is held

Our database is hosted in Frankfurt, Germany, and our server code is configured to run there too.

Being straight about the limits of that: Vercel’s own terms do not guarantee the data stays in Europe — they say their primary processing is in the United States and may be anywhere else in the world. Stripe, Resend and Cloudflare are United States companies, and Cloudflare runs its checks on a network of servers around the world rather than in one place. So some of your information does leave the UK and Europe.

Where it does, those transfers are covered by the contractual protections UK law recognises — the Standard Contractual Clauses together with the UK International Data Transfer Addendum, which all five have agreed to. Stripe and Resend are additionally certified under the UK extension to the EU–US Data Privacy Framework.

8. How long we keep it

While your account exists. Your profile, your places in games, your notifications, the ratings and votes you gave, anyone you blocked, and reports you filed are kept while you have an account. Delete your account and they are deleted — along with your login and your photo. Section 11 covers how.

Financial records: kept, with your name removed. UK law requires a company to keep its accounting records for six years from the end of the financial year they relate to, and sometimes longer. Payment and payout records therefore survive deletion of your account — but your identity is removed from them at the moment you delete, so what remains is an anonymous financial entry.

Games you organised, and reports about you: kept, with your name removed. A game that happened, happened, and the people who were there still have it in their history. Your name comes off it.

Server logs: about a day. Our host keeps runtime logs for roughly 24 hours on our plan, then they are gone. They contain internal reference numbers rather than your name or email address.

Emails you send us stay in our support inbox for as long as we need them to deal with what you wrote about and to keep a record of having dealt with it.

Accounts nobody is using. We keep your account for as long as you use Game2Join. If you have not signed in for three years, we will email you first, and then delete it. We check this ourselves rather than running a timer in the background, and no account is old enough for it to have happened yet.

Reports, once they are settled. When a report has been dealt with, we will delete it two years later — including whatever was written in it about another person. This is the same kind of check, done by us rather than automatically.

9. Decisions made automatically

Two things happen without a person deciding, and you should know about both.

An automatic refund when several players report the same game. If three different players report that a game did not happen — the organiser did not turn up, the pitch was not booked, or the game did not take place — our system cancels the game and refunds everyone straight away. The organiser receives nothing for that game. No person reviews this before it happens.

An automatic hold on an organiser’s payout. Money for a game is held for about two days after kick-off before it is transferred. If anyone reports the game in that window, the transfer stops and waits for one of us to look at it.

Separately, an organiser’s rating is recalculated automatically as the average of the ratings players have given them. It affects what other players see, not their money.

If one of these has affected you and you think it is wrong, email support@game2join.com and a person will look at it. Suspending an account is never automatic — that is always a decision one of us makes.

10. Cookies

We do not set any cookies, and we do not use analytics or tracking of any kind. When you sign in, your browser stores your login session so you stay signed in — it stays on your device and is cleared when you sign out.

11. Your rights

You have the right to:

See what we hold about you, and get a copy.
Have it corrected if it is wrong — you can edit your name, photo, playing level and spirit yourself in the app.
Have it deleted.
Ask us to pause using it while a dispute about it is sorted out.
Object to us using it where our basis is legitimate interests — the purposes marked that way in section 3.
Take it with you, in a machine-readable form, for the information you gave us and the information we hold to perform our contract.

To use any of these, email support@game2join.com. We will reply within one month. There is no charge.

Deleting your account you can do yourself, immediately, without asking us: Account Settings, then “Delete Account”. This permanently removes your profile — your name, email, and photo — along with your login itself, your own ratings and Man of the Match votes, and your place in any game.

Payment and payout records are kept after deletion, not erased, because we are legally required to retain financial records for accounting and tax purposes. Your name and other identifying details are removed from these records at the same time your account is deleted — what remains is an anonymous financial entry, not anything that identifies you.

Similarly, a game you have hosted, or a Man of the Match award you have won, remains part of the record other players share — a game that happened, happened — but with your name removed from it.

If you have a payment or payout that has not yet finished processing (for example, a game you are hosting still has players signed up, or a refund is still being confirmed), deletion is not completed immediately — you will be told what is still outstanding and can delete your account once it has resolved.

12. Complaining

If you are unhappy with how we have handled your information, please tell us first at support@game2join.com — we would rather fix it.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at any time. You do not have to come to us first. They are at ico.org.uk/make-a-complaint or 0303 123 1113.

13. Changes to this policy

If we change this policy we will update the date at the top of this page. The date is the version.

14. Contact us

If you have any questions about this Privacy Policy, please contact us at support@game2join.com.