Privacy Policy

Last updated 7 October 2026

Who we are

Ball Knowledge is operated by Ryan Rudolph, in South Africa. That makes us the responsible party under the Protection of Personal Information Act, and the data controller under the UK and EU General Data Protection Regulation — two names for the same thing, which is that we are the ones who decide what is collected and why, and we are the ones you complain to.

All three apply at once, and not because we chose to be thorough. POPIA applies because we are here. The UK and EU regulations apply because you might not be: they reach any service offered to people in those places, wherever the service is run from. Where the three differ this notice describes whichever is stricter, so that there is one answer rather than three.

Write to support@ballknowledge.football for a copy of your data, a correction, a deletion, or anything else on this page. If you are signed in, the feedback form reaches the same place.

What we collect

Only what the game needs. Your email address, to sign you in. A username derived from it. Your year of birth, asked once when you create the account. And your match history — the questions you were asked, the answers you gave, how long you took, and the rating that resulted. If you send us feedback, we keep what you wrote, the page you were on and which account sent it, so that we can reply to the problem rather than to a stranger.

We also count page views, without a cookie and without storing anything in your browser. That count carries the page, the site that linked you here, and a country-level location worked out from your connection — which is the only location data that reaches us, and it is never tied to your account. The cookie policy describes it in full.

We do not collect your name, address, full date of birth, phone number or precise location. We do not ask for them and there is nowhere to enter them.

Playing as a guest

You can play the daily puzzles without an account. Doing that creates a guest: a random identifier, a placeholder username and the answers you give, kept in our database and tied to a session cookie on your device. A guest has no email address and no year of birth, and other players do not see it.

If you then create an account, the guest becomes that account and the games you played stay with it. If you do not, the guest and everything it played are deleted once it has gone thirty days without playing. Supabase sees your connection’s IP address when a guest is created and uses it to limit how many guests one connection can make.

Why we collect it

• Your email identifies your account and lets you sign in.
• Your match history is what a rating is. Without a record of results there is no way to compute or audit a Ball Knowledge Rating.
• Response times are stored because they break tied matches. They are measured by our server, never reported by your browser.
• Your year of birth decides what advertising you may be shown, and nothing else. We ask for the year rather than the full date because the year is enough to answer that question and the rest would be data we never use. You must be at least 13 to hold an account.

What is public

Your username and rating are visible to other players — that is the point of a rating. Your email address and year of birth are never shown to anyone else, and are stored so that only your own account can read them.

Who else sees it

Your data is stored with Supabase, which hosts our database and handles authentication. The site itself is served by Vercel, which also provides the cookieless page-view count described above. If you subscribe, Polar acts as merchant of record: they are the seller, they handle the payment and they hold the card details — which never reach us. Cloudflare Turnstile checks that a sign-in, signup, password reset or guest game comes from a person rather than a script: it sees your IP address and details of your browser and connection for that check, and Cloudflare also uses them to improve its bot detection. We have never sold data and we will not.

There is no advertising on Ball Knowledge today, so there is currently no advertiser or ad network receiving anything at all. We intend to add advertising, with a paid tier to remove it. When that happens this section will be rewritten before the first advert loads, naming the ad provider and what it receives — and no advertising cookie will be set without your consent. Players under 18, and anyone whose age we do not know, will be shown non-personalised advertising only.

How long we keep it

Match records are kept while your account exists, because deleting them would corrupt the rating history of everyone you played. If you delete your account, your profile, email and year of birth are removed and your past matches are anonymised rather than deleted. A guest that never becomes an account is deleted after thirty days without playing.

Our lawful basis

Your email, username, year of birth and match history are processed to perform the contract you entered into by creating an account — there is no game without them. That is Article 6(1)(b) of the UK and EU regulation, and section 11(1)(b) of POPIA, which both say the same thing in different words: we may hold what the service cannot run without. A guest game rests on the same basis: playing it is what you asked for, and the answers are how it is scored.

The cookieless page count and the crash reports rest on legitimate interests instead — knowing that a page is broken is necessary to run the service, and neither identifies you. The check that you are a person rests on them too: a game that scripts can sign up to in bulk is not one anybody can trust, and the check looks at your connection for a moment rather than keeping a record of you. Advertising, when it arrives, will run on consent, and consent will be asked for before the first advert loads rather than after.

Where your data is held

Your data does not stay in South Africa, so section 72 of POPIA applies: we may only send it somewhere that protects it comparably, or under a contract that makes the recipient do so. Both of ours are the latter.

The database and your account are with Supabase, in their Ireland region — inside the EU, which is where most of our players are. The site is served by Vercel, which operates globally and may process requests in the United States, and so does Cloudflare, which runs the check that you are a person. All three hold us to their own data processing agreements, which carry the standard contractual clauses that the UK and EU regulations require for the same journey in the opposite direction.

Your rights

You may request a copy of your data, ask for it to be corrected, ask for your account to be deleted, object to processing based on legitimate interests, or ask for your data in a portable form. Those are your rights under POPIA and under the UK and EU regulations alike; where the two lists differ, you get the longer one. Write to support@ballknowledge.football. We will answer within one month, which is the deadline the strictest of them sets rather than a target we set ourselves.

You do not have to write to us for the first or the last of those. Your account page will download everything we hold about you as a single file, and will delete the account outright. What deletion does is described under “How long we keep it” above: your profile, email address, year of birth and profile picture are removed, and past matches are anonymised so that the ratings of the people you played remain correct. It cannot be undone, so it asks you to type your username first.

If you think we have got this wrong, complain to the regulator where you are. In South Africa that is the Information Regulator, at inforegulator.org.za, which is also the one that supervises us. In the United Kingdom it is the Information Commissioner’s Office, at ico.org.uk. In the EU it is the data protection authority of the country you live in. We would rather you told us first, but that is a preference and not a condition.