GAFFER is a football arcade game. This page explains what the game does with data, in plain terms. Your Gaffer scores stay on your device. You can optionally sign in with a shared FootyZone account to manage your profile and friends. Google supplies advertising in the mobile app, and our server connects temporary private-room matches.
You can play as a guest. If you create or use an account, FootyZone stores your chosen player name, optional email, a password hash, sign-in sessions, friends, requests, blocks and Gaffer profile preferences. Use a nickname rather than your full name. Your identity and friendships are shared between Gaffer and FootyZone; Gaffer career scores and match history are not uploaded.
On mobile, the sign-in credential is stored using the operating system's Keychain. On the website, sign-in uses a secure HttpOnly cookie with a 30-day inactivity limit and CSRF protection. These cookies support account access and are not advertising cookies. Signing out removes the saved sign-in on that device or browser. The server stores a password hash, not your plaintext password; the app remembers a sign-in token rather than saving your password.
You can view your server account data, manage signed-in devices, or delete your shared account under Profile → Account settings. Deletion affects the shared FootyZone account and its server data across both products. Local Gaffer scores remain until this device's app or site data is cleared. See the FootyZone account privacy notice for more about account data. Keychain data may survive app reinstallation on iOS; sign out before uninstalling if you want to remove saved sign-in.
Apple handles subscription payment. We do not receive your payment-card details. Our server verifies Apple transaction identifiers and subscription status and links membership to your FootyZone account. We use purchase history, product identifiers, expiry and renewal information to provide paid access, restore purchases and handle refunds or revocations. These records are not used for advertising.
Manage or cancel your subscription through Apple subscription settings, available from Manage Subscription on the membership screen. Deleting your FootyZone account does not cancel your Apple subscription. Subscription records may be retained for transaction reconciliation and applicable recordkeeping requirements; contact us for questions or requests about those records.
High scores, local player names, career activity, your rivalry record and your difficulty setting are stored on the device itself, using the browser or app's own local storage. These local records are not synchronized to your account. During online matches, selected manager names and match moves are relayed to the other player as described below. Deleting the app or clearing the website's storage removes local game records; operating-system backups may retain a separate copy under your backup settings.
The mobile app uses Google Firebase Analytics to measure game opens, starts, completions, repeat play and time spent playing while the app is active. Firebase also collects installation and app/device information and may derive approximate location from network information. Crashlytics reports crashes and diagnostics. Signed-in activity can use an internal account identifier. We do not send your name, email, password or sign-in token in these reports. Firebase Analytics does not collect the advertising identifier in this integration.
You can turn off game usage and crash reporting under Profile → Account settings → Privacy & data. This does not prevent you from playing. Firebase reporting is not enabled for the website.
When game usage reporting is enabled, the app and website send our service the current screen, game, play mode, platform and a temporary launch identifier. Signed-in reports use your account. Guest reports use a randomly generated installation identifier stored on your device. Guest reports do not include a name, email or advertising identifier. Authorized administrators can see recent visits and which games reported active play, including guest visits.
The app reports background status when possible. A report expires from the live online list after 90 seconds. Recent visits and daily game activity stay for 30 days and are removed when another activity report arrives. You can stop new reports under Profile → Account settings → Privacy & data. Clearing local storage removes the guest identifier from your device.
The mobile app shows ads supplied by Google AdMob. To do that, Google's advertising software may collect and process an IP address (which can estimate coarse location), device identifiers, advertising data, interactions with the app and its ads, and diagnostic information such as crash and performance data. This is used to deliver and measure advertising, analyse performance, prevent fraud, and improve the advertising service.
This applies to the iOS and Android apps. The website at gaffer.footyzone.app shows no ads and includes no advertising software.
Google's own explanation of how it uses this data is at policies.google.com/technologies/partner-sites.
When regional privacy rules require it, GAFFER displays Google's consent message before requesting ads. You can accept or manage the purposes and ad partners shown in that message. If consent cannot be established, GAFFER does not request an ad during that launch.
On iOS, GAFFER also asks for permission before allowing cross-app tracking or access to the advertising identifier. Declining does not prevent you from playing. If permission is denied, restricted, or unavailable, GAFFER does not start its advertising SDK, request ads, or display advertising cookie consent forms. Account sign-in cookies are essential for authentication and are not used for advertising or cross-app tracking. You can change tracking permission later in iOS Settings; restart GAFFER after enabling it.
On supported iPhone builds, GAFFER uses the TikTok App Events SDK to measure advertising results. The SDK starts only when you allow tracking in iOS and game usage reporting is enabled. Events include the first SDK activation, app launches, game starts, and completed games. TikTok receives technical device and network information, an app-instance identifier, and, with permission, the advertising identifier. The SDK also reports technical error and performance diagnostics. Game events contain the game type, play mode, time played, and result category. GAFFER does not send account names, emails, phone numbers, player answers, or private room details to TikTok through this integration.
You can stop new advertising events by switching off usage reporting in GAFFER's Privacy & Data settings or revoking GAFFER's tracking permission in iOS Settings. TikTok uses received events for advertising measurement and optimization. See TikTok's privacy policy.
When you open or join a private room, the game connects to our server at
api.footyzone.app so the two devices can pass moves to each other.
That connection carries the six-character room code, your account name or chosen
display name, the selected game, and the moves and shared match state. Each
phone receives the information it needs to play; mystery answers and secret
choices are revealed at the appropriate point in the game.
Room membership and player names are kept temporarily in server memory. Match moves are relayed to the other player; they are not saved as match history. A room closes when a player leaves or disconnects, or when its 30-minute lifetime expires. We do not log match content. Technical connection and request logs are separate from room contents, as described below.
iOS build 20 and later receive app updates through the App Store and do not include the over-the-air update plugin. Earlier builds and other supported native platforms may check our update service for compatible game files. The request includes an app installation identifier, platform, operating-system version, app and game-bundle versions, and update-plugin version. Our service uses this to return a compatible update. It records platform/version information and update outcomes to operate the service; it does not store the request's installation identifier in its update log.
Our hosting and API servers also process IP addresses, request URLs, request times, browser/device information, search terms included in request URLs, and response/error details for service delivery, security and troubleshooting. Browser account sessions can retain IP and browser information while the session is active. Account sessions and recovery controls are linked to your account. We do not use these service logs for advertising. Our API web-server logs are configured for daily rotation with 14 retained archives. Other diagnostic and security logs follow their respective operational retention schedules.
Earlier native builds may also send update diagnostics to Capgo, including an installation identifier, system/app versions and update events. This optional vendor reporting is disabled starting with iOS build 14. Installing that native build or a newer one applies this change.
FootyZone operates the account and game services. Other players can see your player name through account search, friendships or a room you join. Your password and email are not included in friend-search results. Hosting providers process technical data to deliver the app and API; Google processes advertising and consent data under its own privacy policies. TikTok receives the consented advertising measurement and SDK diagnostics described above. We do not upload your phone's address book or your photos. Gaffer has no direct messaging or public user feed.
Account data is retained while your shared account exists. In-app account deletion removes its active server records, including Gaffer preferences and friendships, and revokes sessions. Operational backups and security logs are separate from the active account database and may remain until their retention cycles complete. Contact us for a deletion or access request concerning those records. Google controls retention of the data it processes; see its linked privacy information. Uninstalling the app alone does not delete your shared FootyZone account.
Gaffer uses a shared FootyZone account. You can request account deletion without installing the app:
You can also delete the account in Gaffer: open Profile → Account settings → Delete account.
Deletion removes the active shared account, Gaffer profile preferences, friendships, requests and blocks, and revokes sign-in sessions. Local scores remain on your device until you clear app data or uninstall. Operational backups and security logs may remain until their retention cycles complete; contact us for details about those records. Google retains data under its own policies linked above. Deleting the shared account also removes access to other FootyZone services using that account.
GAFFER is not aimed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided personal information through the app, contact us and we will look into it.
If this policy changes, the new version appears on this page with a new date at the top.
Questions about privacy in GAFFER: privacy@footyzone.app