Privacy

What is stored

Creating an account stores the following, and nothing else:

• Your email address and password, held by our authentication provider. The password is stored as a hash; it is never readable by us.
• A display name you choose, shown to other managers in leagues you join.
• Your language preference, so the app opens in the language you picked.
• Your date of birth and your wilaya (province). Both are required to play, and you must be 16 or over. No other manager can see them, and the app never shows them to operators: the operators’ statistics contain only totals per age group and per wilaya, which never identify a person. They are used for nothing else.
• An account role, which is “user” for everyone except operators.
• The date your account and profile were created and last changed.

What you create in the game

Your squad, transfers, captain choices, points and the private leagues you create or join are stored so the game can work. Other managers in a league you join can see your display name, your team and your score. That is the point of a league; if you do not want that, do not join one.

Measuring how the app is used

DZ Fantasy measures how its own website is used, with software we run ourselves. No third-party analytics service is involved, and the records stay in our own database (held by Supabase, listed below).

What is recorded:

• A random identifier for your browser, generated on your device and kept in its local storage (not in a cookie). It is not derived from your device, browser or connection, and clearing this site’s data creates a new one. We do not use browser fingerprinting.
• Visits (“sessions”): a session ends after 30 minutes without activity, and a new one begins after that.
• Which screen you open, as a general category such as “Fantasy” or “Player Profile” rather than the exact address, plus your interface language and whether you arrived directly, from elsewhere on the site or from another website (never that website’s address).
• Where a sponsor placement appears: that it was on screen (at least half of it visible for at least one second) and whether it was clicked.
• If you are signed in, these records are linked to your account so that one person is not counted twice. If you delete your account that link is removed; the records that remain carry only the random identifier.

What the measurement leaves out, and opting out

Never part of these records: your email address, name, date of birth, address, password or sign-in token.

Your IP address is not stored in these records. When your browser reports an event, the server turns the address into a one-way value (hashed with a secret) that is used only to limit abusive volumes of requests, and it is kept in a counter separate from the measurement records. The hosting platform’s own server logs, described below, are separate.

Measurement does not run if your browser sends “Do Not Track” set to 1 or the Global Privacy Control signal, or if you opt out by setting the value dzf_analytics_optout to 1 in this site’s local storage. There is no opt-out button in the app yet.

The Android and iOS apps take the same measurement, only while you are signed in: which screen you open (as the same general category), the app version, your account, and a random identifier for the app installation kept in the app’s own storage (uninstalling the app deletes it). When the app reports a screen, it proves that you are signed in with your sign-in token, which is checked and not stored. The browser signals above do not apply to the apps, and there is no opt-out setting in the apps yet.

These records are not currently deleted automatically.

What is not collected

There is no third-party analytics service, no advertising or attribution SDK, and no crash-reporting service in this application; the only usage measurement is the first-party measurement described above. We do not build advertising profiles of you, and nothing is sold or shared for marketing.

The mobile app requests network access and, only if you allow it, permission to show notifications. It cannot ask for your location, camera, microphone, contacts or photos, because it declares no such permission.

Cookies

All cookies are set by DZ Fantasy itself. There are no third-party cookies, and none is used for advertising or to track you across sites. The cookies are:

• The session cookies that keep you signed in.
• af_locale and af_theme, which remember the language and the light or dark theme you chose. They last one year.
• dzf_last_seen, set only while you are signed in. It holds the time of your last activity so that a session left unused for 8 hours is signed out.
• af_session, a random identifier set on your first visit and kept for 7 days. The application does not currently read it or attach it to any record.
• dzf_maint_bypass and dz_ops, set only for site operators.

Who processes the data

Two providers hold data on our behalf:

• Supabase — database and authentication. The production database is hosted in the EU (London region, eu-west-2).
• Vercel — application hosting. Server logs contain request metadata such as IP address and are retained by that platform.

Deleting your account

Your profile, squad, transfers, league memberships and any leagues you own are removed together with the account — the database is set up so they cannot outlive it.

To request deletion, use the support page. Deletion is permanent and cannot be undone.

Children

This game is not directed at children. Do not create an account if you are below the minimum age for using online services where you live.

Changes

If what the software stores changes, this page changes in the same release. The date at the top is the date of the last change.