StadiatorPlayPrivacy policy
Last updated: 4 November 2026
Stadiator is a football stadium guessing game, played at stadiator.xyz and in the Stadiator app for Android. It is made and run by Houssem Saoud, an independent developer based in Tunisia (“we”). This page explains what the game collects, why, who helps us run it, and how you can see or delete your data.
The short version: we only collect what the game needs to work. There are no ads, no tracking cookies, and we never sell or rent your data.
What we collect
| Data | When | Why |
|---|---|---|
| Email address | When you create an account, with Google or with email and password | To sign you in, and for the reminder emails described below |
| Name and profile picture link from Google | Only if you sign in with Google; Google sends them with the sign-in | Stored with your sign-in record; the game shows only your username, never your Google name or photo |
| Password | Email accounts only | Stored only as a secure hash by our sign-in provider; nobody can read it |
| Username | When you pick it | Shown to other players on leaderboards, profiles, duels and tournaments |
| Game data: games, guesses (where you placed the pin), scores, streaks, league results, passport stamps, trophies | Every time you play | To score games, run leaderboards, leagues, duels and tournaments, and show your profile |
| Friends and chat messages | When you add friends or send messages | To deliver messages to your friend and show your conversations |
| Notification token and language | Only if you turn notifications on | To send you duel, message, friend, league and tournament notifications |
| Guest name and scores | If you play without an account | The game gives guests a random football name and keeps a random number on your device so your scores show on the guest leaderboard. This is not linked to any personal information |
| Error reports: browser type, screen size, page, language, error message | When something goes wrong, and at a few steps of the game | To find and fix bugs. Linked to your account if you are signed in. Deleted automatically after 90 days |
The game also stores a few settings on your own device (language, theme, your recent daily results). These stay on your device and are not sent to us.
We do not collect your location, contacts, photos, phone number, or payment details. When you place a pin on the map, that is your guess for a stadium, not your location.
Emails
If you signed in with Google and have not played for two days, we may send you a short reminder email from [email protected]. We stop after two reminders you don’t act on. Every email has an unsubscribe link that works with one tap. We also send account emails you ask for, such as password resets.
Who helps us run Stadiator
These companies process data on our behalf, only to run the game:
- Supabase: database, sign-in and account emails. Data is stored in Frankfurt, Germany (EU).
- Cloudflare: hosts the website and protects it from attacks. It handles your IP address to deliver the pages.
- Resend: sends the reminder emails.
- Google: “Continue with Google” sign-in, and the Android app (Google Play).
- Push services (Google, Apple or Mozilla, depending on your device): deliver notifications if you turn them on.
- Google Fonts, cdnjs and jsDelivr: deliver the fonts and code libraries the game uses. They see your IP address when your browser downloads them.
We never sell your data, share it with advertisers, or use it for advertising.
What other players can see
Your username, avatar, scores, league, passport, trophies and recent games are public in the game. Chat messages are seen only by you and the friend you are talking to. Your email address is never shown to anyone.
How long we keep data
- Account data: until you delete your account.
- Error reports: 90 days.
- Guest games: kept for the guest leaderboards. They are not linked to any personal information.
- After you delete your account, copies can remain in routine encrypted database backups for up to 30 days before they are overwritten.
Deleting your account
You can delete your account and all its data at any time, without contacting us:
- In the game: open your profile and tap Delete my account at the bottom, then confirm.
- On the web: go to stadiator.xyz/delete-account.
- By email: write to [email protected] from the email address of your account, with your username. We delete it within 7 days.
Deletion is immediate and permanent. It removes your sign-in, profile, games and guesses, scores, passport stamps, trophies, friends, messages, duels, tournament entries, league history, notification tokens and email history.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it, and you can object to how we use it. Write to [email protected] and we will answer within 30 days. If you live in the EU or UK, you can also complain to your local data protection authority.
We use your data because it is needed to provide the game you signed up for (contract), and for bug reports and reminder emails, because of our legitimate interest in running a working game, which you can opt out of.
Children
Stadiator is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, write to us and we will delete it.
Security
All connections use HTTPS. Database access is locked down so players can only reach their own private data through the game. Passwords are never stored in readable form.
Changes
If we change this policy, we will update the date at the top. If a change is important, we will tell players in the game.
Contact
Houssem Saoud, Stadiator · [email protected]