Privacy Policy
Last updated: May 2026
1. Who we are
GoalSignal (goalsignal.com) is a free football information service providing live scores, statistics, and betting-comparison tools. GoalSignal is not a bookmaker or gambling operator; we do not accept stakes or hold customer funds.
2. Data we collect
Account data (optional): If you create an account (email + password, or via GitHub OAuth) we store your name, email, and OAuth provider identifier. You can use most of GoalSignal anonymously without an account.
Geo / jurisdiction: Your country, derived from your IP by Cloudflare, is used to decide which version of the site to show: Bettor mode, Fan-only mode, age-gated, or restricted. Legal basis: GDPR Art. 6(1)(f), legitimate interest in complying with national gambling laws.
First-party event log: We record events such as affiliate-link clicks and push-notification subscriptions in our own Cloudflare D1 database. Each event is tagged with country, a salted truncated SHA-256 hash of your IP, and your anonymous PostHog session ID so we can verify attribution, monitor geo-fence integrity, and measure feature usage.
Push notification subscription: If you enable push notifications, we store your browser push endpoint and the public encryption keys needed to deliver notifications. We never store the device identifier directly.
Browser storage (localStorage): Display preferences, spoiler-free mode, bets you build in the Social Betting Lab, and your PostHog session ID are stored locally on your device.
Community feed: If you post a bet to Social Betting, your nickname and bet details are stored on our servers for up to 24 hours and are visible to other users.
3. Cookies and local storage
For EU/EEA visitors, no analytics cookies or persistent analytics IDs are stored before you accept the cookie banner. We use PostHog's cookieless memory mode until consent is given.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| gs-display-locale | Remembers your selected language | 12 months | GoalSignal |
| gs-display-tz, gs-client-tz | Timezone for kick-off display | 12 months | GoalSignal |
| gs-analytics-consent | Records your analytics consent (EU/EEA) | 12 months | GoalSignal |
| Better Auth session | Keeps you signed in (account holders only) | 7 days | GoalSignal |
| ph_*, posthog (localStorage + cookie) | PostHog product analytics session (only after consent in EU/EEA) | 12 months | PostHog Inc. (EU) |
| _ga, _ga_* | Google Analytics (only after consent in EU/EEA) | 2 years | Google LLC |
| __cf_bm, cf_clearance | Cloudflare bot management and security | 30 min - 1 year | Cloudflare, Inc. |
Bookmakers reached via affiliate links operate under their own privacy policies and may set additional cookies on their own domains, not on goalsignal.com.
4. Third-party services
- Cloudflare, Inc. - Hosting, edge cache, database, bot management, and Web Analytics. Cloudflare processes IP address and user-agent for normal web operations.
- PostHog Inc. (EU region) - Product analytics hosted in the EU at eu.i.posthog.com. EU/EEA visitors load cookieless memory mode before consent; full session tracking only starts after the cookie banner is accepted. Session recordings are disabled.
- Google LLC - Google Analytics and Google Fonts. Loaded only after you accept the EU/EEA cookie banner; outside the EU/EEA they may load by default.
- Better Auth + GitHub OAuth - Account authentication. GitHub processes your account name and email under its own privacy policy if you choose GitHub sign-in.
- MiniMax - Server-side natural-language generation for match analysis. Only public match metadata such as team names, league, market, and odds is sent. No personal data is included.
- Enetpulse - Football data feed for live scores, fixtures, lineups, and statistics. It receives no personal data from GoalSignal users.
- Web Push - Push notification delivery through your browser vendor's native push service when you opt in.
- Affiliate tracking partners - Bookmaker links may pass through third-party tracking partners that can set their own cookies during the redirect. Each operator's privacy policy applies after the redirect. GoalSignal may receive a commission.
5. Your rights (GDPR)
If you are an EU/EEA resident, you have rights under the General Data Protection Regulation: access, correction, erasure, portability, restriction, and objection.
Account holders: Email privacy@goalsignal.com with the subject GDPR request and the email tied to your account. We respond within 30 days.
Anonymous visitors: Most event tracking uses an anonymous PostHog session ID and a salted IP hash, so we cannot tie it back to you without an account. To remove your PostHog data, clear your browser storage for goalsignal.com.
You also have the right to lodge a complaint with your national data protection authority. In Denmark, contact Datatilsynet at datatilsynet.dk.
6. Data retention
- Account data: until you request deletion.
- First-party event log (D1): 12 months, then aggregated and the raw rows deleted.
- PostHog product analytics: 12 months (PostHog free-tier default).
- Community feed posts: 24 hours.
- Server logs: 30 days.
7. Contact
For privacy questions or GDPR requests, contact privacy@goalsignal.com.
8. Responsible gambling
Betting involves risk. GoalSignal provides information tools only and does not facilitate actual betting. If gambling is causing harm to you or someone you know, help is available:
- UK: BeGambleAware.org · GamCare.org.uk
- Denmark: ROFUS.nu (national self-exclusion register) · StopSpillet.dk
- Sweden: Spelpaus.se (national self-exclusion register) · Stödlinjen.se