Information we use
Updated 6 October 2026. Registered accounts provide an email address, screen name, date of birth and password. Passwords are stored as salted cryptographic hashes. Guest visits use a temporary identity rather than an email address.
We store your fictional-coin balance, accepted game rounds, coin activity, saved game preferences, club-shirt settings, lineup and account-break state. These records keep your experience consistent and help enforce the game rules.
Purpose and support
Account information supports sign-in and eligibility; server sessions protect account access; game records prevent duplicate-round charging and keep balances accurate. Cosmetic preferences are used only to display your chosen club identity.
Help-desk submissions store a topic, reply email, message and reference. Avoid providing unnecessary sensitive information. Your request is saved and may be used to investigate the issue you report.
Storage and retention
Essential session and security cookies operate the club. Google Analytics starts automatically when you visit the website. Analytics cookies last up to 90 days.
Account and game records are retained while needed to operate your account and resolve service issues. Expired guest data and support requests are subject to retention housekeeping. Support messages are retained for up to 90 days.
Access, corrections and choices
Use the help desk’s Privacy topic to request access, correction or deletion of personal information. We may need to establish that the request relates to your account before disclosing or changing data.
Deleting browser cookies signs you out but does not delete a registered account. An active account break cannot be shortened by removing cookies. Read the Cookie Policy for the exact storage inventory.
Security and external services
We use server-side validation, access controls, hashed session identifiers and safeguards against repeated requests. No system can guarantee perfect security; avoid sharing credentials and report suspected unauthorized activity.
Google LLC and its affiliates provide Google Analytics. Google processes page paths, page titles, a cleaned referring page and technical browser/device information for aggregate usage measurement. Google also processes network information, including your IP address, when receiving requests. Processing may occur outside your country. We do not send your account ID, email, date of birth, password, coin balance or support messages to analytics. URL queries and fragments are removed. Google sign-in, Google signals and advertising storage stay off.
Contact the clubhouse
Our public contact address is team@cupsoccer.com. You can also use the Help Desk form. Never send passwords, payment details or sensitive documents.
Transactional email and password recovery
Brevo sends requested password resets and help-desk notifications. ImprovMX forwards mail addressed to our help desk to the operator mailbox and central Inbox. These providers receive the email addresses and message content needed for delivery. This is service email, not marketing.
Password-reset tokens are stored only as digests, expire after 30 minutes and work once. A successful reset signs out existing sessions and preserves account breaks. We retain delivery status records for up to 90 days.
Review your storage choices