Privacy Policy

Starting11 is built on the principle of minimal data collection. We believe you should be able to create and share football lineups without compromising your privacy. We only collect the data necessary to provide our services and respect your rights at every step.

We collect minimal information to provide our services. For users who choose to create an account, we store only the standard OAuth data required for authentication (typically your email address and basic profile information from your chosen login provider). Guests who build a lineup on Starting11 without an account give us no personal information at all. One narrow exception applies on partner sites, explained under "Predictions made on partner sites" below. We also run short, optional in-app feedback surveys; if you leave a suggestion you may choose to add your email, which we use only to follow up on that feedback and nothing else. Account holders may also choose to tell us the year they were born, covered under "Your Year of Birth" below; it is optional and we never ask for a full date.

Any information we collect is used solely to provide and improve our services. This includes enabling you to save your lineups, track your creations, personalise your experience, and measure which emails are useful to you so we can send fewer of the ones that are not, and stop mailing addresses that bounce or complain. Apart from the advertising and ad measurement described under "Advertising" and "Who We Share Data With", we never sell, rent, or share your personal information with third parties for marketing purposes.

We use two analytics tools. Cloudflare Web Analytics measures page speed and pageviews. It sets no cookies, does not track you across sites, and needs no consent. Google Analytics 4 gives us session-level usage data, and it can set analytics cookies. We run it under Google Consent Mode, so if you are in the UK, EU, or Switzerland it stays off until you accept it in our privacy preferences pop-up, the same one that asks about advertising. We only treat it as accepted if you allow storing information on your device and allow Google as a partner there. Elsewhere it runs on an opt-out basis. You can change or withdraw your choice at any time using the "Update Privacy Preferences" link in the site footer, and if you decline, Google Analytics runs without cookies. The only strict-necessary cookie we set is the Clerk session cookie that keeps you signed in if you have an account; it expires when you log out and is exempt from consent banner requirements. Advertising cookies are covered separately under "Advertising" below, and have their own consent choice.

From time to time, on a small and rotating slice of visits (only while we are actively looking into something), we use Microsoft Clarity to record an anonymised replay of how that visit used the page, and to build heatmaps of where people click, scroll, and pause. On our club, fixture, player, and gameweek pages this is around one visit in ten. On the lineup builder and the screens for making, saving, and sharing a prediction it is around one in twenty, so that we can see where that flow is confusing without slowing it down. Clarity is never used on our sign-in, sign-up, onboarding, or account pages. Whether a given visit is recorded is decided once, at random, in your browser, and only for a visit where our usual analytics consent choice already allows it: if you are in the UK, EU, or Switzerland this needs your consent, given the same way as for Google Analytics; if you decline, or have not yet chosen, nothing is recorded. If you are signed in, we only record a visit when your account has given a year of birth that puts you at 18 or over: an account that is under 18, or that has never answered that question, is never recorded, and nor is a visit where we have not yet been able to check. We configure Clarity's strict masking option, which hides free text, so anything you type is not visible in a recording; input boxes are masked by Clarity automatically in every mode and this cannot be switched off. Microsoft stores recordings for up to 30 days and heatmap data for up to 9 months. You can stop this the same way you withdraw analytics consent generally: the "Update Privacy Preferences" link in the site footer.

When you sign in with Google, we receive the profile photo on that account and store it so we can show it back to you on your own profile page. By default nobody else sees it. Leaderboards show your initials instead. If you want your photo shown next to your name on our public leaderboards, which anyone can view without signing in, you turn that on yourself under "Your photo" on your profile, and we record the date you did. You can turn it off at any time and the leaderboards go back to your initials. We never switch this on for you, and signing in with Google does not by itself give us permission to publish your photo.

You can tell us the year you were born, and only the year. We never ask for, and never store, the day or the month. It is optional at signup, it is optional afterwards, and you can add, change, or clear it at any time under "Year of birth" on your profile. We use it for two things. First, advertising. Unless the year you have given us shows you are over 18, the page asks our advertising partner to serve non-personalised ads, which means the ads you see are chosen from the page you are looking at rather than from anything about you or what you have done online. The same applies if you have given us no year at all. This changes how ads are chosen for you, not which kinds of ad can appear on the site. To do it, the page tells our advertising partner only that this page takes non-personalised ads; it never sends them your year of birth, your age, or anything that identifies you, and we never give it to an advertiser for any other purpose. Second, to decide whether an account is eligible for any prize we run on the leaderboards, which needs the account holder to be over 18. If you leave it blank, your account works exactly the same way and you keep predicting as normal; the only thing you cannot do is claim a prize. It is never shown on your public profile, never appears on a shared lineup, and is never given to a third party.

The lineups you create are stored to enable sharing and saving functionality. Public lineups (those you choose to share) are visible to other users and may appear in recent lineups sections. You maintain full control over your creations and can delete them at any time.

Some football forums and fan sites embed our prediction widget so their members can pick a starting XI without leaving that site. You do not need a Starting11 account to use one. When a partner has enabled member credit, the partner's site sends us an opaque identifier for the member making the prediction: a salted, one-way hash generated on their servers. We never receive and never store usernames, display names, email addresses, or any other identifying detail from a partner site, and any value that is not a valid hash is discarded on arrival. The hash lets us count how many predictions a member made and how accurate they were, without us knowing, or being able to work out, who that person is. Only the partner can connect the hash back to a member, using their own records. If a partner publishes a leaderboard of their members, they choose to do so, they map those identifiers to names themselves within their own website, and they are responsible for telling their community. To have a prediction removed, contact the partner site you made it on, or contact us with the identifier and we will delete the matching records.

We retain your data only as long as necessary to provide our services. Account data is kept while your account remains active. Inactive accounts and associated data may be automatically deleted after extended periods of inactivity, with appropriate notice where possible. Where Microsoft Clarity records a visit as described under "Session Recording and Heatmaps", Microsoft retains that recording for up to 30 days and any heatmap data built from it for up to 9 months.

If you're in the UK or EU you have the following rights, all of which we honour: (a) Access: get a copy of the data we hold on you; (b) Rectification: correct anything we have wrong; (c) Erasure: delete your account and all associated data ("right to be forgotten"); (d) Restriction: pause our processing of your data while a dispute is resolved; (e) Portability: receive your data in a machine-readable format and move it elsewhere; (f) Objection: object to specific processing activities. To exercise any of these, email us; we'll respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU supervisory authority.

We share only what is strictly necessary to operate the service, and only with providers who process data on our instructions under a written data processing agreement. (a) Clerk Inc. handles authentication and stores your email, display name, and OAuth tokens. Their privacy policy: https://clerk.com/legal/privacy. (b) Cloudflare Inc. provides DNS, CDN, and cookieless analytics, and stores our encrypted database backups. Their privacy policy: https://www.cloudflare.com/privacypolicy/. (c) Google LLC provides Google Analytics 4, which processes usage data such as pages viewed and approximate location, subject to your consent choice described under "Cookies and Analytics". Their privacy policy: https://policies.google.com/privacy. (d) Hetzner Online GmbH hosts our application servers and database in Germany. Their privacy policy: https://www.hetzner.com/legal/privacy-policy. (e) Mailjet SAS, a Sinch company, delivers the emails you have asked for, such as your scorecard, team news alerts, and the newsletter, and holds the address they are sent to. These emails record whether they were opened and which links were clicked, linked to your account, so we can tell which emails are useful, stop sending the ones that are not, and stop mailing addresses that bounce or complain. We do not keep the IP address that comes with these events in our own records. You can avoid this by unsubscribing, by turning that email off in your alert settings, or by blocking remote images in your mail client, which stops open tracking (a link you click is still recorded). Their privacy policy: https://www.mailjet.com/legal/privacy-policy/. (f) Formbricks GmbH runs the short optional in-app feedback surveys, and receives an email address only if you choose to add one to a response. Their privacy policy: https://formbricks.com/privacy-policy. (g) CMI Marketing, Inc., d/b/a Raptive places the display advertising on our content pages, as described under "Advertising" below. (h) Reddit, Inc. runs the Reddit Pixel, which lets us measure the results of our own Reddit ads and lets Reddit use that activity to improve how those ads are delivered. It only loads for visitors outside the UK, EU, EEA, and Switzerland. Where it loads, Reddit can receive your IP address, the pages you view, and browser details, and may use them as described in its own policy; under some US state privacy laws this counts as "sharing" personal information for advertising. You can stop it loading by choosing to decline through the "Update Privacy Preferences" link in the site footer, or by turning on a Global Privacy Control signal in your browser, which we honour automatically. Their privacy policy: https://www.reddit.com/policies/privacy-policy. Each of these providers may use its own vetted sub-processors, listed in the policies above. We do not sell your data, and outside of the consent-based advertising described below and the Reddit Pixel described above we do not share it with advertisers or data brokers. (i) Microsoft Corporation runs Microsoft Clarity, which we use as described under "Session Recording and Heatmaps" to record an anonymised sample of visits and build heatmaps. Their privacy statement: https://privacy.microsoft.com/en-us/privacystatement.

Our application servers and database are in Germany, and our encrypted backups are stored in Cloudflare's Western Europe region. Some of the providers listed above are based in, or process data in, the United States: Clerk, Cloudflare, Google, and Raptive. Where your data reaches a country outside the UK or EEA, that transfer is covered by the European Commission's Standard Contractual Clauses and the UK Addendum, which form part of our written agreement with each provider, alongside their own technical safeguards. Ask us at any time for details of the safeguards that apply to a specific provider.

We implement appropriate security measures to protect your information against unauthorised access, alteration, disclosure, or destruction. Our systems are designed with privacy and security as core principles, not afterthoughts.

CMI Marketing, Inc., d/b/a Raptive (“Raptive”) is a service provider of this Site for the purposes of placing advertising on the Site, and Raptive will collect and use certain data for advertising purposes. To learn more about Raptive's data usage, click here: https://raptive.com/creator-advertising-privacy-statement/ We show display advertising on our content pages (club, fixture, player, and similar informational pages) to fund the service, and Raptive works with advertising demand partners to fill the ad space. Ads never appear inside the lineup builder or in the flow of making and sharing a prediction; a shared lineup shows ads to the people viewing it, never to the person who made it. If you are signed in you see fewer ads. To do that, the page tells our advertising partner only that the reader is signed in, never who they are. If you are in the UK, EU, or Switzerland, personalised advertising only runs with your consent, which we ask for through an IAB TCF-certified consent banner; you will see the specific advertising partners listed there, and you can accept, reject, or customise your choice. If you decline, you may still see non-personalised ads, which do not use advertising cookies or cross-site identifiers. Elsewhere, ads may be personalised subject to your local law and any opt-out choices you make. When personalised ads run, advertising partners may set cookies and process your IP address, approximate location, and information about the pages you view to select and measure ads; each partner's purposes and lawful bases are listed in the consent banner. You can change or withdraw your advertising choice at any time through the "Update Privacy Preferences" link in the site footer. Advertising consent is asked for on its own; it is never bundled into our terms, your account, or any other agreement.

Starting11 uses OAuth providers (such as Google or GitHub) for authentication. These services have their own privacy policies that govern how they handle your information during the login process. We encourage you to review their policies as well.

Starting11 is designed for general audiences and we do not knowingly collect personal information from children under 13. The optional year-of-birth answer described above is one way we may become aware; if we are, we will take steps to delete that account's information promptly. An account holder aged between 13 and 17 keeps a normal account and predicts as usual. The small sample described under "Session Recording and Heatmaps" leaves out any signed-in reader whose age we cannot confirm: if your account is under 18, or has not given a year of birth, none of your visits are recorded. Anything you type is masked in every recording in any case, whatever your age, and we have configured Microsoft Clarity's strictest masking option throughout.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify users of any material changes through our website and update the effective date below. Your continued use of Starting11 after changes become effective constitutes acceptance of the revised policy.