Privacy policy
This policy covers the website, launch list and Hometown FC mobile game. We use only the data needed for the purposes below. This policy also covers the optional tester-feedback form and private feedback dashboard.
Trader and controller
Quarenda (Hometown FC)Belgium
support@hometownfc.app
privacy@hometownfc.app
Data we process
Game careers are stored on the device and may sync through Apple iCloud/CloudKit or Google Play Games when platform cloud save is available. Optional PostHog analytics uses a pseudonymous install identifier and basic app/device events only after opt-in. Google AdMob may process IP, device and advertising identifiers to deliver and measure ads under the in-app consent and age settings. Apple or Google processes store purchases; we receive transaction and entitlement data, never card details. The website uses Cloudflare hosting, security logs and the launch-list data described below. At launch the game also requests one public version file from this site to check whether a newer release exists; that request carries no identifier and only the site logging described here applies to it. The feedback form is only for people aged 16 or over. We process the category, title, details, game area, reproducibility, app version, optional device and Android version, age attestation and, if supplied, an email address and up to three screenshots or short videos. The private dashboard also stores triage status, priority and an internal note. Do not include passwords, payment data or unnecessary personal information in text or uploads.
New launch-list signups are limited to people aged 16 or over and store the email, locale, signup and confirmation times, consent-text version, age attestation and delivery status for one requested launch notice; they require double opt-in. Valid records collected by the previously deployed launch-notification form retain only the one launch notice originally requested. We do not infer or add an age attestation or double-opt-in proof that was not recorded.
For purchase delivery and support, our own purchase service receives technical step/status codes, timestamps, app build and safe purchase references. No receipts, purchase tokens, names or save content enter this diagnostic trail. Up to 128 events (64 KiB) remain on the device for seven days; the service keeps up to 256 events per purchase for 30 days. You can share the local report from Purchase History or the setup settings, even offline. This purchase-support trail is separate from optional PostHog analytics.
The trail also records random event and runtime references, sequence numbers and optional elapsed time. It is processed by our existing EU Cloudflare purchase service. Access keys, store bindings, free error messages and stack traces are excluded. Failed diagnostic collection never changes purchase delivery.
Help improve Hometown FC with pseudonymous gameplay statistics and limited technical error codes through PostHog (EU servers), including app build and device information. No names, save content, error messages, stack traces or transaction identifiers or receipts are sent. This is optional, separate from the terms, and can be turned off any time in Settings.
Only signals from app sessions in which an adult had opted in are sent: at most one per error signature and 20 per app session. Errors from before consent and local crash reports are never uploaded. On Android, if the app closed unexpectedly during such a session (a crash, a freeze or the system closing it for lack of memory while it was in use), the next launch may send one note in fixed codes, provided that choice still stands: how it ended, the approximate memory used, how long the app had been open and what was on screen. Withdrawal or loss of age eligibility discards pending events and attempts to cancel requests in flight; already delivered data cannot be recalled. Retention is at most 12 months. Earlier consent does not enable this expanded scope; a new choice is required.
Owner rankings
This applies to versions of the game that include the owner rankings (1.1 and later). Adults take part by default, players aged 13 to 17 only if they turn them on in Settings, players under 13 never. The game then sends a random install identifier and the progress and results of your careers (such as division, position, titles, club figures and your club’s town) to our rankings service, hosted by Cloudflare in the EU. If a purchase made in a career is refunded, the game also tells the rankings service (no amount or other purchase details); that career is then no longer shown to other owners. The game also sends a one-way code made from the career’s internal identifier (never the identifier itself); with it the rankings service checks whether a purchase delivered into that career was later refunded, and if so that career is no longer shown either. A refund the store makes by itself because a purchase was never confirmed does not count. On Android, the game also asks Google Play to confirm that it is the official app from Google Play on a device Google vouches for (Google Play Integrity); the rankings service receives only whether this check passed and the app’s version number. If Google Play does not confirm that it is the official app, that install’s careers are not shown in the rankings and the game says why; they return once a later check passes. If an owner’s wealth early in a career is more than the game allows without a purchase, the rankings service checks our purchase records for the cash packs bought for that career, also when it began with a paid company start (no payment details), before it takes that career off the boards. Your name, typed text, age and save are never sent, except a friend’s invite code you choose to enter. You can invite a friend with a one-time code that you send yourself; once your friend accepts, the rankings service keeps a link between your two installs, and each of you sees the other’s place with what the boards already show, or only the division while the other is still in a first season (there is no chat or search). An unused code runs out after 7 days; deleting your ranking data also deletes your friendships. Boards in the game, on hometownfc.app and in our community channels show “Owner of <club’s town> #<number>” with your title, colours and results. Leaving hides your careers; “Delete my ranking data” removes them. Ranking data is deleted after two years without contact.
Legal basis: for adults, our legitimate interest in offering competitive rankings, which you can leave at any time; for players aged 13 to 17, their consent, given by turning the rankings on and withdrawn by turning them off.
Why we process it
We use consent for optional analytics and the launch notice; contract steps and performance for requested game/store functions; legitimate interests for proportionate security, abuse prevention and aggregate service measurement; and legal obligation for records we must keep. We process tester feedback on our legitimate interests in finding defects, improving the game and preventing abuse. Email and attachments are optional. A supplied email is used only to follow up on that report; the form does not subscribe you to marketing or launch messages.
Providers and transfers
Relevant providers may include Cloudflare, Resend, PostHog, Google and Apple. Where data leaves the EEA, we rely on an adequacy decision or appropriate contractual safeguards as applicable. Cloudflare provides the Worker, Access-protected dashboard, D1 database, private R2 object storage and abuse protection. Feedback D1 and R2 are created with EU jurisdiction, restricting their persistent database and object storage and processing to the European Union. Unless Regional Services is separately enabled, website traffic may still be decrypted and processed transiently at Cloudflare edge locations outside the EEA. Applicable contractual safeguards cover such transfers.
How long we keep data
Unconfirmed launch-list records expire after 30 days; unverified legacy records remain quarantined for at most 30 days; sent records are deleted within 30 days; keyed suppression values last up to 400 days. Raw PostHog events are capped at 12 months. Local saves remain until you delete them; platform cloud copies follow your platform account controls. Minimum accounting records may be kept for the legally required period. Staff and security logs are kept for up to 12 months; sanitized Worker logs for up to 7 days. Screenshots and videos are deleted after 90 days; R2 lifecycle deletion normally completes within a further 24 hours. Raw reports, optional email and administrator notes are deleted after 180 days; only non-identifying monthly counts by category, app version, final status and priority remain. Deleted D1 data may remain recoverable through Cloudflare Time Travel for up to 7 days on Free or 30 days on Paid.
Children and age
The full game is available to every age group. The website launch list is 16+. Before privacy-sensitive services start, the game uses a coarse age band. Under-13 players use child privacy mode: no optional analytics or ATT/IDFA, and only child-directed, G-rated, non-personalised ads. Players aged 13-17 likewise receive no optional analytics or ATT/IDFA and only G-rated, non-personalised ads. Adults may separately choose analytics and advertising consent; on iOS, the game does not ask for ATT and every ad request is non-personalised. After you accept, the full game opens. Private platform cloud sync, ads and analytics start only after your selected age band and legal acceptance have been saved successfully and a usable platform age authority is available. If saving that choice or the platform age authority remains unresolved, the full game and player-initiated store checkout remain available, while cloud sync and analytics stay off and ads stay limited and non-personalised. The 16+ attestation applies to new signups; no age value is inferred for valid earlier records. Tester feedback is available only to people aged 16 or over and requires an age attestation, not a date of birth.
Your privacy rights
You may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Email support; we normally respond within one month. You may complain to the Belgian Data Protection Authority. You may request access, correction, deletion, restriction or objection by emailing the privacy address with the feedback reference and, where relevant, contact email. We may request proportionate proof of identity. Anonymous counts cannot be reconnected to a person after the raw report is deleted.