Elevenfold Rush · Legal

Privacy Policy

Last updated: 5 November 2026

This policy explains how personal data is processed when you use Elevenfold Rush at elevenfold-rush.vercel.app (the “Service”).

You can play without registering. When connected, the game creates a guest identity to save progress. Runs with at least one league win and recorded player statistics are public. Google and email sign-in are optional.

1. Controller and contact

This shared support inbox also handles Elevenfold Rush privacy requests. Please name the game in your message. Publisher details are in the Impressum.

2. Purposes and legal bases

• Providing the game, accounts and progress sync: Article 6(1)(b) GDPR, where processing is necessary to provide the Service you request.
• Public rankings, sporting history, security and reliability: Article 6(1)(f) GDPR. Our interests are maintaining useful competition records, preventing abuse and keeping the Service working. You may object on grounds relating to your situation.
• Support: Article 6(1)(b) or 6(1)(f) GDPR, depending on the request.
• Legal requirements: Article 6(1)(c) GDPR where a legal obligation applies. Where processing requires consent, Article 6(1)(a) GDPR applies and consent may be withdrawn.

3. Guest accounts and optional sign-in

With a working cloud connection, the game automatically creates an anonymous Supabase Auth account. It has a unique user ID and session information; it is not anonymous to the technical system simply because the public name is “Guest”. Offline play can continue using local browser storage.

If you choose email sign-in, we process your email address, verification and session information. Authentication codes are delivered through Brevo. If you choose Google sign-in, Google processes the sign-in under its own policy and provides the identity information needed to authenticate you, such as a user identifier and email. We do not receive your Google password.

You may set a public username and optionally enter a free-text “Where are you from?” location. Neither is needed for local play. Please do not enter sensitive information or a precise home address in public profile or team fields.

4. Gameplay data and public information

We process team names, player selections, lineups, formations, progress, recruitment, energy, rewards, results, match events and player statistics. Cloud progress is linked to your user ID. An unfinished league match is checkpointed on your device; it does not resume on another device from that local checkpoint.

After at least one league win, your run is published in the Streak League leaderboard, including ongoing runs. Public information can include your username or Guest label, optional location, team name and representative portraits, wins and losses, opponents, scores, match history and footballer statistics. Recorded league and friendly player statistics also contribute to the public Player stats view. These are game characters, not photographs of account holders. Your email address and authentication tokens are not published by these views.

The experimental 5v5 Championship keeps its own championship history, statistics and unfinished-match recovery in this browser, separately for the current account or offline device. Unfinished schedules, detailed fixture reports and match recovery stay in that browser. Completed tournament summaries, champions, awards and aggregate team/player statistics sync with your private account progress; they do not enter the public ranking. Tournament energy is separate from league and friendly energy. A recruited player changes its source saved friendly roster, which uses normal progress sync. The game can retain up to three saved friendly squads.

Training, Quick matches and Test matches do not submit sporting results to the public rankings. Normal league and saved-team friendly records are kept separately, as described in the game.

Private recovery snapshots and codes

We retain private versions of successfully synced progress to help correct accidental loss: normally up to ten distinct snapshots for each of the five most recent runs per user. A snapshot attached to a pending support recovery may be retained until that ticket expires. Empty drafts with no saved teams are not backed up. These copies are not included in public rankings or exposed to other players.

If a guest requests a recovery code, we store its cryptographic hash and creation time; the readable code is returned to that guest and may be kept in that browser. Support can use a code you supply to locate your private snapshots and issue a hashed, one-time restore ticket valid for up to 48 hours. We record ticket expiry, use and destination user ID. Following a verified guest recovery, sporting-record ownership may move to the new guest ID without duplicating results; the former guest is prevented from writing progress. No Google/email identity, password or authentication session is transferred. Treat recovery and restore codes as confidential.

5. Browser storage

The game uses localStorage and sessionStorage for authentication, local progress and recovery snapshots, a requested guest recovery code, match recovery, pending cloud uploads, account flows and your language, sound, graphics, camera and stadium preferences. This is functional storage used to provide the game or remember choices you make. Clearing it can remove unsynced progress and access to an unregistered guest account.

Rush currently has no advertising trackers or third-party product analytics integration. The legal pages can be read without creating a game account or loading the game. Infrastructure providers may still process the request information described below.

6. Hosting, authentication and email providers

• Vercel: website hosting and delivery. Requests may generate technical logs including IP address, browser/device information, requested URL, timestamps and errors. See Vercel’s Privacy Notice.
• Supabase: guest and registered authentication, cloud progress, profiles, leaderboard and player-statistics database. See Supabase’s Privacy Policy.
• Brevo: delivery of requested authentication emails, including recipient address and delivery/error information. See Brevo’s Privacy Policy.
• Google: optional Google sign-in, used only if you select that sign-in method. See Google’s Privacy Policy.

Support correspondence is processed through the support mailbox and its email infrastructure. Data may also be disclosed to authorities where legally required. Rush currently has no payment processing. Its on-pitch computer opponents run in your browser; gameplay is not sent to a generative-AI service.

7. International processing

Service providers and their subprocessors may process information outside the EU/EEA. Where such a transfer occurs, applicable GDPR transfer requirements must be met, for example through an adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for information about the safeguards applicable to your data; the provider notices above describe their processing practices.

8. Retention and account deletion

Account and cloud progress data are kept while needed to provide your account and game history. Technical logs and support correspondence are retained as needed for security, troubleshooting, handling requests and applicable legal obligations. Local data remains on your device until cleared or replaced by the game’s account/reset actions.

You can delete a registered account from Account in the game, or contact support about a registered or guest account. Account deletion removes the authentication identity, profile, private progress and associated private recovery snapshots, codes and tickets and clears identity-related game data on the device performing deletion. Other devices may retain local copies until cleared.

Published results and footballer statistics can remain for sporting-history integrity, with the account link removed and the owner shown as Guest. This does not necessarily remove personal information you typed into a team name or other public text. Contact us if a retained record identifies you or you wish to exercise your erasure or objection rights.

Prelaunch data from before the production reset is held in a restricted administrative archive for recovery and integrity checks. It is not publicly accessible and old sessions are not restored for gameplay. Retention is limited to the continuing recovery, integrity or legal need and is subject to review; privacy requests also apply to archived personal data. The archive is separate from active game-account deletion, so contact us to request review of archived data.

9. Your rights

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. You may withdraw consent where processing relies on it, without affecting earlier lawful processing. See the European Data Protection Board’s explanation of these rights.

Send requests to support@elevenfold-legacy.com. We may need proportionate information to verify that the data belongs to you. Never send a password, sign-in code or session token. A username, team name and approximate play date can help us locate the relevant records.

You may complain to a supervisory authority, including in your place of residence or work. For the controller’s location in Bavaria, you can contact the Bavarian State Office for Data Protection Supervision (BayLDA).

10. Security, children and updates

We use access controls and encrypted transport to protect data, but no online service or local browser storage can be guaranteed completely secure. The Service is intended for users aged 16 and over. Contact us if a child has provided personal data.

We may update this policy when the game, its providers or legal requirements change. The date above identifies this version. Material changes will be brought to your attention in the Service where required.