Futbol Island is a free game that teaches children how football is played. Because it is made for children, it is built to collect as little as possible. It does collect anonymous usage data (counts and totals, never a name), for two reasons only: to run and improve the game, and to show sponsors who help pay for it combined totals such as how many players visited and how long they played. This policy explains, in plain words, what the game keeps, why, where, for how long, and what you can do about it.
Last updated October 22, 2026.
1. The short version
- No accounts and no contact details. We never ask a child for a last name, age, birthday, email, phone number, photo, voice, school or location. The one exception is the Play with friends feature, which asks a grown-up to type a first name only so friends can tell each other apart; it is shown only to that party and is never stored, logged or counted (section 7a).
- No ads, no free-text chat with other players, no tracking cookies, and no third-party analytics or advertising tools. Friends in a party can only use preset emotes.
- A save code instead of an account. Three easy words and a number (for example striker · volley · corner · 4271) keep a copy of game progress so it can be opened on another device. The code is not linked to anyone’s identity.
- We do collect anonymous usage data. Things like how many visits there are, how long the game is played, which lessons and parts of the game are used, party sizes and how often emotes are used, and the kind of device. It is counted without names, and it is used for two things only: to run and improve the game, and to give sponsors combined totals (for example “players spent 18,000 minutes on the island this week”) so the game can stay free (section 7).
- Sponsors never get anything about one child. No names or first names, no save codes or party codes, no internet addresses, and no small groups: only overall numbers.
- Links that leave the game, donations and grown-up tools sit behind a grown-up check.
- We never sell or rent information, there are no ads, and we do not use information for targeted advertising or to build profiles of children.
- Grown-ups can see and delete a save at any time, right in the game, without contacting us.
2. Children and grown-ups
Futbol Island is designed for children, including children under 13, and for the parents, carers and coaches who help them. We follow the principles of the US Children’s Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code: we collect only what the game needs to work plus the anonymous usage totals described in section 7, we keep privacy-protective settings on by default, and we do not nudge children to share more.
Children are never asked to type personal information into the game. Places where a grown-up may type something (a note in the football plan, or an email address to receive a save code) are behind a grown-up check, and what is typed is handled as described below.
3. What stays on the device
Most of the game lives only in the web browser on the device being used (its “local storage”). This includes coins, cards, lessons and quiz progress, the character’s look, items, island jobs, fishing, museum visits, arcade best scores, the football plan, and settings such as sound, music, voice and controls.
This information is not sent to us unless a save code is used (section 4). Clearing this site’s data in the browser deletes it from the device.
Some things always stay on the device and are never uploaded, even with a save code: notes typed into the football plan or the coach tools, volume and control settings, and battery-saver settings.
Play with friends: while a player is in a party, the game may remember that party’s code and a random resume token on this device (for the player who started it, also the party’s host key), so they can get back in if the tab is closed. It is removed when the party ends or the player leaves, and after 12 hours at most. It never includes the first name, is never sent to our visit counter, and is not part of a save code.
4. Save codes
To play, each player gets a save code (or types one they already have). The game makes the code at random; it does not come from anything about the player.
What we keep on our server: a copy of the game progress (the same game data listed in section 3, minus the device-only items), a revision number, the day the save was made and the day it was last used.
What we don’t keep: the code itself. We store only a keyed fingerprint of it (HMAC-SHA256, with a secret key kept separately from the database), so the code cannot be read back from our records. We do not keep names, emails, photos, voice, location, IP addresses or device details with a save.
What the code is used for: only to open the player’s own saved progress on a device where the code is typed, and to keep that progress up to date while they play. These are “support for internal operations” uses. The code is not used for advertising, profiling, or contacting anyone, is never sent with visit counts (only a one-way number made from it, see “Players” in section 7), and is never shared or sold.
Two devices: if a player has played on two devices, the game asks which island to keep. The one not chosen stays on that device for 7 days so the choice can be undone in Settings.
If saving is unavailable (for example during maintenance), a player can still play; progress stays on the device and the game offers the save code again later.
Protecting codes from guessing: wrong guesses are limited per network and across the whole site, and the game gives the same answer whether a code exists or not. To apply these limits, a scrambled, day-specific fingerprint of the network address is kept for at most one day.
5. The football plan and QR links
The football plan helps a player choose one or two “I can…” goals, practise them, and talk about how it’s going. The plan is made of choices from fixed lists: goal and mission identifiers, dates, and picture choices such as a face for “how it felt”. With a save code, these choices are saved with the game progress. Typed notes are never uploaded.
Fridge cards and coach QR codes carry a plan or a goal inside the link itself, after the “#” sign. Browsers do not send that part of a link to any server, so opening a fridge card or a coach’s goal on a phone shares nothing with us. Opening any page on our site does make a normal web request (see section 8).
The plan never scores, ranks or compares children.
6. Sending a code to a grown-up
After the grown-up check, a grown-up can ask us to email the save code once. The email address is used only to send that one email and is then discarded: it is not stored, logged, shared, or used to write again. The email contains the code, what it is for, and how to delete the save. It has no links, images or tracking.
7. Anonymous usage data (visit counts and statistics)
Yes, the game collects usage data. We run our own counter (no third-party analytics), and it does not use cookies or identify anyone. We use what it collects for two purposes only:
- to run and improve the game: to see whether it works, fix problems, and learn which parts help children learn football;
- to report combined totals to sponsors who help fund the game: for example how many players visited in a week, how many minutes were played, how many lessons were watched, or how many parties were played. Sponsors only ever receive overall numbers; groups too small to stay anonymous are left out (section 13).
For each visit we record:
- a visitor code: a scrambled value made from the network address, browser type and a random key that is replaced every day, so the same visitor can’t be recognised on another day. The network address itself is not stored;
- the country and, at most, the state or province, worked out by our host from the network address (never the city or a precise location);
- the kind of device (phone, tablet or computer), worked out from the browser type, which is then discarded;
- how the visitor arrived: the name of the website that linked to us (not the full address), or a campaign tag in our own links;
- which part of the game was opened first, from a fixed list;
- time spent while the game is on screen, in total and by area (for example the island, the arcade or the museum), by place on the island, by activity (such as walking, fishing or a lesson), and by 20-metre square of the island map. These are totals; we never record a route or the order in which places were visited (only, for a visit still under way, the part of the game it is in now and the one before);
- counts of learning steps from fixed lists: lessons opened and finished, which answer was chosen first on each quiz question, steps of the welcome walkthrough, football-plan actions, and broad progress bands (such as “1–3 lessons done”);
- counts of play from fixed lists: arcade games started, designs saved by their pattern or boot model (never the colours, name, number or drawing), cards added to the binder (how they were found and which footballer’s card), card films and pop-up books opened, finished or bought, and how long a book stayed open in broad bands (such as “1–3 minutes”);
- counts of island activities from fixed lists, such as fish caught, swims started, rides and Kit Shop designs saved (never a position, a route or a drawing);
- counts from Play with friends, from fixed lists: how often a party is opened, started or joined (and why a join did not work), party sizes and lengths in broad bands (such as “3–4 friends” or “15–30 minutes”), minutes played in a party, invite links shared or opened, and which preset emotes are used and where (such as on a scooter or near a townsperson). Never the party code, a name or first name, or who played with whom;
- which buttons and links on the start page are tapped (for example Start, For grown-ups or Donate), counted as totals;
- a few settings at the start of a visit, such as whether sound or the coach’s voice is switched off;
- whether the device has played before and whether a save code is in use on it: a yes or no each, never the code.
We never record typed text, names or first names, save codes, party codes, network addresses or the order of a visitor’s actions. Small numbers are hidden in our day-by-day reports, and anything shown to a sponsor is a combined total with small groups left out.
Visits under way: we see each visit happening now as an anonymous session: the country and region it connects from, the website that linked to the game or our campaign tag, the part of the game it is in, and its time and counts so far, and we can look back at each day’s visits the same way for the 14 days we keep them. Never a name, an account, a network address or a precise location.
Players: the game keeps a random player number on the device (and, when a save code is in use, a number made one-way from the code), so our own reports can tell visits from the same player apart over time. It is not a name, an account, an email, a network address or a location, and it is never shared. Deleting the save or clearing this site’s data in the browser removes it from the device; the visits we already counted are deleted after 14 days.
Do Not Track: if the browser sends a “Do Not Track” or “Global Privacy Control” signal, the counter sends nothing at all.
7a. Play with friends (optional)
Play with friends lets a small group of friends see each other on the island. It works only after a grown-up passes the grown-up check, and a grown-up can switch it off in Settings.
What the other players in a party can see: a colour chosen by the game (such as Red or Blue), the first name only that the player typed when starting or joining (letters only, 2 to 12 letters, needed to play with friends so friends can tell each other apart), their outfit, where they are on the island, and simple preset emotes such as a wave. There is no free-text chat, no voice, no photos, and no way to send a link or a message. Please type only a first name: never a last name, school, address or contact details.
What we keep: nothing about who the players are. We do count, as anonymous totals from fixed lists, how Play with friends is used (section 7): for example how many parties started and their sizes in broad bands, never a code, a name or who played with whom. A party exists only while it is in use (an invite code works for 8 hours and a party lasts at most 12 hours). The first name is not saved on our servers once the party ends, is not kept on the device after the visit, and is never added to visit counts, save codes or reports. To let a player return after closing the tab, the device may remember the active party’s code and a resume token (section 3) until the party ends or 12 hours pass; never the first name, and never sent to analytics. Like any website, the party service sees the internet address a connection comes from; it keeps only a short-lived scrambled version in memory to stop abuse. The party service keeps only daily totals, such as how many parties started, their sizes and lengths in broad bands, and how many connections failed, with no code, name or internet address.
Controls: everyone in a party can see its code to invite a friend they know. Only the party’s host can remove a player, lock the party, change the code, reset a player’s name back to their colour, or end the party. The host is whoever started the party; if they leave or lose their connection for a while, the player who has been in the party longest becomes the host. Any player can leave, or hide or mute another player. If you see a name that should not be there, tell a grown-up.
8. Technical information
Like every website, our host receives standard technical information with each request (such as the network address, browser type and the page asked for) so it can deliver the page and protect the site from abuse. Our host keeps these logs for a short time under its own policy; we use them only to keep the service running and secure, and we do not combine them with save codes or visit counts.
9. What we never collect
Last names, usernames, ages or birthdays, email addresses or phone numbers (other than the one-time email in section 6; and other than the first name described in section 7a, which is never stored or counted), home or school addresses, photos, video, voice recordings, precise location, contacts, chat messages, or advertising identifiers.
The anonymous usage data in section 7 is collected, but it never includes any of the things above, and nothing that identifies a child is ever given to a sponsor.
10. How we use information
- To run the game and keep a player’s progress (save codes).
- To send a code to a grown-up who asks for it, once.
- To understand, in totals, how the game is used, so we can fix problems and make lessons clearer.
- To show sponsors who help fund the game combined, anonymous totals of how it is used (section 13).
- To keep the site secure and prevent abuse (for example, limiting code guessing).
We do not show ads, and we do not use information for targeted advertising, for profiling children, or to send marketing.
11. Cookies and browser storage
The game does not use tracking or advertising cookies. It uses the browser’s local storage to keep the game on the device (section 3), and a per-tab session value for the visit counter that disappears when the tab is closed. Two small yes/no marks on the device help count first-time use without knowing who anyone is: whether this device has been in the sea before, and whether it has played in (or started) a party before; they never leave the device and are not part of a save code. Our administrators’ own sign-in uses a cookie that is never set for players.
12. Services that help run the game
These companies process information only to provide their service to us, under contracts or terms that limit their use of it:
- Vercel hosts the website and works out the country and region for visit counts.
- Supabase stores saves and visit counts.
- Cloudflare runs the party service for Play with friends: messages pass through it while a party is in use and are not stored afterwards.
- Resend sends the one email a grown-up asks for, only when they ask.
- YouTube (in its privacy-enhanced mode) plays official football clips, only when a player taps a clip to play it. When a clip plays, YouTube receives the request and may collect information under its own policies. Nothing loads from YouTube until a clip is tapped.
- Stripe processes donations, which only a grown-up can start after the grown-up check. Payment details go directly to Stripe; we do not receive card numbers.
- football-data.org and ESPN provide public match scores and news. Our server fetches these; no information about players is sent to them.
Pictures of players and historical images are stored on our own site, so viewing them does not contact other websites. Links that open other websites are behind the grown-up check.
13. Sharing and selling
We do not sell or rent personal information, and we never share anything that identifies a child. We share information only with the services above to run the game, or if the law requires it (for example, a valid legal order).
Sponsors: we do share combined, anonymous totals with sponsors and supporters who help fund the game (for example, “players spent 18,000 minutes on the island this week” or “400 parties were played”). These totals never describe any one player: they contain no names or first names, save codes, party codes, internet addresses, player numbers or anything about an individual child, and groups too small to stay anonymous are left out. Sponsors do not get access to our systems and cannot use these totals to reach or advertise to any child.
If Futbol Island ever changed hands, this policy would continue to apply to information already collected, and we would tell you about any change in advance.
14. How long we keep things (our retention policy)
| Information | Why | How long |
|---|
| Saved game progress (with a save code) | So the player can continue on any device | Until deleted, or automatically 12 months after it was last used. Backups roll off within 7 days of deletion. |
| Code-guessing limits (scrambled network fingerprint) | Security | At most 1 day |
| The one-time email address | To send the code once | Not kept: discarded after sending |
| Visit-count details | Understanding use, fixing problems | 14 days, then only daily totals are kept |
| Daily totals (no visitor codes) | Long-term trends, and the combined totals shown to sponsors | Kept long-term, as they contain no information about any one visitor |
| Totals reported to sponsors | Funding the game | Kept in reports; they describe no one and leave out small groups |
| The daily random key for visitor codes | Making visitor codes unlinkable between days | Deleted the next day |
| Information on the device | Playing the game | Until the browser’s site data is cleared |
15. How we protect it
- Saves and visit counts can be reached only by our server with a secret key; the database refuses every other request.
- The key used to fingerprint save codes is kept apart from the database.
- Every uploaded save is checked against a fixed list of game data and capped in size, so nothing else can be stored.
- All connections use encryption (HTTPS).
- Code guessing is rate-limited, and a firewall watches for unusual traffic.
- Access to our systems is limited to the people who run the game.
16. Your choices and rights
Parents and carers can, at any time and without asking us:
- see what is saved: For grown-ups shows a summary of the saved progress, and “Show my code” shows the code;
- delete the save: Settings → My save code → Delete my save, or For grown-ups → Saving progress. It is removed from our server immediately;
- stop further saving: after deleting the save, that device won’t upload anything until a code is made or typed again;
- stop usage counting: turn on “Do Not Track” or Global Privacy Control in the browser, and the counter sends nothing at all from that browser;
- clear everything on a device: clear this site’s data in the browser settings.
Because we hold no names or emails, we can find a save only from its code. If you contact us with a request, please include the save code so we can act on it, and we will then delete our copy of your message.
Usage data: the details of each visit are deleted automatically after 14 days. Because they carry no name or contact details, we cannot pick out one child’s visits to delete them sooner; the daily and sponsor totals describe no one. You can ask us any question about this data using the contact in section 19.
17. If you live in the UK, EU or a US state with privacy laws
Depending on where you live, you may have rights to access, correct, delete or move information about you or your child, to object to or restrict how it is used, and to complain to a regulator (in the UK, the Information Commissioner’s Office). We use the information described here because it is necessary to provide the game you asked for, and for our legitimate interest in keeping it working, safe and useful for learning, in ways children would reasonably expect. We do not sell or “share” personal information as those terms are used in US state laws, and we do not use it for targeted advertising or profiling. The totals we give sponsors are combined, de-identified figures that do not describe any person.
Our service providers may process information in the United States and other countries. Where required, they use recognised safeguards for international transfers.
18. Changes to this policy
If we change this policy, we will update the date at the top. If a change would mean collecting more information or using it in a new way, we will not do so for children’s information until the change is clearly shown in the game and on this page, and, where the law requires, a parent has agreed.
