Privacy

What SoccerGhost stores, why, and how to get rid of it, on soccerghost.com and in the SoccerGhost app. In plain terms, because a policy nobody can read is not consent.

Last updated 11 October 2026.

If you never sign in

You can read every prediction, statistic and Ghost Record entry on this site without an account, and we store nothing that identifies you. No profile is built, and nothing follows you between visits beyond the settings your own browser keeps for you — the teams you follow, your theme, and your 18+ declaration are stored on your device and never sent to us. Where ads are shown, Google's advertising cookies are the exception: they are Google's, not ours (see Advertising).

If you sign in

When you sign in with Google or Apple, we keep a code — not your email. We keep your name, country, age confirmation, and saved data. You can delete everything anytime. 18+ only.

Google and Apple send us a stable identifier for your account, and usually your name and email address. We do not keep your email address — nothing here needs one, and an address we do not hold cannot be leaked or sold. We store:

• That identifier, and which of the two providers issued it.
• Your display name, where the provider supplies one. Apple sends it only on the very first authorisation, so it is captured then or never.
• When you confirmed you are 18 or over, if you did.
• The two-letter country your connection appears to come from, for the national leaderboard. Never a location, and never your IP address.
• The slips you choose to keep, and how they settled.
• A public name for the league tables, only if you choose one.
• The teams you follow and the competitions you have pinned, so a second device shows the same ones. These reach us only once you have signed in, and only as a merge with whatever the account already held — signing in never wipes either side.
• The tipsters you follow, if you follow any.
• The codes of any private leagues you have joined.
• A recovery phrase, if you ask for one — stored only as a one-way hash, so we could not tell you what it was.
• When you were last signed in.

Signing in with Google

SoccerGhost uses Google only to sign you in. When you choose Google, it sends us a signed sign-in token carrying your Google account ID, your name, your email address and a link to your profile picture. That is all SoccerGhost asks Google for: it gets no access to your Gmail, contacts, files, calendar or anything else in your Google account.

• What we keep: your Google account ID, so we know it is you next time, and your name, which only you see, on your profile.
• What we drop: your email address and your profile picture. The token is checked, your account ID and name are taken from it, and the rest is discarded without being stored.
• What it is used for: signing you in, and keeping your account — kept slips, follows, league entries — the same on every device you use. Nothing else: not advertising, not profiling, not training AI.
• Who it is shared with: nobody. It is not sold, and not passed to advertisers, bookmakers or anyone else.
• How long it is kept: until you delete your account, which removes your Google account ID and name straight away (backups below).

SoccerGhost's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Lineup alerts

If you turn on alerts, your browser gives us an address at its own push service and a key to encrypt messages for it. We store those against your account and delete them when you turn alerts off, when the push service tells us the address has gone, or when you delete your account. What an alert says is encrypted before it leaves us, so the push service that delivers it cannot read it.

The daily pick by WhatsApp or SMS

No account is involved. If you ask for it we store your phone number, the channel, the hour you want it and your time-zone offset, your language, and the two-letter country your connection appears to come from. A number that is never confirmed with its code is deleted once the code expires. A confirmed number is deleted, not flagged, the moment you reply STOP — and also if messages to it keep failing.

What is public, and only by choice

Nothing about you appears publicly until you choose a public name for the league tables. Your provider name is never used — it is frequently somebody's real name, and publishing that on a betting leaderboard because you once tapped "continue with Google" is a disclosure nobody agreed to. Leaving the tables removes you immediately. In a private league, its members see your public name; members without one are not shown.

What we read on every request

The network in front of this site tells us which country your connection appears to come from. It decides which competitions to show first and whether bookmaker prices may be displayed where you are. It is used for that request and not recorded, except in the two places above where it is stored for a reason: your account, and a daily-pick subscription.

The server also writes a line for each request it answers: the address of the page or data asked for, without the part after a "?", the answer's status and how long it took. It is how we find faults and slow pages. Those lines hold no IP address, no country and nothing about your account. They are kept for fourteen days; the most recent are also in the server's running output, which is overwritten as it fills and cleared each time the site is updated.

When something breaks in the app in your browser, it tells this server what broke: the kind of error, its message, the file and line it came from, and the address of the screen, without the part after a "?". No IP address, nothing about your account and nothing you typed is sent with it. It is how we find faults we would otherwise never see, and the line is kept as the request lines are, for fourteen days.

Counting visits

No visit counter runs on these pages. The request lines above are how we know how much the site is read.

Who else sees it

• Google and Apple, if you use them to sign in — they already know.
• Our hosting and content network, which necessarily handles requests.
• Our football data provider's image service (media.api-sports.io), which sends team crests and players' photos straight to your browser. Like any site your browser fetches from, it sees your IP address.
• Backblaze, which stores our encrypted backups in the United States.
• WhatsApp or our SMS provider, if you ask for the daily pick — they deliver it, so they see the number and the message.
• Your browser's push service, if you turn on alerts — it delivers them, but cannot read them.
• Advertisers, where ads are shown: Google and the ad networks it works with, under their own cookies (see Advertising). We do not pass them anything about your account.
• Bookmakers see only that a visitor arrived from us, via a link you chose to click. We do not send them your details.

We do not sell anything about you to anybody, and there is no arrangement under which we would.

Google, Cloudflare, Backblaze and the image service handle what they see outside South Africa, under their own data-protection terms.

Advertising

Where SoccerGhost shows ads, they are served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. Other ad networks that Google works with may also serve ads here, using their own cookies in the same way. Google and these third parties may place and read cookies in your browser, or use web beacons or IP addresses, to collect information as a result of ads being served here.

You can opt out of personalised advertising in Google's Ads Settings, and from other vendors at www.aboutads.info (in Europe, www.youronlinechoices.eu). Google explains how it uses information from sites that show its ads at policies.google.com/technologies/partner-sites.

Ads are kept apart from your account: advertisers get nothing about you from us, and nothing from your Google sign-in is ever used for advertising.

How we protect it

• Every connection to SoccerGhost is encrypted (HTTPS). An address typed with http is sent to the encrypted one.
• You stay signed in through an encrypted cookie that is only ever sent over HTTPS and that no script on the page can read.
• The database runs on our own server and cannot be reached from the internet.
• Its backups are encrypted (AES-256) and kept in private storage, where nobody can change or delete them for their first 30 days.

How long we keep it

Account data is kept while you have an account, and removed when you delete it (below). The database is backed up every night and each backup is deleted 36 days after it is made, so nothing you delete outlasts that in a backup. Alert addresses and daily-pick numbers go sooner, as described above.

Getting rid of it

To delete your account:

1. Open your profile at soccerghost.com/app/me, in the app or the browser, and sign in.
2. Choose Delete my account, then Delete everything.

It removes your account and everything stored against it above — kept slips, follows, leaderboard handle, alert subscriptions and recovery phrase. It is immediate, it signs out every device within minutes, and there is no confirmation email designed to change your mind. A private league you started stays for the people who joined it, under the name you gave it. A league nobody else joined goes with your account. Published Ghost Record entries are not personal data and remain — they are calls the Ghost made, not things you did.

If you can no longer sign in, write to privacy@soccerghost.com and say how you signed in.

For the daily pick, reply STOP to any message.

You can also ask for a copy of what we hold, ask us to correct it, or object to how we use it, at the address below. And you can complain to the Information Regulator, at inforegulator.org.za, enquiries@inforegulator.org.za or 010 023 5200.

Children

This site is for adults. It is not directed at anyone under 18, and we do not knowingly hold an account for anybody under that age.

Contact

SoccerGhost is run by Devroom SA (Pty) Ltd, registration number 2018/281366/07, which decides what is kept and why. Write to privacy@soccerghost.com, or by post to:

What records we hold, and how to ask for one, is in our PAIA manual.