Last updated 22 October 2026
Privacy Notice
Goalpost Games can be played without an account. This notice explains what personal data is handled when you visit, play, create an account, use social features, or contact the site.
Who is responsible
Ryan Ede, based in the United Kingdom, is the data controller for Goalpost Games. Privacy questions and rights requests can be sent to support@goalpost.games.
Data we handle
If you choose Google sign-in, we receive your name, email address, verified-email status, and optional profile image to create and secure your account. We do not request offline Google access. Google provider tokens are removed after sign-in and are not retained.
Account records, opaque server-side sessions, friendship requests and relationships, blocks, and signed-in daily challenge attempts, results, streaks, and scorecards are stored in a Cloudflare D1 database configured for EU jurisdiction. Daily records include the challenge, submitted actions, resulting game states, scores, provenance, and timestamps needed to resume play and validate results. Sessions can include an IP address and browser user-agent for security and device management.
Guest progress, local matches, room reconnect credentials, streaks, and limited continuity markers can be stored on your device. The Cookie Policy lists current cookies and local browser storage, their purposes, and how long they remain.
Purposes and lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Provide optional accounts, saved games, private rooms, history, social features, and data controls | Profile, session, room, gameplay, and social records | Performance of the service you request |
| Secure accounts, validate results, prevent abuse, and diagnose failures | Session, action, IP, user-agent, rate-limit, and technical records | Legitimate interests in protecting players and operating a reliable service |
| Understand aggregate feature use and page performance | Allowlisted product events and privacy-first aggregate analytics | Legitimate interests in improving the service without profiling individual players |
| Answer support, correction, and privacy enquiries | Your email address, message, and related correspondence | Legitimate interests, steps you request, and legal obligations where applicable |
| Meet legal duties and respond to valid legal requests | Relevant account, security, or correspondence records | Legal obligation |
You can object to processing based on legitimate interests. We will assess the request against any compelling operational, security, or legal reason to continue.
Gameplay and account continuity
We use account data to authenticate you, manage your profile and sessions, resume signed-in daily games across devices, calculate private history and streaks, and validate submitted game actions. If you sign in on a browser with guest daily data, we make a one-time import of eligible current progress and the visible legacy streak. Imported records are labelled and are not treated as server-verified play.
Private online rooms
When you create or join a private online room, the player names chosen by participants, random participant identifiers, submitted answers, scores, and current game state are shared with people in that room and temporarily stored in a Cloudflare Durable Object. A one-way hash of each reconnect token is stored server-side; the original reconnect token stays in that participant's browser. Room data and credential hashes are automatically deleted no later than 24 hours after the room was created.
Friends and discovery
Your friends list is visible only to you. Other signed-in players can see your display name and handle when they know your exact handle and you allow exact-handle discovery, when a friendship request connects you, or when they open an invite you created. Invite-only profiles do not appear in exact-handle lookup. Blocking an account prevents that account from connecting with you; your blocked list is private.
Accepted friends can compare your daily attempt status, concise result metrics, and seven-day form. Today's friend results remain hidden until they have made a genuine play in that day's game. Friend leaderboards do not include your answers, scorecards, action history, completion time, email address, or account identifiers. Removing or blocking a friend removes this access.
Friend invite links expire after seven days and can be used once. The invite token stays in the private link fragment and is stored in our database only as a one-way hash, so we cannot recover the original link. Anyone who receives a valid link can preview the creator's display name and handle before choosing whether to accept it.
Signed-in players can create an opaque challenge link for a finished daily game. Anyone holding that link can reveal the sender's completion status and concise result metrics after submitting one genuine game action. Challenge links expose no name, handle, answers, scorecard, action history, or account identifier, and expire when that UTC day ends. The random link token is retained with the result until the account is deleted.
Analytics and advertising
Cloudflare provides aggregate traffic, security, and performance analytics. Cloudflare Web Analytics is designed without cookies or cross-site visitor profiles. Goalpost product events contain only an allowlisted event name, page category, game, and surface. Account identifiers, email addresses, IP addresses, room codes, answers, challenge tokens, and social relationships are not written to product analytics.
Goalpost Games does not currently load AdSense advertising code or set advertising cookies. The passive AdSense account meta tag in the page source is used only to verify site ownership. Before advertising technology is enabled, this notice will be updated and an appropriate Google-certified consent platform will be provided where consent is required.
Age policy
Goalpost accounts are available only to players aged 16 or older. Players under 16 can use guest play without creating an account. We ask you to confirm that you meet the minimum age, but we do not collect your date of birth or infer your age from Google profile data.
Sharing and processors
Cloudflare provides hosting, database, security, rate limiting, and analytics infrastructure. Google provides the optional identity service and hosted font files. These providers process data under their own security and data-protection commitments. We do not sell personal data, publish your email address, or share account data with data brokers.
Cloudflare and Google operate internationally, so technical or identity data may be processed outside the UK or EEA. Where restricted transfers apply, the providers' contractual safeguards and applicable adequacy arrangements are relied upon.
Retention and deletion
Sessions expire after 30 days of inactivity unless revoked sooner. Private online room data is deleted no later than 24 hours after room creation. Signed-in and imported daily attempts, results, aggregate game statistics, import records, action records, and social relationships are retained until you delete your account so games can resume and private account features remain available. Security and rate-limit records are kept only for their operational window. Support correspondence is retained only as long as reasonably needed to resolve the enquiry, handle follow-up, and meet legal or security requirements.
You can download your account, gameplay, and social data, revoke other sessions, sign out, or delete your account from the account page. Account deletion removes your profile, sessions, gameplay records, friendship records, blocks, and invites. Guest progress remains in your browser after import and can be removed through your browser's site-data controls.
Your data-protection rights
Depending on the circumstances, UK data-protection law can give you rights to access, correct, erase, restrict, or receive a portable copy of personal data, and to object to processing based on legitimate interests. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Send a request to support@goalpost.games. We may ask for enough information to verify that the account or data belongs to you. Exercising a privacy right does not affect rights you have under other laws.
Changes
We will update this notice when data practices materially change. The date at the top identifies the current version.