Privacy Policy

Who operates the site

256 TEAMS WC is operated by Mohamed A. For privacy questions or requests, email mohamed@256teams.com.

Information collected

• Accounts: username, email address, profile country, account dates and sign-in identifiers. Passwords are stored as secure hashes, not readable text. If you use Google or Discord sign-in, that provider supplies the identifiers and basic profile details needed to sign you in.
• Game and career data: tournament and match state, custom clubs, uploaded badges, Player Career and national-team manager career saves, achievements, challenge scores, selected teams, results and related settings. Some saves remain only in your browser; signed-in cloud features store the relevant data on the site's systems.
• Predictor and community data: predictions, points, private or community league membership, league names, display names and leaderboard statistics. Information you submit to a public or shared feature can be seen by other users.
• Memberships: membership status, plan, Stripe customer, checkout and subscription identifiers, billing period dates and payment status. Stripe receives the billing and payment information you enter at checkout. The site does not receive or store your full card number.
• Online play: display names, room membership, team choices and temporary room state. Room access tokens are protected using one-way hashes.
• Messages and reports: information you send through feedback, support, copyright and account-deletion requests, including any optional screenshot or contact details.
• Browser and technical data: local saves, history, settings and preferences stored on your device, plus IP address, device and browser information, page activity, referrer, approximate location, identifiers, consent choices and cookie or similar-technology data used to host, secure, measure and support the site.

Please do not put private or sensitive information in a public username, league name, club name, badge or room display name.

How information is used

Information is used to create and secure accounts; provide simulations, careers, cloud saves, Predictor leagues, leaderboards and online rooms; process and verify memberships; remove advertising for eligible accounts; answer support requests; prevent abuse; diagnose problems; understand site use; and show, measure and improve advertising.

The legal bases used are performance of the service or membership you request, legitimate interests in operating, securing and improving the site, consent where required for non-essential storage or personalised advertising, and compliance with legal obligations. Where information is required to create an account, complete a payment or provide a requested cloud feature, the feature may not work if that information is not supplied.

Public features and user content

Usernames, profile countries, Predictor leagues, rankings, results, shared rooms and custom content may be visible to other users depending on the feature and its settings. Private account, payment and contact details are not intentionally displayed publicly. Avoid uploading content you do not have permission to share.

Cookies and browser storage

Essential cookies and similar browser storage keep you signed in, remember security and consent choices, and support saves, preferences and online rooms. With consent where required, analytics and advertising technologies may measure visits, select or personalise ads, limit repetition, detect fraud and report performance. Long sessions can result in refreshed ad impressions.

You can use the site's consent controls to accept, reject or change non-essential choices, and can also clear or block site data in your browser. Blocking essential storage may stop accounts, saves or other features working. Google explains its processing in its partner-sites notice and provides advertising controls.

Service providers and international transfers

Cloudflare hosts, secures and stores site data. Stripe processes membership checkout, recurring payments, one-off purchases, invoices and the billing portal. Google provides sign-in, Analytics, advertising and fonts. Discord provides optional sign-in and may receive feedback sent through the site. Publift Fuse and its advertising partners provide and measure display, video and rewarded advertising. Other content providers may supply items such as flags or football data.

These providers receive only the information reasonably needed for their role and operate under their own privacy terms. Some may process information outside the UK. Where UK data-protection law requires it, those transfers rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism.

How long information is kept

Account, cloud-save, predictor and membership records are normally kept while your account exists and for as long afterwards as reasonably needed for billing, disputes, fraud prevention and legal obligations. Feedback and support records are kept only as long as reasonably needed to handle the issue. Stripe and advertising or analytics providers apply their own retention periods. Login sessions normally expire after 30 days. Online rooms close when the host ends them or after six hours. Browser saves remain until you reset them or clear site data.

Your rights and account deletion

Depending on the circumstances, you may have rights to access, correct or delete your information, restrict its use, receive a portable copy, or withdraw consent at any time. Withdrawing consent does not affect processing that was lawful beforehand. You can edit your profile and request account deletion from your profile, or contact the email address above. Requests may need to be verified and some records may be retained where legally required.

UK visitors may complain to the Information Commissioner's Office, although the operator would appreciate the opportunity to address the issue first.

Your right to object

You may object to processing based on legitimate interests, including certain analytics or profiling, by contacting the operator. You can object to or withdraw consent for personalised advertising through the site's consent controls. Any objection will be considered in line with applicable law.

Security and changes

Reasonable security measures are used, including password hashing, protected tokens, secure cookies and rate limits. No internet service can guarantee complete security. This policy may be updated as the site changes; the date above will show the latest version.

Privacy choices

Where consent controls apply, you can review or change your advertising and privacy choices below.