Legal
Privacy Policy
Last updated: 29 September 2026 · Version 1.0
Plain-language policy, not legal advice. We plan a lawyer review as prize pools grow.
This policy explains what personal data Form8 ("we") collects, why, and what you can do about it. Controller: Form8, an independent project (legal entity to be registered). Contact: support@form8.football.
1. What we collect
| Data | Why |
|---|---|
| Email (if you log in with email/passkey) | Login, account security, important service messages |
| Wallet address (Solana) | Your account identity, entries, prize claims |
| Nickname | Shown on leaderboards |
| Squads, entries, scores, XP, invites | Running the game, rankings, prizes, invite rewards |
| Eligibility attestation (timestamp + Terms version) | Proof you accepted the Terms and confirmed eligibility |
| IP address, device/browser info, logs | Security, fraud and multi-account prevention, debugging |
| Cookies / local storage | Keeping you logged in, language choice — see Cookie Policy |
We do not collect your seed phrase or private keys, and we never ask for them. We do not sell your data.
2. Legal bases (GDPR-style)
- Contract: to provide the game you signed up for.
- Legitimate interests: security, fraud prevention, improving the service.
- Legal obligation: where law requires us to keep or disclose data.
3. Onchain data is public and permanent
Entries, payments and prize claims happen on the Solana blockchain. Your wallet address and these transactions are public, visible to anyone, and cannot be changed or deleted — by us or anyone else. Avoid linking your wallet address to your real identity if you care about privacy.
4. Who processes data for us
We use trusted providers who process data only to run Form8:
- Turnkey — embedded wallet and email/passkey authentication
- Helius — Solana RPC (sees wallet addresses and transactions you send)
- Upstash (Redis) — application data storage
- Vercel — website hosting and server logs
- Public Fantasy Premier League data feeds — we only read from them; we do not send your data there.
We do not currently use third-party analytics.
Some providers may be located outside your country (including outside the EU/EEA). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
5. How long we keep data
- Account data (email, nickname, squads, XP): while your account is active, then deleted or anonymised within 12 months of deletion request or inactivity, unless we must keep it longer.
- Records of entries, payments and attestations: up to 5 years for legal, tax, anti-fraud and dispute purposes.
- Server logs / IP: up to 90 days, unless needed to investigate abuse.
- Onchain data: permanent (outside our control).
6. Your rights
Depending on where you live, you can: access your data, correct it, delete it, restrict or object to processing, port it, and withdraw consent. You can also complain to your local data protection authority.
7. Deleting your account
Email support@form8.football from your account email (or tell us your wallet address and sign a message if we ask) with the subject "Delete my data". We will reply within 30 days. Note: we cannot delete blockchain records, and we may keep limited records required by law or for open disputes. Claim any unclaimed prizes before requesting deletion.
8. Security
We use reasonable technical and organisational measures (encryption in transit, access control, minimal data). No system is 100% secure.
9. Children
Form8 is only for adults (18+, or 21+ where required, including Ukraine). We do not knowingly collect data from minors; if we learn we have, we will delete it.
10. Changes
We will update the "Last updated" date and notify you in the app about material changes.
11. Contact
support@form8.football · Telegram alerts @Form8AlertsBot · X @Form8HQ