Privacy Policy — Cricket Masterplan

Last updated: 17 July 2026.

This policy covers the Cricket Masterplan website (www.cricket-manager.co) and the Cricket Masterplan game (app.cricket-manager.co), together "Cricket Masterplan". The data controller is Jason Wirth, the developer of Cricket Masterplan. You can reach me at jason@cricket-manager.co.

What we collect

Account details, minimum-age confirmation and terms acceptance. The game requires an account to play. We store your email address and a password (handled by our authentication provider, Supabase — we never see your password itself). Accounts are for people aged 13 and over who also meet any higher minimum account age that applies in their country, so we store the date and time when you confirm that you meet those requirements. We store the version of the Terms of Service you accepted and the acceptance time. We do not ask for your date of birth, country or an identity document.

Game saves. Your saved careers are stored in our Supabase database so you can continue across devices, along with basic save metadata (county, edition, season and save time). Owner-scoped copies and two rotating backups are also kept in IndexedDB in each browser you use, so the game can survive a connection failure. Save files are not stored in ordinary local storage.

Feedback and screenshots. If you use the in-game feedback tool, we store your message, the screen you were on, save version, edition, county, season, round and browser user-agent. You may choose to attach a screenshot. Screenshot objects are stored in a private Supabase bucket, are not publicly readable and can be accessed only with administrator credentials. Please avoid including information in a screenshot that is not needed for the report.

Automatic crash reports. If you enable automatic crash reporting and the game crashes, we may store the error message, JavaScript stack trace, React component stack, page origin and path, and browser user-agent. The crash URL excludes query parameters and fragments. We do not automatically attach a screenshot or save file. Automatic crash reporting is off by default and can be controlled in Settings.

Gameplay analytics. We record basic gameplay events tied to your account — signing in, starting a new game, which screens you visit, matches played and seasons completed. This is our own first-party system: no advertising networks or third-party analytics platforms are involved, and we don't use tracking cookies.

Gameplay analytics is off by default. You can choose to enable it in Settings. That account-level preference is stored with the time it was changed and applies when you use another device.

Beta waitlist (historical). The beta waitlist has ended. Email addresses previously submitted through Formspree are no longer used and are scheduled for deletion together with the retired form and any exports.

Service logs. Supabase and Vercel generate short-lived technical and security logs that can include IP address, request time, browser or device information and requested path. We do not configure a separate log drain.

What we use it for

Running the game and administering your agreement — accounts, terms acceptance, cloud saves and sign-in (necessary to provide the service you've asked for and perform our agreement with you).
Enforcing the minimum account age — your minimum-age confirmation (our legitimate interest in applying the account rules and reducing data-protection risks to younger children).
Handling feedback you choose to send — your message, optional screenshot and diagnostic context (our legitimate interest in answering the report and improving the game).
Diagnosing crashes — limited automatic crash details (our legitimate interest in keeping the service reliable, subject to your right to switch this off or object).
Understanding and improving gameplay — limited first-party analytics (our legitimate interest in improving the game, subject to your right to switch this off or object).
Keeping the service secure — server logs (our legitimate interest in preventing abuse).

We do not sell your data, share it with advertisers, or use it for any purpose beyond the above.

Cookies and browser storage

We don't use advertising or third-party tracking cookies. Supabase stores the sign-in session in local storage. The game stores small settings and interface preferences in local or session storage, and stores local save copies in IndexedDB. Clearing this site's browser data removes those on-device records; it does not delete cloud saves. Oswald and Bitter font files are served from our own sites, so loading them does not send a request to Google Fonts.

Who processes your data

We use the following providers to run Cricket Masterplan:

Supabase Pte. Ltd — authentication, database, private file storage and service logs. The live project's primary data region is AWS eu-central-1 in Frankfurt, Germany. Supabase and its authorized subprocessors may also process limited data elsewhere for support, security, email, control-plane and monitoring services.
Vercel Inc. — static hosting through a global edge network. Requests may be processed in the United States and other edge locations. Vercel handles service-generated traffic and security data under its own Privacy Notice where it acts as controller.
Formspree Inc. — historical beta-waitlist submissions only, pending final deletion. No new waitlist data is collected.

For restricted transfers, Supabase's data-processing addendum contains the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Vercel states that it participates in the EU–US Data Privacy Framework and the UK Extension for processing covered by that framework, and its paid-plan data-processing addendum also contains the EU clauses and UK addendum. Current provider subprocessors and locations can change; we review them and the applicable transfer assessment regularly.

You can ask for a copy or summary of the transfer safeguards by emailing jason@cricket-manager.co. We may redact confidential commercial or security details, but not information needed to understand the safeguard.

How long we keep it

Account, minimum-age confirmation, terms, privacy-preference and cloud-save data: until you delete it or close your account.
Bug and idea feedback and diagnostic context: 180 days.
Feedback screenshots: 90 days.
Automatic crash reports: 30 days.
Account-linked gameplay analytics: 90 days.
Vercel Hobby runtime logs: one hour under the current hosting plan. Supabase platform logs rotate under the project's provider plan.
Support and rights-request correspondence: 12 months after the request is closed, unless a specific legal hold applies.

Expired feedback, screenshots, crash reports and analytics are reviewed and deleted through the documented operator process. Daily automated deletion has been prepared but is not yet active. When an account is deleted, live Auth data, saves, feedback, screenshots and analytics are removed without undue delay and no later than 30 days after a verified request. Deleted database rows may remain temporarily in inaccessible rolling provider backups until those backups expire; private Storage screenshots are not included in Supabase database backups. A browser copy remains on a device until site data is cleared on that device.

Your rights

Where applicable data-protection law gives you these rights, you can ask us to:

tell you what data we hold about you, and give you a copy;
correct data that's wrong;
delete your data ("right to erasure");
restrict or object to how we use it;
give you your data in a portable format.

To exercise any of these, email jason@cricket-manager.co from the address on your account and we'll respond without undue delay, normally within one month. You may complain to the Information Commissioner's Office where UK law applies, or to the data-protection authority in the EEA country where you live or work where EU GDPR applies. You do not have to contact us before complaining.

Your right to object

You may object at any time to processing based on our legitimate interests, including account-linked gameplay analytics and automatic crash reporting. The quickest route is to turn either category off in the game's Settings; the preference is stored on your account and stops new records on every device. You may also email jason@cricket-manager.co and explain your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your rights or the processing is needed for legal claims. We will respond within one month.

Children

The Cricket Masterplan account-based game is offered to people aged 13 and over who also meet any higher minimum account age that applies in their country. A person who does not meet both requirements must not create or use an account. The public information website can be read without an account. New account holders must confirm that they meet the minimum-age requirements and accept the current terms during registration. Existing account holders who have not previously confirmed the minimum age must do so before the game loads or cloud saves are accessed.

Users aged 13 to 17 are children for data-protection purposes and receive the same privacy-protective defaults as every other user. Account-linked gameplay analytics and automatic crash reporting are off unless the account holder actively enables them. The game has no advertising, purchases, public profiles, user-to-user communication or public sharing, and it does not use personal data to recommend content or influence gameplay.

We use a self-declaration rather than collecting a date of birth or identity document because the service is low risk and this avoids gathering additional identifying information solely for age checking. We keep this approach and the service's use by children under review. If the risk or feature set changes, we will reassess whether stronger age assurance or additional age-appropriate safeguards are required.

If you are under 13, or below the higher minimum account age that applies in your country, please do not use the account-based game. If you are a parent or guardian and believe an ineligible child has created an account, email jason@cricket-manager.co. We will investigate promptly and, where appropriate, close the account and delete its personal data in line with the retention section above.

Changes to this policy

If we change this policy in a way that matters — for example, collecting something new or adding a provider — we'll update this page and note it to signed-in players. The "last updated" date at the top always reflects the current version.