Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data Moneyball collects when you use the website, why, who else handles it, how long it is kept and what your rights are. It is written for the Indonesian Personal Data Protection Law (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, "UU PDP"), and it also describes the rights readers in the European Union and the United Kingdom have under the GDPR.

1. Who we are

Moneyball is an independent football statistics and probability website, run from Indonesia. It is the controller of the personal data described here.

Moneyball holds no money for anyone. Its figures come from its own statistical model, the Dixon-Coles · xG fusion model: a Dixon-Coles goal model fed with expected goals (xG), shots, big chances, pressure and other match statistics, which turns them into probabilities and expected values. The model is about matches and teams, never about you.

2. The data we collect

When you create an account

• Email address and password, if you sign up with email. The password is handled by Google Firebase Authentication; Moneyball never sees or stores it.
• Your Google name, email address, profile photo and Google account ID, if you sign in with Google. We receive only what Google shares for sign-in.
• Your username, the public name shown with your comments.
• Your email alert choices (football news, new match probabilities, announcements), if you turn any on, with the confirmed email address they are sent to.
• Account details: your email address and whether you have confirmed it, how you sign in (Google, or an email and password), when you last visited, and, only if you add them under My account, your first and last name, a profile photo, what describes you (for example fan, scout or analyst), the organisation you work for and your job title or the club you support, your country and city, phone number, website or LinkedIn, and how you heard about us. They are used to run your account and to set up club licences, and only you and the Moneyball team can see them. We never see your password.
• Payment proofs and messages: if your plan is not switched on after you paid, you can send us how you paid (PayPal or Wise), a screenshot of the receipt, its transaction or transfer number and a note; and you can write to us from My account > Help and support. We keep them with your account ID and email so we can answer, and only you and the Moneyball team can see them.
• Premium: whether your account is Premium and until when, and, if you reserve the launch price, the billing period you chose. Payments are taken by PayPal, or sent by a Wise transfer; card, bank, PayPal and Wise account details are handled by PayPal and Wise and Moneyball never stores them. They tell us the name, email address, amount and status of each payment so we can switch Premium on; with PayPal we also pass your account number, so the payment reaches the right account.
• Your choices at sign-up: whether you want match previews and the latest stats by email, your confirmation that you are over 18 and have read these documents, and the time your account was created.

When you take part

• Comments and replies you post, the likes you give, and the time of each. These are public.
• User Predictions votes (three-way result, correct score, man of the match). Totals are shown publicly; your own ballot is stored with your account ID.
• Reports you file about a comment, with the reason. Only moderators can read them.

Stored in your browser

• Preferences (light or dark theme, the number format, the board view you chose) are kept in your browser's local storage. They never leave your device.
• Sign-in state: Firebase keeps you signed in using your browser's storage.
• The human check: when you pass the check that you are a person (quietly by Cloudflare at your first visit, and before you sign up or post a comment), the time you passed it is kept in your browser so you are not asked again for a week.

Moneyball uses no analytics or tracking tools of its own. Two outside services can set their own cookies:

• Google AdSense shows ads to readers who are not signed in, never to Premium or Moneyball Scout members. Google and its partners use cookies to show ads based on your visits to this and other websites. You can turn off personalised ads in Google's Ads Settings, and for other ad companies at aboutads.info. How Google uses this data: policies.google.com/technologies/partner-sites.

Technical data

The services that run the site (section 5) see the technical details any website receives: your IP address, browser and device type, and the time of each request. They use them to deliver pages, keep accounts secure and prevent abuse.

Keeping robots out

To stop automated accounts, spam and scraping, the site checks that visitors are people: at the first visit, on the sign-up form and before a comment. The check looks at how the button is pressed and whether the browser is controlled by a program; if we switch on Cloudflare Turnstile or Google reCAPTCHA (through Firebase App Check), those services see technical details of your browser and device to tell people from robots, under their own privacy policies. Commenting also needs a confirmed email address, and the database accepts at most one comment every 20 seconds from an account.

What we do not collect

We do not collect card or bank details, identity documents, your location, or your contacts. We do not buy personal data from anyone, and we do not sell it.

3. Why we use it, and on what basis

We make no automated decisions about you that have legal or similarly significant effects. Three reports from different members hide a comment until a moderator reviews it; a person makes the final decision.

4. Football data

Match, team and player statistics (expected goals, ratings, lineups, live events and the rest) come from our licensed data provider, Sportmonks. They describe professional players' public sporting performance. We send Sportmonks no data about you.

5. Who handles your data

• Google (Firebase Authentication and Cloud Firestore) stores accounts, profiles, comments, votes and reports for us, as our processor. The Firestore database is in Google Cloud's Jakarta region (asia-southeast2), in Indonesia.
• Cloudflare (Cloudflare Pages) hosts the website and the live match feed and receives the technical data of each page request.
• Resend sends Moneyball's emails for us, as our processor: it receives your email address and the email we send you.
• PayPal takes subscriptions for Premium in US dollars and shares with us the name, email address, amount and status of each payment and of the subscription.
• Wise carries a Premium payment sent by Wise transfer, and shows us the sender's name, the amount, the reference and the date of the transfer.
• Wise pays the FPL League prizes: we give Wise the winner's name, email address and the amount, and the winner gives Wise their bank details directly, never to us.
• Cloudflare (Turnstile) and Google (reCAPTCHA, through Firebase App Check), when switched on, check that visitors and requests come from people in real browsers.
• Google Fonts delivers the site's typeface, which shows your IP address to Google.
• Google AdSense shows the ads described in section 2 and receives the technical data of your browser to do so, under Google's own privacy policy.
• Moderators appointed by Moneyball can read reports and remove comments.
• Authorities, only when Indonesian law requires us to disclose data, or to protect someone's safety.

Each of these providers has its own privacy policy for the data it handles as a controller.

6. Transfers outside Indonesia

Our database is in Indonesia, but Google's sign-in service, Cloudflare, PayPal and Wise operate worldwide, so some data (for example sign-in records, page requests and the emails we send) may be processed in other countries, including the United States. We rely on these providers' data protection terms and contractual safeguards, as UU PDP Article 56 requires for transfers abroad.

7. How long we keep it

• Account and profile: until you ask us to delete your account.
• Comments: until you delete them, a moderator removes them, or your account is deleted.
• Votes: until your account is deleted.
• Reports: until reviewed, and no longer than 12 months.
• Payment proofs and messages: as long as needed to deal with them, and no longer than 24 months (payment records may be kept longer where tax law requires).
• Payments, cancelling and refunds: how a subscription is cancelled, the free trial, and the rule that a payment once made is not refunded are set out in our Terms of Use.
• Marketing consent and email alerts: until you withdraw them or turn them off.
• Browser preferences: until you clear your browser's storage.

8. Your rights

Under UU PDP (Articles 5 to 13) you have the right to:

• be told who is processing your data, why, and on what basis;
• have inaccurate or incomplete data corrected;
• access your data and get a copy of it;
• end the processing and have your data deleted or destroyed;
• withdraw consent you have given, such as for marketing emails;
• object to decisions based only on automated processing;
• delay or restrict processing;
• receive your data in a commonly used, machine-readable format, or have it sent to another controller;
• sue and claim compensation if your data is processed unlawfully.

Readers in the European Union and the United Kingdom have the equivalent rights under the GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawing consent.

To use any of these rights, write to us (section 12) from the email address on your account. We answer within the time UU PDP sets, which is 3 × 24 hours for most requests. We may ask you to confirm it is your account before we act.

Deleting your account. Email [email protected] with the subject “Delete my account”, from the email address you signed in with, on the website or in the app. We delete your account, profile, comments, votes and alerts within 3 × 24 hours and confirm by email. Records of payments are kept for as long as Indonesian tax law requires; nothing else is kept.

8a. Payments, free trial, cancelling and refunds

• A payment that has been made is not refunded. Moneyball Scout and a Club Licence open as soon as the payment is confirmed, so money already paid (by PayPal, Wise or Google Play) is not returned, in whole or in part, also when you stop using the plan or cancel during a period you have paid for.
• A free trial is different. Where a plan comes with a free trial (for example 7 days in the Google Play app), nothing is charged during the trial: cancel before it ends and you pay nothing at all.
• Cancelling is done in My account > Your subscription > Cancel my subscription. It stops the next monthly or yearly payment; your plan and your Scouting Portal stay open until the end of the period already paid for.
• The full rules are in our Terms of Use. A subscription bought in the app is also covered by Google Play’s own refund policy, and nothing here takes away a refund right that the law of your country gives you and that cannot be excluded.

9. Security

The site is served only over HTTPS. Passwords are handled by Firebase Authentication and are never stored by Moneyball. Database rules allow members to write only as themselves and only within fixed limits, and moderator access is granted by hand. No system is perfectly secure; if a personal data breach happens, we will tell affected members and the authority within 3 × 24 hours, as UU PDP Article 46 requires.

10. Age

Moneyball is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.

11. Complaints

Please contact us first; we would like the chance to put things right. You may also complain to the Indonesian personal data protection authority: UU PDP establishes a dedicated agency, and until it is fully operating, complaints are handled by the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, Komdigi). Readers in the European Union or the United Kingdom may complain to the data protection authority where they live.

12. Contact

Moneyball, Indonesia.
Email: [email protected]

13. Changes to this policy

When this policy changes, the date at the top changes too. If a change affects how we use your data in a significant way, we will tell signed-in members on the site before it takes effect.