Cookie Policy

This Cookie Policy explains how Footy26 (operated by Lilico LLC) uses cookies and similar browser storage when you visit footy26.com. It complements our Privacy Policy and Terms of Service. By using Footy26 you agree to the use of cookies as described below; you can change or withdraw your choices at any time.

1. What “cookies” means here

Footy26 uses a small number of cookies and equivalent browser-storage technologies (localStorage, the service worker cache, IndexedDB). The legal rules that govern cookies (EU ePrivacy Directive, UK PECR, Brazilian LGPD) apply to anything stored on or read from your device, so we treat all of these the same way. Throughout this page we use the word “cookies” to mean the whole family.

2. What we use and why

2.1 Strictly necessary

These are required for Footy26 to work. They cannot be disabled from inside the app because the site cannot function without them.

• Supabase authentication session (sb-*-auth-token): keeps you signed in across pages. Expires when you sign out or when the session refresh window lapses.
• Locale preference (NEXT_LOCALE): remembers your chosen language so the site loads in the same language next time. Expires after one year.
• Consent record (cc_cookie): remembers your cookie choices so we don’t prompt you again on every visit. Expires after one year.
• Theme + view preferences (wc26-theme, footy26.bracket.mode, banner-dismissal flags): small localStorage entries that remember your light/dark choice and which bracket layout you prefer.
• Service worker cache: the Progressive Web App layer caches static assets and read-only bracket data so the app works offline and loads instantly on repeat visits. The cache is cleared automatically when Footy26 ships an update.
• Web Push subscription (only if you turn on push notifications): a token tied to the Footy26 origin so we can send the alerts you opted into. You can revoke this any time from Settings or your browser’s site settings.
• Error reporting (Sentry): Sentry does not set cookies on footy26.com. It receives anonymized error stack traces with email, username, IP address, and cookie payloads stripped before transmission. We rely on Sentry under our legitimate interest in keeping the service running and bug-free. If you would prefer that we not collect even anonymized error reports about your sessions, email eric@lilicollc.com and we will exclude your account.

2.2 Analytics (opt-in)

These cookies and storage entries are off by default and only set if you click “Accept” on the cookie banner or enable them from the preferences modal. They help us understand which features people use, in aggregate, so we can fix bugs and improve the product.

• PostHog (ph_*, plus a matching localStorage entry): product analytics. Stores a random visitor identifier so we can tell apart returning visitors from new ones in aggregate. No personal identifier is stored in this cookie. Expires after one year.

2.3 Advertising / cross-site tracking

Footy26 does not use any advertising or cross-site tracking cookies. We do not run Google AdSense, advertising networks, ad-conversion pixels, or behavioral retargeting. We never sell or share your personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CCPA/CPRA).

2.4 Email open and click measurement

This is not a cookie on footy26.com, and it stores nothing on your device while you browse the site, but we disclose it here because it is the same kind of measurement. The transactional emails we send (for example a bracket-deadline reminder) include a small tracking pixel and wrapped links, so we can see in aggregate whether a message was delivered, opened, and clicked. We use this only to tell whether our reminders are useful.

We tie this to your analytics choice. If you decline analytics, we stop attributing your email opens and clicks in our analytics. We still record hard bounces and spam complaints either way, so we can stop emailing an address that is unreachable or has asked not to hear from us. You can turn the reminder emails off entirely from Settings or the unsubscribe link in any email.

3. Third-party processors

The cookies above are set either by Footy26 or by the following processors:

• Supabase, Inc.: authentication and database. United States. Privacy notice.
• Vercel Inc.: application hosting and content delivery. United States. Privacy notice.
• PostHog Inc.: product analytics (opt-in). United States. Privacy notice.
• Resend: transactional email delivery and open/click measurement. United States. Privacy notice.
• Functional Software, Inc. (Sentry): error monitoring with PII stripped. United States. Privacy notice.
• Stripe, Inc.: payment processing for voluntary tips. United States. Cookies for the tip flow are set on stripe.com, not footy26.com. Privacy notice.
• Google LLC: identity provider for sign-in (OAuth). Cookies for the sign-in flow are set on google.com, not footy26.com. Privacy notice.

Footy26 is operated from the United States. If you visit from outside the United States your information may be transferred to and processed there, which may have different data-protection laws than your home country. See our Privacy Policy for the full international-transfer disclosure.

4. Your choices

You have three ways to manage analytics cookies:

• The banner: on your first visit, click “Reject” to decline analytics or “Accept” to allow them.
• Cookie preferences modal: open it any time to manage cookie preferences.
• Settings: signed-in users can also manage preferences from Settings → Preferences → Cookie preferences.

Strictly-necessary storage cannot be disabled inside Footy26 because the site cannot function without it. To clear or block it system-wide, use your browser’s controls (see section 5 below).

We respect the Global Privacy Control (GPC) signal: if your browser sends GPC, analytics cookies stay off by default. You can still opt in via the preferences modal if you want to.

Your analytics choice also governs email open and click attribution (see section 2.4): declining analytics turns that off as well.

5. Browser-level controls

Every modern browser lets you view, delete, or block cookies and clear localStorage. These controls are outside Footy26 and apply to every site you visit.

• Chrome: Settings → Privacy and security → Cookies and other site data.
• Safari: Settings → Privacy → Manage Website Data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Edge: Settings → Cookies and site permissions.

Blocking strictly-necessary cookies will sign you out and may prevent the bracket from saving.

6. Children

Footy26 is not directed to children under 13. We do not knowingly set analytics cookies on devices of children under 13. If you believe a child has provided us with personal information, contact us at eric@lilicollc.com and we will delete it.

7. Changes to this policy

We may update this Cookie Policy from time to time. If we make a material change we will update the “Last updated” date and, where the change is significant, re-prompt you with the consent banner. Your continued use of Footy26 after the change takes effect constitutes acceptance of the revised policy.

8. Contact

Questions about cookies, or want to exercise a privacy right under GDPR, UK GDPR, LGPD, or CCPA/CPRA? Email eric@lilicollc.com.

Lilico LLC