What we know about you, why we know it, and how to make us forget it.
Last updated 21 September 2026.
Match-Lens decides what personal data this service collects and why, and is therefore its controller under the General Data Protection Regulation.
Write to support@match-lens.com about anything on this page.
Match-Lens is a football statistics board. It needs very little about you, and it asks for nothing it does not need.
Your email address, a display name if you set one, the date you joined, and your password. The password passes through our sign-in service, over an encrypted connection, on its way to our authentication provider, which stores it only as a one-way hash. We do not keep it, and it cannot be read back by us or by anyone else. If you ask for a password reset, we keep a one-way hash of the reset link and of the network the request came from, so that the reset cannot be abused.
When you create an account with an email and a password, nothing is created until you open the link we send to that address. Until then we keep the address, the name you gave and a one-way hash of the password for up to 24 hours, and the request itself is deleted within a week.
When we send a message to every account, it can also arrive by email. Every such email carries a link that turns these news emails off; the message stays in your inbox on the site either way. Messages written to you personally are not news emails and are not affected.
If you sign in with Google or Apple, that company confirms who you are and tells us your email address and, if you share it, your name. We never receive your Google or Apple password, and we ask those accounts for nothing else. Apple may give us a private relay address in place of your own.
The choices that make the board yours: favourite teams and competitions, competitions you have hidden, which statistics columns you show, your chosen signal, the marks you put on rows, your theme, your time zone and your alert preferences. Also any notes you write about a match or a team. These are yours, they are visible only to you, and they follow your account between devices.
A subscription token from your browser that lets us push a notification to that device, the browser and device description your browser sends with it, and a record of which alerts we have already sent you so we do not repeat them. Turning alerts off in your profile deletes the subscription at once. Blocking notifications in the browser's own settings stops them too, and the subscription is deleted the next time a delivery is refused.
Your customer and subscription identifiers at our payment provider, which plan you hold, when the current period ends, and a ledger of payment events so that your access is correct and our accounts are correct. Your full card number and its security code never reach us: they go from your browser straight to the payment provider, who is a certified card processor. The provider tells us the card's brand, its last four digits and its expiry date, so that the Billing tab can show which card is on file. We read those from the provider when the tab opens and do not store them. If you withdraw from a purchase, the statement you send (your name, the purchase and the time you sent it) is kept with these records.
The free 2-day trial is one per person. To hold that line we store a one-way hash of your network address rather than the address itself, a random identifier we put in a cookie on the browser that took the trial, and, from the payment method you save, a fingerprint the payment provider gives us that identifies a card without revealing its number. We compare hashes to hashes. We do not use any of it to profile you or to work out where you live.
An account can be signed in on up to 3 browsers at a time, as the Terms of Service explain. To keep that count, each signed-in browser carries the random identifier in the ml_dev cookie, and for each one we keep the description your browser sends of itself (its type, version and operating system), a one-way hash of the network it last used, and when it was first and last seen. We also keep a list of the hashed networks your account has been used from, with when and how often, so that an account passed around a group of people shows up for what it is. We never store a network address itself.
While you are signed in, we note which days you were on the site and, from the regular check that keeps you signed in, roughly how many hours a board was open. While a board is on your screen it also counts how many minutes it was visible, how many of those came within a minute of you clicking, tapping, scrolling or pressing a key, and whether that was on a desktop, in a phone's browser or in the app added to a home screen. That is all it counts. It does not record which matches you look at, what you click or anything you type. We use these records to see how the service is used, to help when you ask us for support, and to check the facts when a refund depends on how much the board was used.
Our hosting provider processes your IP address and request details in the normal course of serving the site and protecting it from attack and abuse. We use these for security and to keep the service standing up, not to build a picture of you.
We do not sell personal data, we do not share it for advertising, and we do not profile you to target you. There is no advertising on Match-Lens at all.
Every cookie we set is needed to run the site or to keep the paid service honest. There are no advertising cookies, no analytics cookies and no third-party trackers on Match-Lens, which is why you are not being asked to agree to a banner full of them. The usage records in section 2 set no cookie of their own: they ride on the sign-in you already have.
| Cookie | What it does | How long |
|---|---|---|
| ml_at | Keeps you signed in for the length of a visit. | One hour, refreshed while you use the site. |
| ml_rt | Renews the sign-in above without asking for your password again. | Up to 30 days, and it ends the moment you sign out. |
| ml_oa | Holds a one-time check while you sign in with Google or Apple, so that only this browser can finish that sign-in. | 10 minutes, and it is removed as soon as the sign-in finishes. |
| ml_dev | Identifies this browser to us. It marks a browser that has taken the free 2-day trial, so the trial is offered once, and it holds this browser's place among the 3 browsers an account may be signed in on at a time. | Up to 400 days. |
| ml_trial_hi | Shows the welcome message once, right after your free trial starts. | 15 minutes, and it is removed as soon as the message shows. |
| ml_ep | Records that this browser has been through the most recent site-wide sign-out, so it happens once and not on every visit. | One year. |
| ml_seen | Remembers that you have opened the board, so the front page stops introducing itself. | One year. |
| ml_here | Remembers that you have just been on the board on your phone, so the front page does not introduce itself again during the same visit. | 30 minutes after you leave the board. |
| ml_app | Remembers that Match-Lens is installed on this phone, so the browser stops offering the install. | 30 days from the app's last opening. |
| ml_unlock | Opens the board immediately after a purchase, while the payment settles. | A few minutes. |
| ml_show | Holds which sample matches a visitor may read in full before subscribing. | One day. |
| ml_pv | Records that the free preview of the live board has been shown to this browser. | Up to 400 days, unless you clear it sooner. |
| ml_wall | A switch we use ourselves to see the site as a customer sees it. It is set only when asked for. | One day. |
| ml_lang | Remembers the language you chose for the site. It is set only when you choose one. | Up to 400 days, unless you clear it sooner. |
Your browser also keeps your board settings in its own local storage so the board can draw itself before your account has answered. That never leaves your device except when it syncs to your account, and clearing your browser data clears it.
Our payment provider sets its own cookies inside the payment form to detect fraud and to remember a saved payment method. Those are theirs, and their notice governs them.
We keep the list short on purpose. The first three act only on our instructions, under a contract, and only for the purpose named. The other two work under their own terms, as their entries say.
Our football data suppliers receive nothing about you. Data flows from them to us, never the other way.
We would also disclose data if the law required it of us, and we would tell you unless we were forbidden to.
Under the GDPR you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing we do on the basis of legitimate interest, and ask for your data in a portable form. Where we rely on consent, you may withdraw it at any time.
Most of it you can do yourself: your name, email, password, time zone and board settings are all editable in your account, and your notes are yours to delete.
For anything else, including deleting the whole account, write to support@match-lens.com. We will answer within one month, and normally within a few days. We do not charge for this.
If you think we have handled your data badly, please tell us first so we can fix it. You also have the right to complain to a data protection authority, normally the one in the country you live in.
The site runs only over encrypted connections. Passwords are stored only as a hash, by our authentication provider, and we never keep them. Full card numbers and security codes never reach our servers. Session cookies are marked so that scripts in the page cannot read them. Access to the production database is limited to the people who run the service, and administrative actions are written to a ledger.
No service can promise perfect security. If a breach ever affected your data, we would tell you and the relevant authority as the law requires, and we would tell you plainly what happened.
Your account data is stored in the European Union. Some of the providers in section 5 operate globally and may process data outside the European Economic Area. Where that happens it is covered by the European Commission's standard contractual clauses or an equivalent safeguard.
Match-Lens is for adults and you must be at least 18 to hold an account. We do not knowingly collect data about children. If you believe a child has created an account, tell us and we will remove it.
When what we do with data changes, this notice changes with it and the date at the top moves. If a change is significant we will tell account holders by email rather than quietly editing the page.
The Terms of Service and the Refunds and Cancellation policy sit alongside this notice.