Your data
Privacy Policy
What Full 90 collects, why, and how to get rid of it.
Last updated September 16, 2026
01Who we are
Full 90 is an independent NCAA men's soccer statistics site operated by a private individual in Missouri, United States. For anything on this page, write to contact.full90college@gmail.com.
02What we collect
| Data | When | Why |
|---|---|---|
| Google account: email, name, profile picture, Google account id | Only if you choose to sign in with Google | To identify your account and show who is signed in. We request only the basic profile and email scopes. |
| Your role, and your school or agency if you request coach or agent access | On sign-up, or when you ask for coach or agent access | To decide what you can see and edit. |
| Starred players and teams | When you star something | To keep your watchlist. |
| How many separate days you have visited, and the date of your most recent visit | Only while signed in | To see whether people who make an account come back. We record the day, not what you looked at — no page history, no browsing trail. Signed out, nothing is recorded. |
| Feedback: your message, the page you sent it from, a category, and any contact details you choose to include | Only when you submit the feedback form | To read and act on it. Contact details are optional and are used only to reply. |
| Browser user agent | With a feedback submission | To reproduce display bugs on the device they happened on. |
| IP address | On feedback submissions only | Held briefly in memory to rate-limit spam. Never written to the database. |
| Usage analytics: pages viewed, approximate location by country/region, device and browser type | Every visit, unless you opt out | To see which pages get used. See section 3. |
We do not ask for or store payment details, dates of birth, phone numbers, or precise location. Google handles your password; we never see it.
03Cookies and analytics
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| connect.sid | Full 90 | Keeps you signed in. Strictly necessary — set only after you sign in. HttpOnly, Secure, SameSite=Lax. | 7 days |
| f90-region | Full 90 | Records whether your country requires us to ask before setting analytics cookies, so the consent rules can be applied. Strictly necessary. Holds a two-letter class, never an identifier. | 12 hours |
| _ga, _ga_* | Google Analytics | Distinguishes returning visitors so page counts are not double-counted. Set only with consent — see below. | Up to 2 years |
We use two analytics tools, and they work differently.
Vercel Analytics counts page views without setting any cookie and without storing anything on your device. It records no identifier that would let us recognise you on a later visit or follow you to another site. It runs for every visitor, which is why we can keep the cookie-based tool strictly optional.
Google Analytics 4 adds detail — returning visitors, how people arrive — and it does use cookies. IP addresses are truncated by Google before storage, advertising features and Google Signals are disabled, and we do not build advertising profiles or share anything with advertisers.
Whether we ask you first depends on where you are, because the rules do. If you are in the UK, the EEA or Switzerland, Google Analytics stays switched off until you accept it on the banner — no cookie is set before you answer. Everywhere else, the law asks us to tell you and let you opt out rather than to ask first, so it is on by default and “Cookie settings” in the footer turns it off at any time. Either way the choice is yours, it is remembered, and refusing costs you nothing — the site works identically.
You can also install Google's opt-out browser add-on. We honour the Global Privacy Control signal: if your browser sends it, analytics stays off without your having to touch the banner.
04Who else sees it
We share personal data with no one for their own purposes. We never sell it. Four service providers process it on our behalf:
- Google — sign-in, and analytics.
- Render — hosts the application server and the database.
- Vercel — serves the website, and provides the cookieless analytics described above.
- Google Fonts — serves the site's typefaces, which involves your browser contacting Google.
Beyond those, we disclose data only if legally compelled to. Player photographs and team logos are loaded from institutional athletics servers, so displaying a page tells those servers your browser requested an image — the ordinary consequence of any embedded image on the web.
05How long we keep it
- Account data, including your visit-day count: until you delete your account.
- Session cookies: 7 days, then they expire on their own.
- Feedback: up to 24 months, so a recurring bug report can be traced.
- Google Analytics: 14 months, Google's shortest retention setting.
- Vercel Analytics: aggregate counts only, with no per-visitor record to retain.
06Your rights
Whoever and wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email contact.full90college@gmail.com and we will act within 30 days. We will not charge you, and we will not treat you differently for asking.
If you are in California, Colorado, Connecticut, Virginia, Texas or another US state with a comprehensive privacy law: you have the rights to know, access, correct, delete, and to opt out of the sale or sharing of your personal information and of targeted advertising. We do not sell or share personal information, and we do not conduct targeted advertising or profiling — so there is nothing to opt out of, but the request route above is open regardless. We do not knowingly process sensitive personal information.
If you are in the UK or the European Economic Area: you additionally have the rights to restrict and object to processing, and to data portability. Our lawful bases are your consent (analytics cookies), performance of a contract (running your account), and legitimate interests (keeping the site secure and working). You may withdraw consent at any time without affecting what came before, and you have the right to complain to your national supervisory authority.
07Children
This site is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, email us and we will delete it.
08Security, and the honest caveat
Traffic is encrypted in transit, session cookies are HttpOnly and Secure, and administrative routes require a token. That said, this is a small independent project, not a bank: please do not entrust it with anything you would be harmed by losing. If we ever discover a breach affecting your data, we will tell you.
09Changes
If this policy changes materially we will update the date at the top of the page and, for anything that affects how your data is used, say so on the site.