Legal

Privacy policy

What Stato collects, why, who can see it, and the choices you have.

Last updated 11 October 2026·JL Pro Ltd
At a glance
  • Your name, Player ID, stats and published match video, with sound, are public.
  • Your email address, password and security data are never public.
  • We don't sell your data, and we use no advertising, analytics or tracking tools.
  • Stato is for people aged 18 and over.
  • Questions, or want to use your rights? Email privacy@stato.pro.

Who we are and how to contact us

Stato (stato.pro) is run by JL Pro Ltd, a company registered in England and Wales (company number 08567331), registered office 341 Rayners Lane, Pinner, HA5 5EN. JL Pro Ltd is the controller of the personal data described in this policy.

For anything about your data, including using the rights below, email privacy@stato.pro. We aim to reply within one month.

Stato records grassroots football games: hosts create leagues and games, players join them, an analyst tags each game from its video, and every player gets stats, awards and rankings.

What we collect

We collect the data below. We don't take card payments yet, and we don't use analytics, advertising or tracking tools.

Account details
Examples
First and last name, display name, Player ID, email address, an encrypted (hashed) password
Where it comes from
You, when you sign up
Google sign-in
Examples
Your Google account ID, email address and name. We don't keep your Google photo or any Google access tokens
Where it comes from
Google, when you choose Continue with Google
Games and leagues
Examples
Leagues you host or belong to, games you join or leave, your team, bib number and roster position
Where it comes from
You, and the hosts who run your games
Match data
Examples
Events you're involved in (goals, assists, tackles and so on), time played, stats, awards and rankings
Where it comes from
Our analysts, who tag them from the game's video
Match video
Examples
Full video of each game, with sound. It shows the players on the pitch and can pick up what they say
Where it comes from
The game's host, who uploads it
Corrections
Examples
Changes you ask us to make to your stats, any comment you add, and our reply
Where it comes from
You, and our analysts
Game fee records
Examples
Whether you've joined a paid game and its fee (no card details)
Where it comes from
You, when you join a game
In-app notices
Examples
Messages about your games and leagues, such as a game being cancelled
Where it comes from
Created by Stato
Security data
Examples
Your IP address and email address when you request a sign-up code or password reset, and standard request logs
Where it comes from
Your device, when you use Stato

Why we use it, and our lawful basis

UK data protection law requires a lawful basis for each use. We rely on these:

Creating and running your account, and signing you in
Lawful basis
Contract: we need it to provide Stato to you
Running leagues and games, and letting you join and leave them
Lawful basis
Contract
Tagging match video and producing stats, awards and rankings
Lawful basis
Contract, for your own stats; legitimate interests, for including you in league tables, leaderboards and other players' games
Showing your name, stats, rankings and published match video publicly
Lawful basis
Legitimate interests: public records of games are the core of Stato, and the players in them expect it
Recording people who play without an account (see below)
Lawful basis
Legitimate interests: a complete and accurate record of each game
Sending sign-up codes, password resets and security alerts
Lawful basis
Contract
Limiting repeated requests and keeping Stato secure
Lawful basis
Legitimate interests: preventing abuse and protecting accounts
Handling your requests and complaints
Lawful basis
Legal obligation, where the law requires us to respond; legitimate interests, for support questions and stat corrections

Where we rely on legitimate interests, we've weighed them against your rights, and you can object at any time (see Your rights).

We also build a play style profile from your stats, comparing you with other players in your league, and rank players globally. This is automated but has no legal or similarly significant effect on you.

What's public on Stato

Much of Stato can be seen by anyone, including people who aren't signed in. That is how Stato works: it publishes a record of every analysed game.

Public: your name as shown on Stato (normally your first and last name) and your Player ID; the leagues you host and the leagues you belong to; the month you joined Stato; game rosters and teams; match events, stats, awards, play style and rankings from published games; highlight clips; and the full match video, with sound, of every published game.

Never public: your email address, your password, and your security data.

Every game on Stato is filmed and analysed: that's what joining one means, and the Join Game screen says so. If you don't want to be filmed, don't join that game. After a game, you can still ask us to remove your name or anonymise you in its stats (see Your rights). The video itself usually stays, because it's the record other players' stats rely on.

People without an account

You can appear on Stato without signing up, in two ways:

  • As an unclaimed player. A host or our staff can add a player to a game by name, so their stats are recorded. That name and those stats are public like any other player's. If it's you, email privacy@stato.pro and we'll remove your name. You'll also be able to claim the profile once your own account exists; we're building that.
  • In match video. A game's video, with its sound, records everyone on the pitch, and sometimes people nearby.

If either applies to you, email privacy@stato.pro. We'll review your request and, where appropriate, remove or anonymise your name. We can't always remove you from a video, because it is the record other players' stats rely on, but we'll tell you what we can do and why.

Past games. While Stato launches, our own team is publishing past games we have analysed. These games were filmed openly and their videos were already published, with the players told at the time. Stato adds names, stats and rankings to them, so we let the players know through the same groups before a game appears on Stato, and anyone can ask us to remove or anonymise their name.

Who we share it with

We don't sell your data or share it for advertising. We use these service providers, who process it on our instructions:

Vercel
What they do for us
Hosts the website and runs our servers
Where
United States
Railway
What they do for us
Hosts our database
Where
United States (Virginia)
Cloudflare
What they do for us
Stores and streams match video
Where
Western Europe (storage); streamed through Cloudflare's global network
Resend
What they do for us
Sends our emails
Where
Ireland (EU)
Google
What they do for us
Provides Continue with Google sign-in
Where
United States (Google LLC)
ImprovMX
What they do for us
Forwards emails sent to privacy@stato.pro and support@stato.pro to our inbox
Where
France and the United States
Google Workspace
What they do for us
Hosts our email inbox, where emails to privacy@stato.pro and support@stato.pro arrive
Where
Any country where Google has data centres, including the United States

We may also share data if the law requires it, or with a buyer if Stato's business is sold, who would be bound by this policy.

International transfers. Some providers process data outside the UK, including in the United States. Where they do, we rely on the UK's approved contract terms (the UK Addendum to the EU Standard Contractual Clauses), which Vercel, Railway, Cloudflare and Resend include in their data processing terms; Railway and Cloudflare may also rely on the UK–US data bridge. Google is certified under the EU–US Data Privacy Framework and its UK Extension. Google Workspace, which hosts our inbox, includes the Standard Contractual Clauses in its data processing terms. Data held in Ireland and Western Europe is covered by the UK's adequacy regulations for the EEA. ImprovMX, a US company, receives forwarded email in France and delivers it through France and the United States; its data processing agreement includes the Standard Contractual Clauses with the UK Addendum.

How long we keep it

Your account
How long
Until you delete it. When you do, we anonymise it within 30 days (see Your rights)
A sign-up that was never verified
How long
30 days, then deleted
Sign-up codes and password reset links
How long
10 and 30 minutes, then they stop working; deleted within 7 days
Security data (IP and email records for repeated requests)
How long
30 days
Match data, stats, awards and match video
How long
For as long as the game's league exists on Stato, because they are the shared record of that game
In-app notices
How long
12 months
Request logs held by our hosting provider
How long
Per the provider's retention, typically up to 30 days
Your emails to us and correction requests
How long
As long as needed to resolve the matter and show how it was resolved

Cookies

Stato uses only the cookies it needs to sign you in, so we don't ask for cookie consent. We use no analytics or advertising cookies.

authjs.session-token
What it does
Keeps you signed in
How long
30 days, renewed as you use Stato
authjs.csrf-token
What it does
Protects sign-in and sign-out from forged requests
How long
Until you close your browser
authjs.callback-url
What it does
Returns you to the right page after signing in
How long
Until you close your browser
authjs.pkce.code_verifier
What it does
Secures Continue with Google
How long
15 minutes

In production these names carry a __Secure- or __Host- prefix. Staff who tag games also store their place in the video in their browser, so a reload resumes where they left off.

Your rights

You have the right to:

  • access the personal data we hold about you;
  • correct it if it's wrong;
  • delete your account;
  • object to uses based on legitimate interests, including public display;
  • restrict how we use it while a complaint is resolved;
  • receive a copy of the data you gave us, in a common format.

To use any of them, email privacy@stato.pro from the address on your account. We may ask you to confirm your identity, and we'll reply within one month. Some rights depend on the lawful basis we rely on (for example, you can't object to what we need to do to provide the service under contract), and legal exemptions can apply.

What deleting your account does. We remove your name, email, password, Player ID and sign-in links. Your past match stats stay in the games and league tables they belong to, shown as “Deleted player”, because other players' records depend on them. They can no longer be linked to you.

Complaints. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. You can also complain to us directly by emailing privacy@stato.pro, and we'd appreciate the chance to put things right. The ICO's postal address is ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL.

Age

Stato is for people aged 18 and over. You confirm you're 18 or over when you sign up, and we don't knowingly create accounts for anyone younger. If we learn an account belongs to someone under 18, we'll close it and delete its data.

If you're a parent or guardian and a child appears on Stato, as an unclaimed player or in match video, email privacy@stato.pro and we'll remove or anonymise their name.

Changes to this policy

We'll update this page when we change how we use data, and change the date at the top. If a change affects you significantly, we'll tell you by email or in the app before it takes effect.