Privacy Policy

The Gaffer is an online football manager game at thegafferfm.com. It is currently operated privately from Norway. It is not operated by a registered company, and there is no organisation number to list here.

The operator of The Gaffer is the data controller for personal data processed through the service. Privacy questions and data-protection requests can be sent to support@thegafferfm.com.

If The Gaffer later becomes operated through a registered Norwegian business, this section will be updated with that legal identity.

This policy explains what personal data The Gaffer processes, why, the legal bases we rely on, who else may receive information, how long data is kept, and the rights you have under the GDPR as incorporated into Norwegian law (including the Norwegian Personal Data Act).

It covers the website, accounts, the game world, The Gaffer's Hall, in-game messages, feedback, and related support. Generated footballers, stadiums, and similar in-game objects are game content. They are treated as personal data only where they can reasonably be linked to an identifiable manager.

We process the categories below. We do not collect date of birth, payment card details, or a separate billing address.

We use this information to:

Where GDPR applies, we process personal data on these bases:

You can register with email and password or, when enabled, sign in with Google or Facebook. At signup you confirm that you are at least 13 years old. We do not collect date of birth. Passwords are stored as one-way hashes. Email verification and password-reset links use short-lived tokens.

Signed-in access uses a session cookie. Sessions expire after about 30 minutes of inactivity. If you choose “Remember me” at login, the outer session lifetime can last up to 30 days, still subject to that idle timeout. Signing out, changing your password, or deleting your account invalidates the session.

Playing The Gaffer creates club and competition records: lineups, results, transfers, finances, and similar history. That information is needed for a shared league world. Virtual players, staff, and clubs are game entities. They become personal data when they identify your manager account — for example because you named the club, uploaded a crest, or are shown as the manager.

The Gaffer is a multiplayer world. Some information you submit, or that the game generates about your club, is meant to be visible to other managers. Confirmed examples include:

Hall posts and manager messages are content you choose to submit. Other signed-in managers can read Hall discussions. Do not post information you would not want other players to see. We may remove content that breaks the Terms of Service.

Your email address is not used as a public Hall display name. If a manager name is missing, other players see a generic label such as “Manager”, not your email.

We process session tokens, idle-activity timestamps, login timestamps, and similar security data to keep accounts signed in safely and to log people out when a session is abandoned.

Some authentication endpoints use the requesting IP address as a short-lived in-memory rate-limit key. That is not stored on your user record. Hosting infrastructure may also produce ordinary access logs for security and reliability; those are operational logs, not a player profile.

The Gaffer currently uses cookies and local browser storage that are needed to run the service or remember a setting you chose. We have not found optional advertising, marketing, or third-party analytics cookies in the application.

Because the technologies in use today are strictly necessary or are local preferences you control, we do not show a cookie consent banner. If we later add optional analytics or advertising, we will update this policy and add a consent mechanism before those technologies run.

We do not sell personal data. We use other organisations only to operate the service. They act as processors or authentication providers as described below. We do not list internal hostnames, connection details, or credentials.

The Gaffer is operated from Norway. Some providers above are based outside Norway and the EEA, including in the United States (in particular Google, Facebook/Meta, and Resend when those services are used).

If you use Google or Facebook sign-in, or if we send you service email, relevant account identifiers or your email address may be processed in those countries. We use those services only to provide sign-in and essential email. We do not transfer personal data for advertising.

Account, profile, and club-ownership data are kept while your account is active.

Short-lived authentication tokens expire and are then unusable. Idle sessions are cleared. In-memory rate-limit data is temporary and is lost when the application process restarts.

After you delete your account, personal login data is removed as described below. Club and competition records that other managers rely on are kept as part of the shared world. Hall posts are kept as discussion history but are detached from your account. Operational backups, if any exist at infrastructure level, are overwritten as those backups rotate; we do not claim instant erasure from every backup copy.

Logged-in managers can delete their account from Settings. You can also write to support. Deletion is permanent and requires confirmation (and your password if the account has one).

What is removed: the user account, email address, password hash, sessions, Google/Facebook login links, verification tokens, manager portrait and bio, career tenures stored against the account, achievements stored against the account, friend connections, feedback you submitted, and personal inbox messages to or from your account.

What remains so the world stays consistent: your club stays in its league with the same identity, squad, finances, fixtures, results, and table position. Ownership is detached and the club becomes bot-managed immediately. Another manager may later take over a vacant club. Match, transfer, ranking, and similar club history is not reset.

Hall topics and replies you wrote stay in the discussion so other managers’ replies are not wiped. The author is shown as a former manager instead of your name. In-game news or match coverage published while you played may still contain the public manager or club name that was shown at the time.

A short internal audit record is written that a self-service deletion happened and, if you had a club, that the club was converted to bot control. That record does not keep your email address.

Under GDPR you may request access, correction, deletion, restriction, or objection, and data portability where it applies. You can also withdraw consent where processing is based on consent.

Use Settings to delete your account yourself, or email support@thegafferfm.com from the address on the account when you can. We may need to confirm it is you before fulfilling a request. There is no self-service data-download button today; access and portability requests are handled through support.

Some records cannot be fully erased if they are still needed for the shared game world, security, or the law. Where that happens we detach or anonymise what we can, as described under account deletion.

We use HTTPS, hashed passwords, access controls, and httpOnly session cookies. No online service is perfectly secure. Use a unique password and tell us at support@thegafferfm.com if you think your account has been compromised.

Matches, league tables, transfers, bot managers, and similar features are simulated by game systems. After you delete your account, a bot manager runs the remaining club. These systems exist to operate the football world. They are not used to profile you for advertising or to make legal or similarly significant decisions about you outside the game.

The Gaffer is intended for users aged 13 or older. By creating an account you confirm that you are at least 13. We do not collect date of birth and we do not operate a parental-consent process.

If you believe someone under 13 has created an account, contact support@thegafferfm.com. We may close that account.

We may update this page when the game or the law changes. The “Last updated” date at the top will change. If a change is material, we may also mention it in-game or by email where that is practical. Please read the current version when you use the service.

Please contact support@thegafferfm.com first so we can try to resolve the issue.

You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet), which is the supervisory authority for this service: Datatilsynet, https://www.datatilsynet.no.

If you live in another EEA country, you may instead complain to your local data protection authority.

Privacy questions, access requests, and deletion requests: support@thegafferfm.com.