Skip to main content
Voragoal
Log inSign up

Privacy Policy

Last updated: 13 June 2026

Voragoal ("we", "us") is an independent analytics platform for the 2026 FIFA World Cup, operated by FirstData Consulting LLC. We are not affiliated with, endorsed by, or sponsored by FIFA. This policy explains what data we collect, how we use it, and the choices you have.

1. Information we collect

  • Account information. When you sign up, we store your email address, display name, and a hashed password (we never see your raw password). If you sign in with Google, we receive your email, name, and profile picture URL from Google.
  • Tournament Pass. If you purchase the Tournament Pass, we store the Stripe Checkout session ID, payment status, and the timestamp of your purchase. We never receive or store your card number, CVC, or full billing address — those go directly to Stripe.
  • Your activity. Teams and players you favourite, matches you save, and your profile preferences.
  • Standard server logs. Vercel (our host) automatically records request metadata (IP, user agent, path, status code) for security and operational reasons. We do not use this data for advertising.

2. Cookies and similar technologies

Voragoal uses two categories of cookies:

Essential cookies

Required for the site to function:

  • A session cookie that keeps you signed in.
  • A CSRF token cookie that protects sign-in and account actions.

Marketing and measurement cookies

Set by third parties when their scripts load on our pages. We use them to see whether our ad campaigns are bringing visitors to the site and producing Tournament Pass purchases:

  • TikTok Pixel — sets cookies on TikTok-owned domains to attribute purchases to TikTok ad campaigns.
  • Google Ads tag (gtag.js) — sets cookies on Google-owned domains to attribute purchases to Google Ads campaigns.

When you first visit Voragoal, a consent banner asks whether you accept the marketing cookies above. You can accept or reject each category independently, and change your mind anytime via the Cookie Settings link in the footer. We honor Global Privacy Control (GPC) signals — if your browser sends one, we treat it as a Do-Not-Sell-or-Share opt-out for US state privacy laws. You can also block marketing cookies at the browser level, or via Google Ad Settings (adssettings.google.com) and the ad personalisation controls inside the TikTok app. For the complete machine-readable inventory of every cookie set on this site, see our Cookie Policy.

3. How we use your data

  • To create and maintain your account and authenticate you.
  • To process your Tournament Pass purchase and grant access.
  • To personalise your dashboard, favourites, and saved matches.
  • To send transactional emails (e.g. password reset, purchase receipt).
  • To protect Voragoal and our users from fraud and abuse.

We do not sell your personal data. We share limited measurement events with TikTok and Google Ads — specifically, that a purchase happened and the Stripe session ID (used as an opaque deduplication key). We never share your email, name, password, or account contents with advertisers.

4. Third parties we use

  • Stripe— payment processing. Subject to Stripe's privacy policy.
  • Google— used in two ways. (1) Optional sign-in (Google Sign-In) — we request only your email, name, and profile picture. (2) Google Ads conversion measurement (gtag.js) — sets cookies on Google-owned domains and receives anonymous purchase events (the fact of a purchase plus the Stripe session ID for deduplication) to attribute Tournament Pass sales to Google Ads campaigns. Subject to Google's privacy policy.
  • TikTok— TikTok Pixel for ad measurement. Sets cookies on TikTok-owned domains and receives anonymous purchase events (the fact of a purchase plus the Stripe session ID for deduplication) to attribute Tournament Pass sales to TikTok ad campaigns. Subject to TikTok's privacy policy.
  • Perplexity — generates AI match, team, and player summaries via the Perplexity Sonar API. We send only public tournament facts (scores, lineups, events) — never your email, name, or any personal information.
  • Vercel — hosting and serverless infrastructure.
  • Supabase — managed PostgreSQL database where your account data lives.
  • Zoho Mail — outbound email (e.g. password reset, receipts).
  • Iubenda— Consent Management Platform. Stores the consent records (which cookie categories you accepted, when, and from what IP) that GDPR requires us to retain for audit. Subject to Iubenda's privacy policy.

5. Data retention

We keep your account data for as long as your account exists. If you delete your account, we remove your personal data within 30 days, except where we are required to keep records (e.g. tax records for purchases, typically 7 years). Anonymised purchase records may be retained for accounting purposes.

6. Your rights

Depending on where you live (EU/UK GDPR, California CCPA, and others), you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Export your data in a portable format.
  • Withdraw consent and object to processing.

To exercise any of these rights, email support@voragoal.com. We respond within 30 days.

7. Children

Voragoal is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.

8. International transfers

Our hosting and database providers may process data in the United States and other countries. Where required, we rely on standard contractual clauses or equivalent safeguards.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will change. Material changes will be communicated by email or in-app notice before they take effect.

10. Contact

Questions or concerns? Email support@voragoal.com.