Privacy policy
Back to Soccer · effective 5 November 2026
The short version.
- The game, in your browser at play.b2.soccer and in the app, is played signed in to an account. Once signed in, the app goes on playing with no network.
- An account needs a name, an email we prove with a code, and your month and year of birth. You must be 13 or older.
- No ads, no advertising or tracking companies, no cookies, and we never sell your data.
- Play analytics (what you play, for how long, on what, and errors) are optional. In the EU, EEA, Switzerland and the UK nothing is sent until you say yes; elsewhere you can turn them off in Settings → Privacy.
- Match recordings (the buttons pressed in a match, never video or voice) teach the game's computer players. You can turn them off in Settings → Privacy, and they are always off for players under 18.
- You can delete your account, and what is kept with it, in the game or at /delete-account.
1. Who we are
Back to Soccer (the game, the website at b2.soccer and its online server) is run by ServXcel LLC, 38211 Piggott Bottom Rd, Purcellville, VA 20132, USA ("we", "us"). We decide what is collected and why: under the GDPR and UK GDPR we are the controller. Write to us at support@b2.soccer about anything on this page.
2. What is kept on your own device
The game keeps your settings, heroes, tactics, club data, kits, a copy of your saved seasons, and your sign-in (a name and a sign-in token, never your password) in your browser's or the app's own storage. It stays on your device until you clear it, and none of it is sent anywhere unless described below. The game sets no cookies.
3. Play analytics (optional)
If you allow it, the game sends to our server, about once a minute:
- a random install id made up on your device (it says nothing about you or the device);
- that the game was opened, with the screen size, whether it is a touchscreen, whether it was opened from the home screen, and the language setting;
- the time the game was in front of you, and whether you used keys, a controller or touch;
- each match played: its kind, the two clubs, its length, the score and how it ended;
- errors in the game: the message and where in the code it happened;
- the game's version, and if you are signed in, which account it is.
The server adds the name of your browser and system as one word each (for example "Chrome", "Android"), read from what your browser says about itself. It uses your IP address only to limit how much one address can send, in memory, and does not store it with the analytics. We use them to see how the game is played and to fix what goes wrong. In the EU, the EEA, Switzerland and the UK the game asks first, and makes no install id and sends nothing until you choose Allow; elsewhere they are on until you turn them off. Either way, Share play analytics in Settings → Privacy changes your choice at any time, and turning it off deletes the install id and anything waiting on your device. Kept for 400 days.
4. Your account
To play a Season or online you make an account. We keep:
- your name (what you sign in with) and, if you choose one, a nickname, which is then the only name other players see;
- your email, proved with a six-digit code before the account is made, and used only to send you codes (to finish making the account, reset a password, change your email or delete the account). We send no newsletters or marketing;
- your password, only as a one-way scrypt hash: nobody can read it back, us included;
- your month and year of birth, to keep the game's accounts and online play to people 13 and over;
- if you sign in with Google: Google's id for your account, your email if Google says it is verified, and the name Google gives, from which your account's name is made (you can set a nickname, which others then see instead). Google's sign-in button is loaded from Google only on the sign-in pages, and Google's own privacy policy covers what it does;
- if you sign in with Steam (the game on Steam): your Steam ID, and the Steam name your account's name is made from;
- if you choose them, your country and favourite club;
- your friends, friend requests and the players you blocked;
- your invite code, which account invited you if you gave its code, and when you had played the Online Season matches that pay it;
- when the account was made and last used, your sign-in sessions (as hashes of their tokens), the bot level you play at, and when you last changed your name;
- a count of online matches you left early or that broke off on your side, and of matches where your machine and the other player's did not agree what was pressed (with which account it was against), kept 30 days, which can keep you out of matchmaking for a while;
- what you bought in the game: each product, when, from which store (Google Play, Steam, or Paddle on the web) and the store's own reference for the purchase — never your card or payment details, which only the store sees.
An account whose email is never proved is deleted after 7 days. A sign-in left unused for 180 days stops working.
5. What you save and play online
- Saves. Your seasons, heroes, tactics, club data and Online Season teams are kept with your account so you can play them on any device, until you delete them or the account.
- Online matches. For each online match we keep a record: the two players' shown names and account ids, the clubs, the score, how it ended, and how fast and by which route the two connections were. To check that nobody cheated, the server keeps a log of the buttons pressed and the team sheets, without names; those logs are kept 180 days. The match records themselves are kept for as long as the server's history is kept, and lose your name and id when your account is deleted.
- Fair play. After every online match the server plays it again and reads the buttons each player pressed for play no person makes — a program playing for somebody. Of that it keeps a few numbers for each player and match (how often the buttons were what the game's own computer player would have pressed, and how quickly the game was answered), with the player's account id and shown name, never the buttons themselves, for 180 days, for the operator to look at. Nothing is done to an account by them alone. Deleting your account deletes them.
- Other players see your shown name (nickname, or name), your clubs and Online Season team when you play them, your country and favourite club when they add you as a friend, whether you are online only if you are friends both ways, and your Online Season team and the players you list for sale on the transfer market. A player who invited you sees your shown name and how many Online Season matches you have played, up to the number that pays him. A player you blocked cannot find you.
6. Match recordings
When you are signed in, the club and online matches you play are recorded: the buttons and stick each player pressed, a tick at a time, the team sheets, and the shown names of the players. Never video, sound or anything outside the match. We play them back to learn how people play, so the game's computer players can be made better, and work out from them summaries of the moves (for example where goals came from), kept 730 days. Recordings themselves are kept 90 days. Keep match recordings in Settings → Privacy turns this off: nothing more is sent from your device and anything waiting is deleted, and an online match is recorded only if both players allow it. Players under 18 are never recorded: going by the month and year of birth given to the game and with the account, nothing of their matches is kept to learn from, whatever the switch says, until the month they turn 18. You can also coach your own team off your recordings: the coaching board in the game lists the matches of yours we keep and their moments, and sends one back to your device to be played again there. Only yours: an online match is shown to the two who played it and nobody else, and nothing is sent while Keep match recordings is off.
7. Reports
If you report a player we keep who reported whom, the reason, where it happened and your note, and the operator reads them to deal with them. There is no chat in the game.
8. IP addresses and the server's logs
Every device that connects to the server has an IP address, which the server sees. It uses it to limit how many connections, sign-in attempts and accounts come from one address, in memory only. The server's operating log records connections and sign-ins with the name and the IP address, and the emails codes are sent to, so we can keep the service running and safe; it is deleted after 30 days.
Online play between two devices. Two players who are friends both ways may be connected directly, and then each device learns the other's IP address. Everybody else plays through our relay, so neither learns the other's address; the relay notes the account and address it served while the match is on. The relay you are given is the one nearest the two of you: ours in the United States, or our relay in Europe. To find the nearest, the game times a request to each when you go online.
9. Who else handles your data
- Our server, which we run ourselves, in the United States.
- Oracle Cloud, in Frankfurt, Germany, where we run our European relay and a machine that plays matches again to check them: the keys of a match pass through it, and nothing is kept there.
- Cloudflare, which sends our code emails from support@b2.soccer (your email address and the email's text), and which receives mail sent to support@b2.soccer and passes it on to our Gmail inbox, under Cloudflare's privacy policy.
- Google (Gmail), where mail you write to us is read, under Google's privacy policy.
- Google, only if you choose to sign in with Google (on the web Google's button, in the Android app your phone's own Google account picker).
- Valve (Steam), if you play the game on Steam and sign in with it: our server asks Steam to confirm who you are and whether your Steam account owns the game's paid content, under Valve's privacy policy.
- Google Play, if you install the Android app, under Google's own terms. The app downloads new versions of the game only from our own server; nothing is sent to the maker of the updater it uses.
- RevenueCat, if you buy something in the Android app: it checks the purchase with Google Play for us and tells our server, knowing you only by your account's id (never your name or email), under its privacy policy. Deleting your account deletes what RevenueCat keeps of you too.
- Paddle, if you buy something in the browser game: Paddle (Paddle.com Market Ltd) sells it to you for us as the merchant of record, so it takes your payment and your email and address for the receipt and tax, under its privacy policy. We are told your account's id, what you bought and the transaction's reference — never your card. Paddle's checkout script is loaded from Paddle only when you press Buy or open the Store with the web shop on.
We do not sell or rent personal data, share it for advertising, or use advertising or analytics companies. We would disclose it only if the law requires us to.
10. Why we may use it (EU, EEA, Switzerland and UK)
- To give you the game you asked for (your account, saves, online play, code emails): performance of a contract.
- Play analytics in those countries: your consent, which you can take back at any time in Settings → Privacy.
- Match recordings, anti-cheat logs, the server's logs, reports and blocking: our legitimate interests in making the game better, fair and safe, which you can object to (for recordings, by the switch).
- Keeping to the law: legal obligation.
Our server is in the United States, so your data is handled there; a match may also pass through our relay in Europe.
11. How long we keep it
| What | How long |
|---|---|
| Your account, its friends and blocks, and your saves | Until you delete them or the account |
| An account whose email is never proved | 7 days |
| Codes sent by email | 30 minutes |
| Play analytics | 400 days |
| Match recordings | 90 days |
| Summaries worked out of recordings | 730 days |
| Anti-cheat logs of online matches (no names) | 180 days |
| Fair-play numbers of each player's online matches | 180 days |
| Online match records | As long as the server's history; your name and id removed when the account is deleted |
| The server's operating log | 30 days |
| What you bought, and the record of each purchase and refund | As long as the account; the record kept for our accounts, your account's id removed from it when the account is deleted |
| Reports | As long as needed to deal with them and keep players safe |
12. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to have it in a form you can take elsewhere. Write to support@b2.soccer from your account's email. You can change your nickname, email and password and delete your account yourself, in the game on My Account, or without the game at /delete-account. Deleting an account deletes it, your saves, your Online Season teams, the reports you made, the fair-play numbers of your matches and every recording you are in, takes your name and id off online match records, and leaves play analytics only as an unnamed device's. If you are in the EU, EEA or UK you may also complain to your data protection authority. If you live in a US state with its own privacy law, you have these rights too; we do not sell or share personal data for targeted advertising.
13. Children
Accounts, and so the game, are for people 13 and over: the game asks for a month and year of birth first and makes no account for anybody younger. Players aged 13 to 17 can have an account and play online, but their matches are never recorded to learn from (section 6). If you believe a child under 13 has made an account, write to us and we will delete it.
14. Security
Connections to the server are encrypted (HTTPS and secure WebSockets). Passwords are stored only as scrypt hashes, sign-in tokens and codes only as hashes. No system is perfectly secure, but we work to keep yours safe.
15. Changes
If we change this policy we will update the date at the top, and tell you in the game if the change is significant.