Privacy Policy

1. Introduction

LiverpoolVerse is committed to protecting your privacy. This Privacy Policy explains how we collect, use and safeguard your information when you use our website.

Please read this Privacy Policy carefully. By using the LiverpoolVerse site, you agree to the collection and use of your information in accordance with this policy.

2. Information We Collect

2.1 Information we collect automatically when you visit our site

We collect the following information from all visitors to our website (even if you do not create an account or sign-in):

• Pages visits. This is a low-granularity measure of engagement with our content as we track the number of distinct visits that there are to our pages and articles- not more detailed tracking like pathways of engagement.
• Device Data. We collect data about the devices that access our site including: device type (ie. desktop or mobile), operating system and browser used. This helps us to improve the user experience for our site (we can test the most common device and browsers more rigorously).
• Performance Data. We collect key performance metrics for visits to pages of our site including: First Contentful Paint(FCP), Largest Contentful Paint(LCP), Interaction to Next Paint(INP), Cumulative Layout Shift(CLS), First Input Delay(FIP) and Time to First Byte(TTFB). These stats are only collected for a small proportion of all pages visits to our site (randomly selected) and help us to monitor how our site is performing.

We associate the country that the request came from with all of the data collected in the list above. We do not record more precise locators like the IP address that a request came from. This allows us to diagnose issues related to geography- for example if a page performs badly in a certain country (ie. slow to load). It is also useful to us to see how the popularity of our articles varies between countries which helps us to improve the quality of the content that we produce.

All of the data collection described in this section (section 2.1) comes from Vercel's Analytics component (view Vercel's Analytics Privacy Policy here) as well as Vercel's Speed Insights component (view Vercel's Speed Insight's Privacy Policy here).

2.2 Information we collect on Sign-up attempt

The sign-up process is heavily reliant on using your web browser's session storage to remember which stage of the sign-up process that you're up to in case you accidentally leave the sign-up page midway through. This information is purged when you close the tab that you used for the sign-up process (or if you close the browser window that contains the tab you used for sign-up or if you shut down your device). The list below walks through the information that is collected at each stage of the sign-up process:

1. reCAPTCHA. This first step of the sign-up process requires that you successfully complete a checkbox reCAPTCHA. This is to prevent bots from signing-up to our site. On successfully passing the reCAPTCHA a token is returned which we then verify with Google before moving you on to the next step (if you successfully pass the reCAPTCHA). No personal information is exchanged here- simply a token that tells us whether you passed the reCAPTCHA or not.
2. Social sign-on. In this step you select an OAuth provider (Facebook or Google) to use that will return your full name, email address and profile picture URL. This information (full name, email and profile picture URL) is then stored in an intermediate table in our database along with a token generated by us that is consumed to score your quiz attempt (to stop users from spamming the quiz scoring endpoint). This information (full name, email and profile picture URL) is used to create your permanent user account in our database if you successfully complete the quiz.
3. Quiz. Upon successfully storing the information from your OAuth provider in our intermediate table you are required to pass a quiz on ex-Liverpool players. Upon completing this quiz your responses will be submitted to our quiz scoring endpoint along with the token given to you after selecting your OAuth provider. If you passed the quiz then your personal information in the intermediate database (full name, email and profile picture URL) will be used to create a user account for you that is stored permanently in our database (unless you delete your account or are banned). Regardless of whether you passed or failed the quiz your information is purged from the intermediate table during quiz scoring. If you leave the page before finishing the quiz or the quiz timer running out then your information will be removed from the intermediate table at some point in the next 24 hours by a cleanup process. We also record your email and the date and time of your quiz attempt in a separate table in our database to enforce a 12 hour cooldown period to stop people from brute-forcing the quiz. This is also stored regardless of whether you passed or failed the quiz as we don't want users who successfully passed the quiz to be able to compile a quiz cheat guide for other users (there are only a finite number of quiz questions and if they were able to easily retake it they would be able to compile a cheat guide). This information (email and date and time of quiz attempt) is stored for at least 12 hours to enforce the cooldown period and will be removed at some point in the 24 hours after the initial 12 hour cooldown period (stored for a maximum of 36 hours in total).
4. Result. The only data-related thing that happens at this step is that if you passed the quiz and your user account was created then you have the option to join our mailing list which will store your email in a separate table in our database to your main user account.

The majority of the information collected to track your sign-up attempt is so short-lived that it only lasts for as long as your sign-up attempt. Even the data that lasts longer than that isn't stored for longer than 36 hours. If you passed the quiz then we store your personal information long term until you delete your account (see next section).

2.3 Information we collect on successful Sign-up

When you successfully create an account (by successfully completing each stage of the sign-up process- see previous section), we collect:

• Account Information. Your email address, full name and the profile picture URL associated with the platform that you used to sign-up (Facebook or Google). Crucially- this information is stored separately from the provider that you used to sign-up with in our own database. This information is held until you delete your account or are banned (see section 6 for details on data retention). See the previous section (section 2.2) for details on how we collect this data.

2.4 Information we collect on Sign-in

Whenever you sign-in to our site we store the following information:

• Session data and cookies. We use session-based authentication which involves storing tokens in our database and as cookies in your browser when you sign-in. By default we store session data in our database for 30 days from when you sign-in which means that if you visit our site within 30 days of last signing-in then you should be remembered and signed-in again automatically (assuming that you're using the same device and browser and didn't explicitly sign-out before you left). If it's been longer than 30 days since you last signed-in or you're using a different device or browser then must sign-in again explicitly via the Sign-in page. By signing-in (automatically or explicitly) you agree to be remembered by LiverpoolVerse for 30 days. If you want to explictly sign-out before then, then you must click the button in the top-right of any page (should be an icon of your profile picture) and then click the sign-out button at the bottom of the menu. This will delete your session from our database and sign you out which will effectively cut the 30 day period that we remember you for short.
• Date and time of sign-in. We record the date and time every time that you sign-in (explicitly or implicitly). This makes it easier for us to identify problematic user accounts- ie. if a user violates our Terms and has a common name.
• Account Information. If you change your name, email address or profile picture on the provider that you used to sign-up with (Facebook or Google) then that should filter through to our database on a subsequent sign-in to our platform. This sign-in may be explicit via our Sign-in page or implicit if you visit our site when you still have an active session in our database (meaning that you were signed-in on that browser and device without explicitly signing-out in the last 30 days).

2.5 Information we collect conditionally

When you use our site, we may collect data related to:

• User-generated content. We collect data for: comments, player ratings, lineup selections, poll responses and any other interactive content you participate in. This is dependent on user engagement.
• Quiz attempts. We require users to pass a quiz to be signed-up and we record quiz attempts in our database to prevent prospective users from brute-forcing the quiz. This information is stored for 36 hours at the most (see section 2.2 for details).
• Mailing list. We store your email addresss separately if you subscribe to our mailing list on the My Account page (this page is only accessible by signed-in users) . This is dependent on user preference (ie. users can choose to subscribe or unsubscribe).
• Banned list. We store email addresses of banned users to prevent them from signing-up to our platform again. This is dependent on user behavior and compliance with our Terms of Service. By using our site you accept that you may be banned for a perceived breach of our Terms of Service and your email address stored in a banned list in our database for up to 5 years.

2.6 Information we collect from Third Parties

We receive information from third-party services:

• Trusted third-party authentication providers. Facebook and/or Google provide us with your email, full name, and profile image URL when you sign-up.
• Google reCAPTCHA. Google provides verification data to us to prevent bots from creating accounts. This occurs in the first step of the sign-up process (see section 2.2 for details).

3. How We Use Your Information

We use the collected information for the following purposes:

• Account management. To create and manage your account, authenticate your identity, and maintain your browser session.
• Service delivery. To provide you with articles and interactive content and to ensure the integrity of interactive content submissions. For example- to stop a user from responding to a poll multiple times to skew it in their favour.
• Communication. To send you updates (if you are subscribed to our mailing list).
• Security. To protect against spamming and fraud (mainly to do with our reCAPTCHA service integration to prevent bots from signing-up and our capabaility of banning users that breach our terms).
• Quiz access. To track quiz attempts and enforce the 12-hour cooldown period to prevent prospective users from brute-forcing the sign-up flow (see section 2.2 for details). This is really a proactive security measure.
• Analytics. To understand how our service is used and improve user experience (see section 2.1 for details).
• Compliance. To comply with our legal obligations and enforce our Terms of Service.
• Moderation. To review and moderate user-generated content in accordance with our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We only share your information in the circumstances described below.

4.1 Public Information

Comments that you post on LiverpoolVerse are publicly visible to other users (whether they have an account or not). We display your name and profile picture along with your comments. We try to only display your first name along with your comments but because of how authentication providers return your name to us when you sign-up (as a single string containing your full name) we do not guarantee that your last name will not be shown alongside your comments instead of or as well as your first name.

See section 5.2 of our Terms of Service for details of our rights to display and moderate the comments that you post.

Other interactive content that you participate in will be indirectly visible to other users through the displaying of aggregated data (ie. other users will not be able to see what another individual user has contributed but they will be able to see an overview of all user contributions). This indirect visibility includes pre-match lineup selections, post-match player ratings and opinion polls. By participating in sed interactive content, you agree to this indirect aggregated visibility of your submissions by other users (whether those users are signed-in or not).

4.2 Third-party Service Providers

We share information with trusted third-party service providers:

• Web hosting. We use Vercel to host our website (view Vercel's Privacy Policy here). We also use Vercel's CDN caches for caching content (ie. articles) and Vercel's data caches for caching data from our database (ie. poll responses). These caches may contain your personal information (full name, email address and profile picture URL). Vercel's data cache frequently contains your personal information but this is much harder for malicous actors to access than the CDN cache. The CDN cache caches what's rendered in our articles- the only sensitive information here is in the comments sections which may contain your full name and profile picture. Whilst the data cache generally stores data in Europe and North America we do not guarantee that this will always be the case (see section 11 for the International Data Transfers disclaimer). The CDN cache is highly distributed in terms of the countries that it is held in (the point of a CDN is to distribute content globally) but the data it contains is less sensitive than the data cache (just what is rendered in an article page).
• Database Hosting. We use Prisma Postgres to host our database (view Prisma Postgres' Privacy Policy here). This database stores all permanent data for our site including your personal information. This database operates in Europe and is not replicated or distributed outside of Europe. The data it contains is often cached (see previous point about data cache) but this is also generally stored in Europe or North America (see section 11 for international data transfers disclaimer).
• Caching. We use Upstash Redis (view Upstash's Privacy Policy here) as an additional caching solution alongside using Vercel's CDN and data caches. This is used to cache your interactive content submissions short-term before they show up in Vercel's data cache. Vercel's data cache is not appropriate for short-term/transient caching which is why we use Upstash separately. The only personal data that Upstash store is the internal id that we use to identify you as a user on our site. They are not aware of any of your core personal information that we store in our Prisma Postgres database (your full name, email and profile picture URL). The nature of this cache is distributed meaning that it is replicated across many different locations and therefore considered global. However, it doesn't store any of your personal information directly (just an internal user identifier which is only useful to us- LiverpoolVerse).
• OAuth Authentication Providers. The platforms that we use for OAuth authentication are Facebook (view Facebook's Privacy Policy here) and Google (view Google's Privacy Policy here). We use these providers to authenticate your identity so that we can control the integrity of interactive data submissions on our site and for moderation purposes (so that we can tell who has submitted what). These platforms provide us with your personal information when you attempt to sign-up to the platform, however we only store that information long-term if you successfully complete the sign-up process (see section 2.2 for details).
• Security. We use Google reCAPCTHA to prevent bots from signing-up to our platform (view Google's Privacy Policy here). This does not involve any transfer of your personal data (full name, email and profile picture URL) but simply the transfer of bot filtering verification data (ie. does Google reCAPTCHA think you're a bot or not).

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation.

4.4 Business Transfers

If LiverpoolVerse is involved in a merger, acquisition, or sale of assets then your information may be transferred to the new owner. You will be notified by email if this is going to happen- a minimum of 30 full days before the transfer of data is due to occur. Provided that you delete your account prior to this deadline (via the My Account page) your personal information will be deleted from the platform and won't be transferred to the new owner.