Privacy policy

The controller of the personal data described here is the operator named on the about page.

Questions, requests and complaints about your data: use the contact form or write to [email protected].

Only if you choose to create an account or sign in (with Google or with an e-mailed link). You are never required to: the site works fully without an account.

• What you give us: your e-mail address, the name you type on the sign-up form (optional), and the choices you make on your account page (what to call you, the clubs, leagues and players you follow, whether you want the newsletter). Why: to let you sign in and to give you the account you asked for. Basis: performing the service you request (GDPR art. 6(1)(b)).
• What Google shares if you sign in with Google: whether it verified your e-mail, your name (full, given and family), your profile picture address, your language and, for a Google Workspace account, your organisation's domain. We ask Google for nothing else (no contacts, calendar, birthday, gender, phone or address). Basis: performing the service you request.
• What your browser tells us when you sign in: its language and time zone, the kind of device, browser and system, the country your hosting provider reports (two letters; we never store your IP address), the page you signed in from and, from that same visit, the website that sent you here and any campaign tags in the link (utm_source and similar). Nothing is stored in your browser beforehand and none of it is read if you do not sign in. Why: to keep the service secure and to know in broad terms which links and countries bring readers. Basis: our legitimate interest in security and in understanding our audience (art. 6(1)(f)); you can object at any time (see your rights below).
• From your e-mail address: its domain and whether it looks personal, an organisation's or an education address, used to refuse throwaway inboxes and to prevent abuse. Basis: legitimate interest in preventing abuse.
• From us: when you first signed in, when you last did, how many times and by which method; the outlets and articles you submit, the result of our checks, and a contributor level worked out from how many of your submissions were accepted (a higher level lets you send more per day). That level is calculated automatically; it has no legal or similarly significant effect on you, and you can ask a person to look at it. Basis: performing the service (tying your submissions to you) and legitimate interest in preventing abuse.
• Rumours you send: the player and clubs you pick, the optional hint and link you add (private: only the editor sees them, we never open or cite the link and nothing you write is published), when you sent it and what became of it. If you choose a public nickname and a rumour you sent is verified and published, the dossier says “Contributed by @nickname”: the nickname is the only thing about you that is ever public, never your name or e-mail, and you can change or remove it at any time (the credit follows). If you tick the box, we e-mail you once about the outcome of each rumour. Repeated rumours we cannot verify pause sending for a week; that is decided by a fixed rule, not by a person. Basis: performing the service, your consent for the nickname and the e-mail, and legitimate interest in preventing abuse.
• The newsletter: only if you tick the box, which is never ticked for you, and only after you click the link in a confirmation e-mail we send you (until then nothing is sent). Basis: your consent (art. 6(1)(a)); withdraw it any time on your account page. We keep when you ticked it.

We do not buy data about you, we do not follow you across other websites, we do not use your data for advertising and we do not sell or share it for advertising. We do not look up your public profiles elsewhere. Reading TransfersLens without an account stores nothing about you.

You are not obliged to give us any of this, but without your e-mail address (or a Google sign-in) we cannot give you an account.

• Session cookie (__Host-tl_session): signed, set only while you are signed in, so the site knows it is you. Strictly necessary.
• Sign-in cookie (__Host-tl_oauth): short-lived, set during the Google sign-in to protect it from forgery. Strictly necessary.
• Theme choice (localStorage): set only when you press the light/dark switch, to remember your choice on this device. Nothing else is kept this way.
• Visit statistics: no cookie and nothing stored on your device; see below.
• Bot check on the submission form: where it is switched on, the form loads Cloudflare Turnstile to tell people from programs; Cloudflare receives your IP address and browser details for that purpose and may set its own cookie. It appears only on the form for suggesting a source, never on pages you read.

No advertising or tracking cookies are used, and the visit statistics need none, so there is no cookie banner to accept. If that ever changes (for example with advertising), you will be asked before anything is set. Fonts are served from this site; photographs of players are stored on our own storage (your browser never loads them from another site). They come from Wikimedia Commons under their authors' free licences and are credited on the photo credits page.

We count how the site is used, to know where readers come from, which pages and sections are read and for how long, and to improve the site. We use Umami, installed on our own server (OVHcloud, London): no one else receives this data. It sets no cookie and stores nothing on your device, and it respects the Do Not Track setting of your browser.

• What is recorded for each page view: the address of the page, the page you came from, your country (worked out from your IP address, which is not stored), browser, operating system, device type, screen size, language, the time, and how long the visit lasted.
• How a visit is recognised: by a code made from your IP address and browser details together with a secret that changes regularly, so it cannot be turned back into your address and cannot follow you across other sites. It is not linked to any account.
• Why and on what basis: our legitimate interest in knowing how the site is used (GDPR art. 6(1)(f)). You can object at any time with the contact form, or by turning on Do Not Track.
• How long: page-view records are deleted after 24 months.

Only the providers that make the service work, each acting on our instructions:

• Google: the sign-in step (its own privacy policy applies to it).
• Supabase: our database provider (servers in London, United Kingdom), where your account data is stored, behind rules that only our servers can read.
• Resend: sends the sign-in links and, if you asked for it, the newsletter.
• Cloudflare: the network and DNS in front of this site (visitors' requests pass through it), the bot check on the submission form (above) and the forwarding of the e-mails sent to our addresses to the editor's inbox.
• OVHcloud: our hosting provider, whose server in London (United Kingdom) serves the pages.

Some of these providers are based in, or process data in, the United States or other countries outside the European Economic Area and the United Kingdom. Where they do, the transfer relies on a safeguard the law accepts, such as the EU–US Data Privacy Framework or the standard contractual clauses. Ask us for details through the contact form. We never give your data to anyone else, except where a court or authority legally requires it.

While your account exists. Sign-in links stop working after 15 minutes. When you delete your account, your profile and your submissions are removed from our live database at once and disappear from our daily backups as these expire, within 14 days; what an outlet or article you sent already added to our archive of published sources is not personal data and stays. Data we must keep because the law requires it is kept only as long as it does.

Whoever and wherever you are, from your account page you can see and download everything we hold about you as a file, correct your name and choices, turn the newsletter off, and delete your profile and submissions in one click.

In the European Economic Area, the United Kingdom and similar laws you also have the right to ask us for access, rectification, erasure, restriction of processing and a portable copy of your data; to object to processing based on our legitimate interest; to withdraw consent at any time without affecting what was done before; and to complain to your data protection authority (in the EU, the one of the country where you live or work, and for the UK the Information Commissioner's Office).

If you live in California or another US state with a privacy law you may ask what personal information we collect and why, ask for a copy, correct it, delete it, and opt out of its sale or sharing. We collect identifiers (e-mail address, name), internet and network details (the page you signed in from, where the visit came from), device details, an approximate location (country), and inferences (the contributor level). We collect it from you, from Google if you use it, and from your browser. We do not sell your personal information, we do not share it for cross-context behavioural advertising, we collect no sensitive personal information as the laws define it, and we will not treat you worse for using these rights. A signal such as Global Privacy Control is honoured by default: there is nothing to opt out of. You can use an authorised agent; we will ask you to confirm it is you.

Use the contact form or write to [email protected] to exercise any of this. We answer within one month.

TransfersLens reports on football transfer rumours, so its pages name players, coaches, agents, club officials and the journalists and outlets that reported the rumours. That information comes from published articles and from public football databases, and we use it to report on and audit those rumours: this is journalism and is based on our legitimate interest and on freedom of expression and information. A photograph of a player comes from Wikimedia Commons under its author's free licence and is credited next to it; the licence covers the author's copyright, not your own rights over your image, so if you do not want your photograph shown, tell us and we will weigh it. If something about you is wrong, out of date or should not be published, tell us through the contact form: we correct mistakes (see the corrections policy) and weigh every request to remove or limit information about a person against the public interest in it. You can object, and complain to your data protection authority.

Accounts are for people aged 16 or older, and by creating one you confirm you are. We do not knowingly collect data from younger children; if you think we have, write to us and we will delete it. Reading the site needs no account.

When this policy changes in a way that matters, we change the date above and, if you have an account, tell you.