Privacy policy

1. Data controller and scope

Ligan is the data controller for the processing of personal data described in this policy. The policy applies when you visit the app, create an account, sign in, use comments and forum features, select favorite teams, use the contact form, or otherwise interact with the service.

If you want to contact us about privacy matters, you can do so via our contact page.

2. What data we process

Depending on how you use Ligan, we may process the following categories of personal data:

• Account data such as email address, password hash, username, profile image, external sign-in provider, provider account ID, and required authentication data to keep account and sign-in linked.
• Profile data and personal choices such as favorite team, email verification status, and whether commenting rights are limited or have active warnings.
• Community data such as comments, votes, comment reports, information you submit in reporting forms, and moderation history required to handle abuse.
• Contact details and message content when you use the contact form, plus technical data such as Turnstile token and IP address used for anti-spam and security checks.
• Technical and usage data such as requested pages, approximate traffic patterns, device and browser information, log data, and security-related signals.
• Local preferences in your browser, such as selected league mode, sidebar state, recent searches, and whether you dismissed the comment-rules information banner.

3. Why we process data and legal basis

We process personal data for the following purposes:

• To create and manage accounts, handle sign-in, verify email addresses, send password resets, and keep you signed in. Legal basis: performance of a contract and legitimate interest.
• To save your settings, such as favorite teams and display name in the community. Legal basis: performance of a contract.
• To provide comments, voting, reporting, and moderation, and to protect the community from abuse. Legal basis: legitimate interest and, when you publish content, performance of a contract.
• To prevent spam, automated attacks, unauthorized access, and other security incidents, including through Turnstile, logging, and moderation controls. Legal basis: legitimate interest and legal obligation where applicable.
• To validate and protect the contact form against spam and automated attacks and, when the contact flow is used for actual case handling, process incoming messages. Legal basis: legitimate interest or steps taken at your request before contact or a relationship is established.
• To understand service usage and improve performance, stability, and product decisions. Legal basis: legitimate interest.

4. Sign-in and community

If you use email/password, we store the information required to create and protect your account. If you use Google or Microsoft sign-in, we process the data required from each provider for authentication and account linking.

Comments and forum posts are linked to your account and may be displayed with your username, profile image (if any), favorite team, and other community context. If you report a comment, we also process the report reason and any free-text input you provide.

5. Cookies, local storage, and analytics

Ligan uses both server-side cookies and browser local storage so the service can function and remember your choices. Examples include authentication cookies, league preferences, sidebar state, recent searches, and whether you have already accepted the comment-rules information banner.

We use Cloudflare Turnstile to protect forms against spam and automated attacks. When you use forms, technical information may be shared with Cloudflare as part of verification.

In the current implementation, contact messages are not stored in the app's user database and are not automatically forwarded through a separate email queue.

Some pages contain partner links to TV4 Play through Adtraction. If you click such a link, Adtraction and TV4 Play may use their own cookies or similar technologies to measure clicks, purchases, or commissions under their own terms and privacy information.

6. Retention

We retain personal data for as long as needed for the purpose it was collected for, or as long as we have a legitimate need or legal obligation to do so. More specifically, this normally means:

• Account data is retained while the account is active and deleted when the account is removed, unless longer retention is required by law.
• Verification and reset tokens are stored for a limited time and expire automatically when used or when they expire.
• Comments, votes, reports, and moderation data are retained as long as needed for community functionality, security, and administration, or until removed according to our processes.
• Active comment warnings have a limited lifetime in the system and are used to handle repeated rule violations.
• Local browser data remains until it expires, is overwritten, or is cleared by you.

7. Recipients and processors

We do not share personal data for sale. However, we use providers that process data on our behalf or as independent controllers for their part of the service, for example for operations, analytics, identity, email delivery, security, and moderation.

• Cloudflare for operations, edge infrastructure, database-adjacent services, and Turnstile protection.
• Google and Microsoft when you choose external sign-in.
• ZeptoMail when verification emails and password reset emails are sent.
• Adtraction and TV4 Play when you click partner links so they can measure clicks, purchases, and any commission.

Some providers may process data outside the EU/EEA. When this happens, we aim to use appropriate safeguards under data protection rules, such as standard contractual clauses when required.

8. Your rights

Under data protection rules, you have the right to request information about what personal data we process about you and, in some cases, to have data corrected, deleted, restricted, or transferred. You may also object to certain processing based on legitimate interest.

You can update certain information yourself through account settings and you can delete your account in the app. When an account is deleted, we remove the account and related comments, votes, reports, warnings, verification tokens, and external sign-in links according to the app's current deletion flow.

If you have objections to our processing, you can contact us via the contact page. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

9. Changes to this policy

We may update this policy when the service changes, when new features or providers are introduced, or when legal requirements change. The latest version is always published here.

Last updated: 2026-04-08