Privacy policy

1. Who we are

Tekkers & Tactics, at tekkersandtactics.com, is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy “we”, “us” and “our” mean that company. We decide why and how the personal data described here is used, which makes us its “controller” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company	FALLINGHIPPO LIMITED
Company number	17415391, registered in England and Wales
Registered office	71-75 Shelton Street, London, England, WC2H 9JQ
Privacy contact	[email protected]
General contact	[email protected]
Data protection fee	Paid. Registration reference ZC264249 on the Information Commission’s register of fee payers

We haven’t appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. Privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you visit tekkersandtactics.com or any page on it, and when you email or write to us. It doesn’t cover other websites we link to, such as IFAB, England Football or the NSPCC, which have their own policies. Our other websites and apps have their own privacy policies too.

3. What we collect and where it comes from

When you visit the site

You don’t have to sign up or give us anything to use the site. When your browser asks for a page or a file, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

We don’t combine this with anything else to work out who you are. We don’t download, copy or keep these logs ourselves, and we don’t use them to follow what individual visitors do. Some browsers also send Cloudflare a short report if a page fails to load because of a network fault. These reports go to Cloudflare, not to us, and we don’t use them.

The session planner and the weekly practice plan

When you choose an age group, a number of players, a length of session or a theme in the planner, or an age, days and kit in the weekly plan, the page builds the plan inside your browser. Your choices are written into the page address (for example ?age=9&n=12) so that you can bookmark, print or share the plan. They are not sent to us as data and nothing about them is stored on our side. As with any web address, if you load or share that address, the address itself reaches Cloudflare as part of the request described above. The choices are general settings, not information about any person. Please don’t type names into the page address.

The skill check

If you record your scores on the skill check, they are saved in your browser’s local storage on that device, so that you can see your progress next time. They are never sent to us and we can’t see them. You can delete them at any time with the “Delete all my scores” button, or by clearing this site’s data in your browser.

Saving things on this device

You can choose to save a few things so the site can tailor itself to you: a display name, whether you are a coach or a player, an age band (for example under 10, or 11 to 13), a position, favourite drills, and the lineups and tactics boards you build. They are saved in your browser’s local storage on that device, only when you press a save button or choose a setting. They are never sent to us, we can’t see them, and they don’t leave the device unless you copy a page address yourself. We don’t ask for your name, date of birth, email address or location, and we don’t use these choices to build a profile for anyone else’s benefit or for adverts. Anything you type into a name or note is for you alone. You can delete all of it at any time with the “Delete everything I saved” button, or by clearing this site’s data in your browser.

There are no accounts today. If we ever add accounts that keep things on our own servers, we will first carry out a data protection impact assessment, update this policy, and tell you before anything is collected. Nobody under 13 would be asked to sign up without a parent or carer’s permission.

The motion setting

If you use the Motion button at the top of the page, your choice is remembered in your browser’s local storage so that the next page you open respects it. It is a single word, “on” or “off”, and it never leaves your device.

When you email or write to us

We receive your email address, your name if your email shows it, what you write, any attachments, and the technical details that come with any email. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don’t send us details about a child, or sensitive information such as health details. If you have a safeguarding concern about a child, contact your Club Welfare Officer, the NSPCC or, in an emergency, 999, not us.

Counting visits

So that we can see which pages people read and whether the site loads quickly, we use Cloudflare Web Analytics. When a page loads, a small script from Cloudflare (served from static.cloudflareinsights.com) reads timing measurements from your browser and sends Cloudflare a short report. The report says which page was loaded, how long it took, and, from your browser and connection, roughly where in the world you are (the country), what kind of device and browser you use and which page sent you here. Cloudflare says the script does not set cookies or use your browser’s storage, that the report doesn’t carry your IP address into its records, and that it doesn’t track individual visitors across the sites of its customers. We get the totals in a dashboard. We cannot see who any visit was.

We don’t use these figures for adverts, to build a profile of anyone or to work out who you are, and we don’t know anyone’s age from them. If you would rather not be counted, you don’t have to do anything if your browser sends a Do Not Track or Global Privacy Control signal, because the script is not loaded at all. Otherwise, use the switch on the cookies and storage page, which stops the script loading in that browser. The site works the same either way.

Videos from YouTube

Some pages carry a video that is hosted on YouTube, which is run by Google. A video loads only when you press its Play button. Until then your browser makes no request to YouTube or Google: the still picture on the poster is kept on our own server, and a line beside the button says what pressing play does. When you press play, your browser loads YouTube’s player from youtube-nocookie.com, which is YouTube’s privacy-enhanced mode. Google then receives your IP address and details of your browser and device, and it may store or read information on your device to run the player. Google says that in this mode, views of embedded videos are not used to personalise your YouTube experience or the adverts it shows you outside the embed.

For what happens at that point Google is its own controller, under Google’s privacy policy, not ours. We receive nothing from it and we cannot see who has played a video. Pressing play is how you consent, and if you don’t want that, don’t press play. Every video carries its credit and licence beside it (see licences and credits).

Pictures from other people

Pictures that someone else made are saved on our own server and shown from there, so loading one sends nothing to the person who made it or to the site it came from. Each one is credited beside it.

What we don’t collect

There are no accounts, comments, forms that send data to us, newsletters, uploads, leaderboards or ways to message other visitors. We don’t use advertising, social media buttons or fingerprinting, and our only analytics is the visit counting described above. We don’t collect sensitive (“special category”) data or information about criminal convictions, and we don’t buy personal data from anyone. Our fonts, images and scripts are all served from tekkersandtactics.com, so loading a page doesn’t send your details to Google or any other company. The two exceptions are the visit-counting script from Cloudflare, which you can switch off, and a video from YouTube, which loads only if you press play.

4. How we use it and our lawful basis

What we do	Data used	Lawful basis	How long
Deliver pages and files to your browser	Server log data	Legitimate interests: running a website that works	Handled by Cloudflare for as long as it needs, then deleted (see section 9). We keep none.
Protect the site from attacks, and investigate faults	Server log data, network error reports	Legitimate interests: keeping the site and its visitors safe	As above
Count visits and page speed, to see what is read and what is slow	Page loaded, load timings, country, device and browser type, referring page, as reported by Cloudflare Web Analytics	Legitimate interests: knowing which parts of the site help people and which don’t work. You can object by switching it off (see the cookies page).	Held by Cloudflare as totals and charts for as long as it needs for this purpose. We don’t download or keep individual reports.
Play a video you ask for	Your IP address and device details, sent to YouTube (Google) when you press play	Consent, given by pressing play after being told what it does	We keep nothing. Google’s own policy applies to what it keeps.
Read and reply to your emails and letters	Contact details, message content, attachments	Legitimate interests: answering people who contact us	Up to 24 months after our last exchange
Look into corrections and feedback	Contact details, what you tell us	Legitimate interests: keeping the site accurate	Up to 24 months after our last exchange
Handle privacy requests and complaints	Your contact details, the request and our reply	Legal obligation	2 years after we close the request, or longer if a related claim is open
Establish, bring or defend legal claims	Any of the above that is relevant	Legitimate interests: protecting our legal rights	Until the claim, and any appeal, is finished
Comply with a court order or a lawful request from a regulator or the police	Only what is required	Legal obligation	As long as the law requires

You don’t have to give us any personal data to use this site. We don’t use your data for any purpose that isn’t in this table. If we ever want to, we’ll update this policy first and ask for your consent where the law requires it.

Where we rely on legitimate interests, we have checked that the use is necessary and isn’t outweighed by your interests and rights. The data is limited and short-lived, and isn’t used to identify or profile anyone. Protecting the security of networks and systems is one of the “recognised legitimate interests” in the Data (Use and Access) Act 2025. You can object to any of these uses (see section 10).

What the site keeps on your own device is covered by the Privacy and Electronic Communications Regulations 2003 rather than by a lawful basis under the UK GDPR. The cookies and storage page explains it.

5. Cookies

Tekkers & Tactics sets no cookies. It keeps a few small things in your browser, all described on the cookies and storage page: your motion setting, and, only if you choose to save them, your skill check scores, your profile choices, your lineups and your saved tactics. Neither is used for advertising or tracking, and neither is sent to us. That is why there is no cookie banner.

Visit counting is covered by the exception in PECR for statistics, which came into force on 5 February 2026. It applies where the only purpose is to collect statistics to improve the site, the figures are shared with no one else, visitors are told, and they have a simple, free way to object. This page is the telling, the script doesn’t load if your browser sends a Do Not Track or Global Privacy Control signal, and the switch on the cookies page is the way to object. Cloudflare’s script uses your browser’s performance measurements and, according to Cloudflare, doesn’t store anything in your browser. If we ever decide to add anything else that stores or reads information on your device, we’ll update this section first and ask for your consent where the law requires it.

A video from YouTube can store or read information on your device, which is not covered by an exception, so it needs your consent. We get it by not loading anything from YouTube until you press play, after a line beside the button tells you what that does. The cookies page explains more.

6. Marketing

We don’t have a mailing list for this site and we don’t send marketing emails. If you email us, we won’t add you to a list.

7. Who we share it with

We don’t sell personal data, rent it or share it with advertisers. We share it only in these situations.

Company	What they do for us	Contract and safeguards
Cloudflare, Inc. (United States)	Hosts and delivers the website, protects it from attacks, keeps the server logs and counts visits through Web Analytics	Cloudflare customer data processing agreement
Google (Google Workspace)	Runs our email	Google Cloud data processing addendum

These companies act as our processors. They may only use personal data on our instructions, under written terms that meet Article 28 of the UK GDPR.

We may also share relevant information with our accountants, lawyers and insurers where they need it to advise us. We’ll disclose personal data to the police, a court or a regulator if the law requires it, or where it is necessary to protect someone’s safety, and we check that each request is lawful. If we sell or transfer the business, personal data may pass to the new owner, who would have to use it in line with this policy.

8. Data sent outside the UK

Cloudflare and Google are based in the United States and can process data there and in other countries. For the United States, both take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies. Both companies’ data processing terms also include standard contractual clauses with the UK’s International Data Transfer Addendum, which apply where the Data Privacy Framework doesn’t. Email us if you’d like more detail.

9. How long we keep it

We keep personal data only for as long as we need it. The table in section 4 gives the period for each use. When it ends, we delete the data or anonymise it. Cloudflare doesn’t publish a fixed retention period for the logs it keeps when serving a customer’s site. Its privacy policy says it keeps personal information for a period consistent with its business purposes and then deletes it.

10. Your rights

The UK GDPR gives you these rights over your personal data. Some only apply in certain situations, and we’ll explain if one doesn’t apply to your request.

Your right	What it means
To be informed	To be told clearly how your data is used. This policy is how we do that.
Of access	To get a copy of your data and the other information in this policy.
To rectification	To have inaccurate data corrected.
To erasure	To have your data deleted, unless we must keep it by law or for a legal claim.
To restrict processing	To have us store your data but not otherwise use it, for example while we check it.
To data portability	To receive data you gave us in a machine-readable format, where the law gives this right.
To object	To object to processing based on legitimate interests. We must stop unless we have compelling grounds or need it for a legal claim.
About automated decisions	Not to be subject to significant decisions made by computer alone. We don’t make any.
To complain	To complain to us, and to the Information Commission (see section 13).

For what is kept on your device, you don’t need to ask us: the “Delete all my scores” button, or your browser’s own controls, remove it immediately.

To use a right, email [email protected] with “Privacy request” in the subject, or write to our registered office. You don’t need a form or particular words. We may ask for what we need to confirm it’s you. We’ll reply without undue delay and within one month, which we can extend by up to two months for complex requests if we tell you why within the first month. It is free, unless a request is clearly unfounded or excessive.

11. How we keep it safe

The site is served only over HTTPS. Its content security policy lets your browser load only our own files, Cloudflare’s visit-counting script and, if you press play, YouTube’s video player, so no other company’s code runs on its pages. Access to our mailboxes and accounts is limited to the people who need it, and passwords are kept in a password manager. The surest protection is that we collect almost nothing.

If a security breach led to personal data being lost or disclosed, we would assess it straight away, report it to the Information Commission within 72 hours where the law requires, and tell you directly if you were at high risk. If you think you’ve found a security problem with the site, please tell us at [email protected].

12. Children

Many of the people who use the Play pages will be children, and many coaches using the Coach pages work with children. The site is built to need nothing from either. There are no accounts, no adverts, no profiling and no way to talk to other visitors, and nothing a child records in the skill check leaves their device. We have followed the ICO’s Age-Appropriate Design Code (the “Children’s code”) in building it: we collect as little as we can, we don’t profile anyone, we don’t show leaderboards or streaks, and we don’t use nudges to keep people on the site. The only measuring we do is the anonymous visit counting described above, which doesn’t identify anyone and doesn’t tell us anyone’s age, and which stops if a browser sends a Do Not Track or Global Privacy Control signal. Nothing is sent to YouTube until someone presses play on a video. Where we find that a feature of the site doesn’t suit children, we change it.

If you are under 13, please ask a parent or carer before you email us. If you’re a parent or carer and believe a child has sent us personal data, email us and we’ll delete it.

13. Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us first so we can try to put it right: email [email protected] with “Complaint” in the subject. We’ll acknowledge it within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026 and still uses the ICO website. Complain at ico.org.uk/make-a-complaint, or call its helpline on 0303 123 1113. It will usually expect you to have raised the matter with us first. You can also go to court if you believe your rights have been breached.

14. Changes to this policy

We review this policy at least once a year and whenever we change how the site handles personal data. If we make a change, we’ll update this page before it takes effect and change the date at the top.

• 11 November 2026. Added visit counting with Cloudflare Web Analytics and click-to-play YouTube videos.
• 11 November 2026. First version.

15. Contact us

For anything about this policy or your personal data, email [email protected]. For anything else, email [email protected]. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, so email is quicker.