Privacy policy.

Fan voting

Opening the fan vote page creates the rivalry-voter cookie, a random browser identifier used to remember one final vote. It is HTTP-only, uses SameSite=Lax and Secure on HTTPS, and is sent only to /api/vote. Its lifetime is up to 400 days, renewed when you load voting results; browsers may remove it sooner. Clearing site data removes this browser’s voting restriction. It is not used for advertising.

The voting database stores a hash of the random browser identifier, the chosen player and the submission time while the poll operates. It does not collect your name or email. To limit automated voting, a keyed hash of the connecting IP address counts new votes for one hour; expired counters are removed on the next new vote. Raw IP addresses are not stored in the voting database. The publisher’s starting totals are labelled separately from visitor votes.

Visiting the website

The Rivalry publishes football comparisons at messivsronaldo17.com. Public visitors do not need an account. The website does not collect payments or operate newsletter subscriptions.

Our hosting provider, Railway, receives technical request information needed to deliver and protect the website, which may include an IP address, browser details, requested URL and time of access. Hosting logs are handled according to the provider’s settings and retention practices.

Preferences and browser storage

Your light or dark theme choice is saved in your browser as rivalry-theme. It stays there until you change it, clear site data or your browser removes it. Comparison filters are stored in the URL fragment so that a comparison can be restored or shared.

On unprefixed pages, we use your browser’s preferred supported language, falling back to English. A link with a language prefix keeps that language. Choosing a language in the menu saves only its language code in the rivalry-locale preference cookie for up to one year. The cookie uses SameSite=Lax and Secure on HTTPS. Clearing it restores automatic browser-language detection.

Site search matches page titles locally in your browser. We do not send the search text to a search provider. Fonts and licensed player photographs are served with the website; we do not load third-party photo embeds.

Website analytics

Vercel Web Analytics is disabled in this edition. Hosting and security request logs are separate from optional visitor analytics.

When analytics is enabled, our integration removes query strings and URL fragments from the page URL sent to analytics and excludes admin pages. Support form text, names and email addresses are not included in analytics events.

Advertising

Google AdSense is enabled on public pages. Ad availability depends on Google’s approval, your location and your consent choices. Where Google’s consent message is shown, use its Privacy and cookie settings link to revisit your choices.

If Google AdSense is activated, third-party vendors, including Google, may use cookies to serve ads based on your previous visits to this website or other websites. Google’s advertising cookies allow Google and its partners to serve ads based on those visits. Advertising requests may also include technical information such as your IP address and browser details.

You can manage Google’s personalized advertising through My Ad Center and learn about other vendors’ opt-out choices at AboutAds. These external choices do not replace any consent controls required on this website. Before advertising starts, this page will identify the active services and explain how to open and change the applicable consent choices.

We will not activate personalized advertising for visitors in the EEA, UK or Switzerland before a Google-certified consent platform is configured and tested. Rejecting personalization must not prevent access to the football content. Non-personalized ads can also use storage and require consent where applicable.

Contact and correction reports

Submitting the Contact form sends your message, category, language, any page or evidence link, and any optional name or email address to our private support inbox. Public visitors cannot read other reports. Authorized administrators use this information to investigate issues, manage corrections and respond when contact details are supplied. We do not use support details for marketing.

Reports are available for up to 90 days after submission. Expired reports are removed when the support service is next used; administrators can delete reports sooner. Database backups may retain older copies according to the hosting provider’s backup retention. If a correction is published, its statistical evidence can remain in the public revision history without your contact details.

To limit spam, we use a keyed hash derived from the connecting IP address with a one-hour submission counter and a site-wide 24-hour counter. Expired counters are removed when the support service is next used. The support database does not store the raw IP address. Hosting providers may separately retain request logs. Do not include passwords or sensitive personal information in a report.

A reference number confirms that the report was saved, not that it has been reviewed or accepted. Email replies are not automatic. If you provide an email address and the publisher replies, the email providers involved handle delivery. Use the Privacy request category to request access, correction or deletion and include your report reference if available.

Administration and retention

Administrator sign-in uses an essential HTTP-only session cookie, rivalry-admin, with an eight-hour lifetime. Server-side session records support authentication. Provider credentials are encrypted on the server and are not returned to public visitors.

The rivalry-admin-ui cookie lets the browser check whether to show administrator controls. It is readable by JavaScript, expires after eight hours and uses SameSite=Strict and Secure on HTTPS. It does not grant access; the server verifies the separate session cookie. Signing out removes both cookies. Neither cookie is used for advertising or visitor tracking.

Match records and administrative activity are stored in our database so corrections can be reviewed and publication history can be recovered. These records are retained for the archive’s operation and integrity. An administrator’s session expiry is separate from the retention of audit records and backups.

Your choices and questions

You can remove saved preferences through your browser’s site-data controls. Removing the admin cookie signs that browser out. Blocking storage may prevent preferences or administrator sign-in from working, but public comparisons do not require a visitor account.

Depending on the laws that apply to you, you may have rights to request access, correction or deletion of personal information, or to object to some uses. Use the contact details published on our Contact page for privacy questions. You may also raise a concern with the relevant data protection authority.

External websites and changes

Links to football sources and photography credits take you to other websites with their own privacy practices. This policy describes the current website. We will update it when services or information-handling practices change.