← Goalsverse

Privacy Policy

Last updated: August 2026 (consent for embedded video; added Twitch; we now record the answer)

1. Who we are

Goalsverse (goalsverse.com) is a fan-made community site for the video game GOALS. We are not affiliated with or endorsed by the developers of GOALS.

2. What data we collect

When you sign in with Discord, we receive and store the following from Discord's OAuth2 API:

  • Your Discord username and display name
  • Your Discord profile picture URL
  • A unique Discord user ID (used to identify your account)

We also store any content you create on the site, such as your club profile settings and uploaded clips.

If you upload a clip, we store the clip title, file duration, and file size in our database, and the video file itself is transmitted to and stored by Bunny.net (our video hosting provider) for streaming and delivery. Viewers' IP addresses may be logged by Bunny's CDN infrastructure when a video is played.

3. How we use your data

  • To authenticate you and keep you signed in
  • To display your username and avatar on content you create
  • To process and stream video clips you upload via Bunny.net

We do not sell, rent, or share your personal data for advertising or profiling purposes. Video content you upload is transmitted to Bunny.net solely to provide the Clips feature — see section 4 for details.

4. Third-party services

We use Bunny.net as a sub-processor for video storage and streaming. When you upload a clip, your video file is sent directly to Bunny's infrastructure. Bunny operates its own CDN and may log technical data such as IP addresses and request metadata when videos are played, in accordance with their own privacy policy.

You can review Bunny.net's privacy policy at bunny.net/privacy.

Some pages feature YouTube videos from creators in the community, and during GOALS events the home page can show the Twitch broadcast. Both are click-to-load: until you press play we render a still image and no player at all, so no YouTube or Twitch code runs on the page and neither can set cookies or read storage on your device. The still images themselves are served by those companies' image CDNs (i.ytimg.com and static-cdn.jtvnw.net) and are fetched as the page loads, so those CDNs can see your IP address and browser user-agent — they do not, however, set cookies.

If you press play, the video is streamed from YouTube's privacy-enhanced domain (youtube-nocookie.com) or from Twitch, and that company may then set its own cookies and receive technical data such as your IP address, under its own privacy policy — Google's for YouTube, Twitch's for Twitch.

During live events we can also start the Twitch stream for you automatically, muted. Because that loads Twitch before you have clicked anything, we only do it if you have told us embedded video is OK. We ask once, in a box in the middle of the page on your first visit; the default is no, and rejecting is a single click, exactly like accepting. You can change your answer at any time from the cookie button in the bottom-left corner of every page, or in section 5 below.

Outside of the services described above, we do not use any third-party analytics, advertising networks, or tracking services.

5. Cookies & your choices

Keeping you signed in. One first-party session cookie, set only when you sign in. It is strictly necessary for the site to work and does not follow you anywhere else.

Counting views. A first-party cookie named gv_vid holds a random identifier with nothing personal in it, so that a page you look at twice is counted once. It is not readable by JavaScript, is never shared with anyone, and is not used to profile you or to recognise you on other sites. We use it on the basis of our legitimate interest in knowing which pages are read.

Embedded video. YouTube and Twitch can set their own cookies, but only once one of their players has actually loaded — either because you pressed play, or because you told us it was fine to load them on their own. We ask before doing the latter, the answer defaults to no, and we do not treat carrying on browsing as agreement.

Your answer, and changing it. Your choice is stored in your browser's local storage under the key gv-consent, together with the date you made it. That copy is what the site reads, and it is the only thing that decides whether an embedded player may load. Change it with the buttons below, or from the cookie button in the bottom-left corner of any page — rejecting takes effect immediately and stops any embedded player loading on its own again. Clearing your browser's site data clears it too, and we will ask again; we also re-ask after twelve months in any case.

What we keep about the answer. We also send each answer to our own server and store it, so we can see how many people opt in. The record is the choice itself, whether it came from the welcome box or from changing your mind later, the date and time, the same gv_vid identifier described above, and — only if you happen to be signed in — your account. We do not store your IP address or browser user-agent with it, and no new identifier is created for this. It is used to produce aggregate counts for us and for nothing else: it is never shared, never used to profile you, and nothing on the site reads it to decide what to load. We rely on our legitimate interest in knowing whether the consent notice works. If you would rather we did not keep it, contact us and we will delete it.

Embedded video:  

6. Fair use & abuse prevention

Some features are resource-intensive to run. To keep them available and affordable for everyone, and to prevent automated abuse, we apply fair-use limits. In particular, the MIG Card generator is limited to 5 cards per IP address per day (a rolling 24-hour window). If you reach the limit you can generate more later.

To enforce these limits we store a salted, one-way hash of your IP address alongside each generated card — never the IP address itself. The hash cannot be reversed back into your IP; it exists only to count requests from the same source and deter abuse. We rely on this on the basis of our legitimate interest in keeping the service running fairly and securely.

7. Data retention

Your account and associated data are retained for as long as your account is active. Clip records are removed from our database when your account is deleted; video files stored on Bunny.net are also deleted, though this may take a short additional period to propagate. You may request deletion of your account and all associated data at any time by contacting us.

8. Your rights

If you are located in the EU/EEA, you have the right to access, correct, or delete your personal data. To exercise any of these rights, contact us via our Discord server.

9. Changes to this policy

We may update this policy occasionally. Any significant changes will be announced in our Discord server. Continued use of the site after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions, reach out via our Discord server.