33 Legends The football almanac

Privacy

33 Legends works without accounts, sign-ups or cookies. This page lists what the site stores and who is responsible for it.

Controller

RELMOS AG, Weieracherstrasse 4, CH-8184 Bachenbülach, Switzerland. Contact: info@relmos.ch. See also the legal notice.

Data in your browser

The site uses localStorage to remember the following data on this browser and device:

These localStorage values stay in your browser and are not sent to our server. We do not use sessionStorage. You can delete them by clearing this site's stored data in your browser settings, or remove individual keys under localStorage for 33legends.com in your browser's developer tools. This resets the saved lineups, sort order, local duel counters and quiz progress, streak and total; it does not delete votes already sent to the server.

Duel votes

When you vote in a duel, the site stores the duel, the winner, the loser, the time of the vote and a short pseudonymous hash. The hash is computed from your IP address, a secret key held on the server and the current date. The browser, its user agent and any device identifier are not part of it. Because the key is secret and the hash is cut short, it is not meant to identify you, but it is not anonymous in the strict sense: whoever holds the key could test whether a known IP address produced a given hash on a given day. The purpose is to limit repeat voting and abuse. The hash is deleted after 30 days; the vote itself then remains without any link to you and is used for the rankings. No name, email address or account is attached to a vote.

Visit statistics

To learn how many people use the site, the server counts page views itself. It sets no cookie, runs no script in your browser and does not link a view to you. For each page view it increases a counter for the combination of: the calendar day (UTC), the page address without any query part, the country code that Cloudflare derives from your connection, the referring website if it is a different site (for example "google" or the host name; nothing if you came directly or from this site), and a coarse type of visitor (mobile or desktop browser, or the name of a known crawler such as Googlebot, Bingbot or GPTBot). Only the counter is stored. Your IP address, your full user agent, any hash or identifier and the exact time of your visit are not stored. Counter rows are deleted after 400 days. Only page views are counted, not images, files or the voting interface calls. The server hosting logs described below are separate from this counter.

We use the counts to see which pages are read and where visitors come from, and to see which search engines and AI services read the site. Because the counters hold no personal data, they cannot be traced back to a person, so a request for access or deletion cannot be answered for them. The legal basis is the same legitimate interest as below. When a page changes, we also tell the search engine Bing, through the IndexNow protocol, the address of the changed page; no visitor data is part of that message.

Hosting and server logs

The site runs on Cloudflare's network (Cloudflare, Inc., USA), which processes technical request data to deliver and protect the site. We have switched on Cloudflare Workers Logs. Each request to the site is logged with details such as your IP address, the approximate location derived from it, the browser identification (user agent), the page requested and the referring page. Cloudflare keeps these logs for at most 7 days (Cloudflare documentation, Workers Logs, limits table, checked 4 October 2026). We use them to find errors and abuse and to count visits to the site in aggregate.

Error reports

The report form on player and nation pages sends the page path, your message (10 to 1,000 characters) and an optional email address to our Cloudflare Worker. We store those fields, a UTC creation day, an internal ID and a review status in Cloudflare D1 to check and correct factual errors. Reports have no IP-address or user-agent field. There are no attachments or confirmation emails.

RELMOS AG's owner and authorised editorial team review reports. Automated assistants receive only the message and page through the editorial tool; the tool never returns the email address. Email addresses are not processed by AI. Please keep other personal information out of your message.

Email is removed immediately when a report is marked completed and by the daily cleanup once its UTC creation day is 90 days old. The entire report is deleted by that cleanup once its creation day is 365 days old. The cleanup runs daily at 03:17 UTC. A reviewed report that does not lead to a correction follows the same deadlines. To request access or earlier deletion, contact info@relmos.ch with the page and approximate day of your report.

To limit abuse, a separate table stores the same daily pseudonymous network hash used for voting, a day and a short-lived request counter, with no link to report IDs. Old hash counters are deleted at the next daily cleanup, within 48 hours. The Worker request logs described above may still contain network details. D1 Time Travel can keep earlier database states for up to 30 additional days (7 days on the Free plan). Access to recovery copies is restricted to the operator; a restore must reapply deletions before reports are used. Any operator-exported backup needs the same deletion treatment and must not feed AI tools.

Legal basis

We process this data on the basis of our legitimate interest in running a secure site and preventing abuse (Art. 6(1)(f) GDPR; under the Swiss Federal Act on Data Protection, processing in line with its principles of good faith and proportionality, Art. 6 FADP). We do not sell data or use it for advertising.

Your rights

You may ask us for access to the data we hold about you, for its correction or deletion, and you may object to the processing. Write to info@relmos.ch. Because votes are stored under a hash, we can only find yours if you tell us the IP address and the day, and only while the hash still exists. You may also complain to a data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

Third parties

The site loads no third-party fonts, no third-party analytics scripts and no advertising; the page-view counter described above runs on our own server. All assets are served from 33legends.com. Portrait credits are listed on the photo credits page.