Overview
TheStatsAPI (“we”, “our”, “us”) operates the website at thestatsapi.com and provides a football data API service. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.
We are committed to handling your data responsibly and in compliance with applicable data protection laws, including the UK GDPR and EU GDPR where applicable.
If you have questions about anything in this policy, please contact us.
Data we collect
Account data
When you sign up, we collect your email address and a hashed password. This is stored securely via Supabase, our authentication provider. Your API key is generated and associated with your account record.
API usage data
We log API requests including the endpoint called, timestamp, response status, and the API key used (not your email). This data is used to enforce rate limits, display your usage dashboard, and diagnose issues.
Payment data
Billing is processed by third-party payment providers. We do not store raw card numbers or bank account details on our servers. We retain billing history (amount, date, plan) for accounting and support purposes.
Communications
If you contact us via email or the live chat widget, we retain the content of those communications for support and quality purposes.
Website analytics
We use Google Analytics to understand how visitors use our site. This collects anonymised data about pages visited, session duration, referral sources, and general device/browser information. IP addresses are anonymised before storage.
How we use your data
- Providing and operating the API service
- Authenticating your account and issuing API keys
- Enforcing rate limits and plan quotas
- Sending transactional emails (account confirmation, password reset)
- Responding to support requests
- Improving our data coverage and API features
- Sending occasional product updates (you can unsubscribe at any time)
- Detecting and preventing abuse of the service
We do not sell your personal data to third parties. We do not use your data for automated decision-making that has a legal or similarly significant effect on you.
ChatGPT, Claude and other AI apps
You can connect your TheStatsAPI account to AI assistants such as ChatGPT and Claude through our MCP server (mcp.thestatsapi.com). This section explains what happens to your data when you do.
What we receive
When you connect, you sign in on thestatsapi.com and approve access. After that, the assistant sends us only the football queries it needs answered: search terms (such as a team or player name), IDs, dates and filters. We do not receive your conversation, your messages or your account details with the AI provider.
What we store
Connecting creates a dedicated API key for that app on your account, shown as a “Connected app” on your API Keys page. Requests made through it are logged like any other API request (see “API usage data” above). To keep you signed in, we store a refresh token for the connection with our database provider (Upstash): the token only as a one-way hash, and the connection's API key encrypted. Access tokens expire after one hour and are not stored.
What we return
Football data, such as fixtures, scores, tables and statistics. So that the assistant can tell connected accounts apart, we also return your account ID and email address to the app you connected. That provider handles everything it receives under its own privacy policy: OpenAI, Anthropic.
Retention and control
A connection's refresh token expires 90 days after it was last used. You can disconnect at any time by revoking the connected app's key on your API Keys page, which stops access immediately, or by disconnecting TheStatsAPI in the AI app. Connecting the same app again replaces its previous key.
Third-party services
We use the following third-party services, each of which processes some of your data under their own privacy policies:
Authentication and database hosting. Stores your account email, hashed password, and API usage records.
Anonymised website traffic analysis. Collects page view and session data. No personally identifiable information is sent to Google.
Database hosting for sign-in sessions of connected AI apps (ChatGPT, Claude). Stores hashed refresh tokens and the encrypted API keys they belong to.
Live chat support widget. If you use the chat, Crisp stores the conversation and may set cookies to identify returning visitors.
Affiliate tracking. If you arrive via an affiliate link, Endorsely records a cookie to attribute the referral.
Data retention
We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are legally required to retain certain records (e.g. billing history for tax purposes, which we retain for 7 years).
API request logs are retained for 90 days for debugging and abuse-prevention purposes, after which they are aggregated and anonymised.
Refresh tokens for connected AI apps expire 90 days after their last use. Revoking a connected app's key ends access immediately.
Analytics data held by Google is subject to Google's own retention policies.
Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the data we hold about you
- Rectification: ask us to correct inaccurate data
- Erasure: request deletion of your account and associated data
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests
- Restriction: ask us to limit how we process your data in certain circumstances
To exercise any of these rights, email [email protected]. We will respond within 30 days.
Policy changes
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. Continued use of the service after changes are published constitutes acceptance of the updated policy.
Contact us
For any privacy-related questions or to exercise your data rights, contact us at:
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority.