What we collect, and what we don't

Privacy & cookies

Who runs this site

SCR Guide is an independent, non-commercial site run by Kubik Jones Digital; it is not affiliated with, endorsed by, or connected to the EFL, the Premier League, or any football club. The data controller for the personal data described on this page is:

Kubik Jones Digital
Email: henry@kubikjonesdigital.com

Email alerts (newsletter)

If you sign up for SCR status alerts, we store only:

your email address;
the page you signed up from;
your subscription status (pending, confirmed or unsubscribed);
the times you signed up, confirmed, and unsubscribed.

We do not store your name, and we do not record your IP address with your sign-up.

Lawful basis: consent (UK GDPR / GDPR Article 6(1)(a)). Consent is confirmed by double opt-in: after you enter your address we send one confirmation email, and nothing further is sent unless you click the link in it to confirm. Your address may be passed to an email-sending service so that it can deliver the alerts to you.

Unsubscribing. Every email we send carries an unsubscribe link, and you can also unsubscribe by contacting us using the details above.

Retention. We delete unconfirmed sign-ups automatically after 30 days. If you unsubscribe we keep your address as a suppression record so that we do not email you again; the lawful basis for that record is our legitimate interest in honouring your choice. We will delete it if you ask us to.

Cookies and similar technologies

Cookies and similar technologies on this site: purpose, expiry and consent
Name	Purpose	Expiry	Consent
`XSRF-TOKEN` and the Laravel session cookie	Security: CSRF protection for the site's forms. If you sign in to an account, the session cookie is also what keeps you signed in.	Session	Strictly necessary — exempt from consent.
`remember_web_*`	Keeps you signed in to your account between visits. Only set if you sign in or register with "Keep me signed in" ticked.	Until you sign out	Strictly necessary for a feature you asked for — exempt from consent.
`scr_consent`	Records your analytics choice so we don't ask again.	12 months	Exempt — it is the record of your consent decision itself.
`_ga`, `_ga_*`	Google Analytics. Identifies your browser across visits so we can count returning readers and see which pages are used.	Up to 2 years each	Only set if you click Accept.
TraceLead identifiers (cookie or browser storage)	TraceLead, a marketing-attribution service. It records which campaign or link brought you to the site (the "touch"), gives your browser a visitor ID so repeat visits can be connected, and may keep the contents of form fields you fill in on the site, so that a sign-up can be traced back to where it came from.	Set by TraceLead; kept until you withdraw consent or clear your browser storage	Only stored if you click Accept.
`scr_subscribe_hide` (browser localStorage, not a cookie)	Remembers that you dismissed the newsletter sign-up box.	No expiry — stays until you clear your browser storage	Functional and user-initiated: only written when you dismiss the box.
`scr_rail`, `scr_nav_open` (browser localStorage, not cookies)	Remember that you collapsed the sidebar, and which menu sections you opened.	No expiry — stays until you clear your browser storage	Functional and user-initiated: only written when you collapse the sidebar or open a section.
`bs_state_*`, `bs_stats`, `bs_player`, `bs_synced` (browser localStorage, not cookies)	The Balance Sheet daily game: your guesses for each day's puzzle, so a reload resumes it; your streak and stats; a random ID your browser makes up, used only to count your result once (see below); and, if you sign in, a note that this browser's games have been copied to your account.	No expiry — stays until you clear your browser storage	Functional and user-initiated: only written when you play.

Analytics run only after you click Accept. If you click Reject, nothing is loaded from Google, no analytics cookies are set, and TraceLead stores nothing in your browser. You can change your mind at any time using the Cookie settings link in the footer, which clears your choice and shows the banner again. Withdrawing consent also tells TraceLead to delete the stored touch, visitor ID and any saved form-field contents from your browser. Where Google Analytics runs, we request IP anonymisation (anonymize_ip) and we do not enable Google's advertising features. Analytics data is sent to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework and its UK Extension. See Google's privacy policy, or use Google's Analytics opt-out browser add-on.

The TraceLead script (app.tracelead.io) is loaded on every page, but until you accept it does not read or write anything in your browser. Your browser does contact TraceLead's servers to fetch the script, which sends them your IP address, as with any file loaded from a third party. See TraceLead for how it handles the data it receives once you accept.

Balance Sheet game results

When you finish a Balance Sheet puzzle, your browser sends us the puzzle number, the clubs you guessed, and the random ID stored in bs_player. We store a one-way hash of that ID, never the ID itself, and no IP address, browser details, email or name. It is used to count each player's game once, to show the "better than X% of players" line, and to see how hard each puzzle turned out to be. Games played without an account are deleted automatically after 90 days. Lawful basis: our legitimate interest in running the game. Clearing your browser storage gives you a new, unconnected ID. If you sign in, a game you finished on that browser beforehand is moved to your account, so that it is counted once however many devices you play on; from then on it is kept with your account, as described below.

Accounts

You do not need an account to read this site or to play Balance Sheet. If you choose to create one, we store:

the name and email address you give us, and whether you have confirmed the address;
your password, as a one-way hash — we cannot read it;
your Balance Sheet games: for each puzzle, the clubs you guessed and whether you solved it. Your streak and stats are worked out from these.

The account exists to carry your game history from one device to another. While you are signed in, our session records also hold your IP address and browser type, which is how we keep the session secure. We send account email only when you ask for it or it is needed to run the account: a link to confirm your address, and a password-reset link. Creating an account does not subscribe you to anything.

Optional emails. When you register, or later on your account page, you can tick either of two emails: the SCR Guide newsletter (occasional news and updates, including alerts when a club's SCR status changes), and a daily Balance Sheet email with that day's first clue and a link to play. Both are off unless you tick them. For each we record whether it is on, when and where you agreed, and when you withdrew, and for the daily email the last puzzle we sent you. We only send to an address you have confirmed. Your address may be passed to an email-sending service so that it can deliver them. Lawful basis: consent (Article 6(1)(a)), which you can withdraw at any time with the unsubscribe link in every email or on your account page.

Lawful basis: contract (UK GDPR / GDPR Article 6(1)(b)) — providing the account you asked for. Retention: until you delete the account, which you can do yourself at any time from your account page; that removes your details and every saved game immediately.

Fonts

The site loads two typefaces, Fraunces and Spline Sans, from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). That means your browser's IP address is sent to Google when the fonts are fetched. Google states that it does not use Fonts requests to build advertising profiles, but we set it out here so you know it happens. No cookies are set by that request. Lawful basis: our legitimate interest in rendering the page as designed.

Server logs

Our hosting provider may keep standard web-server logs — IP address, requested URL, user agent, timestamp — for security and abuse prevention, for a short period. We do not use these logs for analytics or marketing.

Your rights

You have the right to ask for access to the personal data we hold about you, and to ask us to correct it, erase it, restrict how we use it, or provide it in a portable form. You may also object to our processing, and you can withdraw your consent at any time — for analytics via the Cookie settings link in the footer, and for email alerts via the unsubscribe link or by emailing us. To exercise any of these, use the contact details above.

If you are unhappy with how we handle your data, UK visitors can complain to the Information Commissioner's Office at ico.org.uk. Visitors in the EU or EEA can complain to their national data protection authority (list of authorities).

We do not carry out any automated decision-making or profiling.

Children

This site is aimed at a general adult audience and we do not knowingly collect personal data from children.

Changes to this policy

If we change what we collect or which third parties are involved, we will update this page and change the date below.

Last updated 2026-10-15. Back to the explainer →