This policy describes how 38-0 handles information about visitors and app users. 38-0 is a free football game that runs in your browser or mobile app, made as an independent fan project.
38-0 can be played without an account. Your matches, settings and saved campaigns are stored locally on your own device (for example via localStorage), except when you use account features.
If you create an account or subscribe as a member, we store the information needed to operate those features, such as email, user identifier, membership status, renewal/expiration dates and payment references. Account sign-in supports an email code plus Apple and Google social sign-in.
Payments are processed by external providers; 38-0 does not store full card numbers. For in-app purchases, Apple App Store or Google Play process the purchase and 38-0 stores the store receipt/transaction identifiers, an obfuscated store account token, product ID, expiry date and entitlement status needed to validate and restore your membership.
App live updates. The iOS and Android app can download an updated copy of its own interface files (JavaScript, CSS and HTML) so fixes and content reach you without waiting for a store release. This service is provided by Capgo. To check whether an update applies to your device, the app sends its app version, bundle version, platform and a per-install identifier generated by the update plugin. That identifier is not the advertising ID, is not used for tracking or advertising, and is not linked to your 38-0 account or email. Update files are downloaded over HTTPS and verified with a SHA-256 checksum before being applied; a file that fails verification is discarded. No gameplay data, account data or personal information is sent to the update service.
When you choose to pay through Woovi, it processes the charge and, for Automatic PIX, the monthly renewal authorization. The name, Brazilian tax ID, phone and address entered in this flow are used to register and process that authorization. We receive payment identifiers and status to grant and reconcile your access. We do not ask for your bank password.
We use Cloudflare Web Analytics to understand visit volumes. This tool is privacy-focused, uses no cookies and does not identify individual people.
On the website, we also use Google Analytics 4 and the Google tag to understand, in aggregate, how people discover and use 38-0. We may measure pages and screens visited, the path between screens, active and total time on each screen, language, platform, approximate performance, game mode, gameplay and funnel actions (such as draft completion, matches, challenges, multiplayer and checkout), plus strictly limited and sanitized source/campaign parameters.
Google may use its own cookies and identifiers to produce these statistics. 38-0 keeps only session acquisition context in sessionStorage and uses a local, non-unique marker to distinguish a first visit from a return. When an account is signed in, we send Google only an irreversible hash of the internal identifier to join journeys across devices; product events do not include email, nickname, player name, room code, token, raw challenge link or payment identifier. The native iOS/Android app does not load Google Analytics. Browser settings and blockers may prevent measurement.
In the game on the website and on the informational pages (like this one), we also use PostHog
for the same usage statistics described above (screens, gameplay and funnel actions, language, platform, game
version and sanitized source/campaign). On the informational pages it records the visit and clicks on links and
buttons, never what is typed into fields. PostHog uses no cookies on 38-0: it keeps a random identifier in the
browser's localStorage. Events go through a 38-0 address (/ingest) and are processed by
PostHog Inc., in the United States, as a processor. The IP address is used only to estimate country and city and
is then discarded. When an account is signed in, the identifier sent is the same irreversible hash described
above, together with the account type, membership status and preferred language. To measure campaigns, 38-0 keeps
on the device the source of the first visit that arrived through a campaign link (source, campaign, content and
date). Events are kept for up to 7 years and do not include email, nickname, room code, token or the full
challenge link (only the link's short code, to count how many challenges are opened).
In the iOS app. When this measurement is switched on in the iOS app, it sends PostHog the same
usage statistics, under the same rules as the website: screens visited, app opens (at launch and when the app
comes back after 30 minutes or more in the background), gameplay and funnel actions, the start and completion of
App Store purchases (no receipt or transaction ID), the app version and, if error reporting is on, app errors with
their stack trace. The app uses no cookies for this: the random identifier is kept inside the app and is cleared
when you sign out. Events go through the 38-0 address (https://38zero.com.br/ingest), the IP address
is discarded after estimating country and city, and a signed-in account is identified by the same irreversible
hash used on the website, so app and website events are joined. The app does not use the advertising identifier
(IDFA) or the identifier for vendors (IDFV), does not track you across other companies' apps and websites, and
does not share this data with data brokers or for advertising. The Android app does not send events to PostHog.
Some account facts are known only to the 38-0 server. So the server itself sends PostHog the start, renewal and end of a membership (with provider, plan, amount and payment method, and the reason it ended) and division changes in the multiplayer series, including when the purchase was made in the native app. These events use the same irreversible account hash, do not carry your IP address and do not include email, nickname, name, or payment or transaction identifiers.
For each membership purchase made on the website, the 38-0 server also sends Google Analytics a purchase event
(purchase) with the amount, currency, provider, payment method and plan cycle, together with an
account hash and a hash of the payment identifier. The payment identifier itself is never sent to Google.
Do not send usage statistics. You can turn off PostHog (in the game and on the informational pages) and Google Analytics for the game in this browser. In the app, open this page from the app's own Privacy Policy link and use the same button: the choice applies to the app on that device. The choice is saved in the browser or in the app; if you clear the site's data or reinstall the app, make the choice again. With your account signed in on this browser or in the app, the game also saves the choice to the account: right away if the game is open in another tab, or the next time you open the game. From then on, the server stops sending PostHog the account events described above, including those for purchases made on other devices, and also stops sending Google the account's purchase event. To send statistics again, use the button again in the same browser or in the app and open the game with the account signed in.
For email-code sign-in, we may use Cloudflare Turnstile to prevent automated abuse. The website shows the check on its own page. The native iOS/Android app shows the same check inside an embedded page from 38zero.com.br before its email-code account flow sends a code. Apple and Google social sign-in opens the provider in the system browser.
On the website, 38-0 shows Google AdSense programmatic ads to visitors and users who are not members; members do not see ads. Google and its partners may set cookies or use device identifiers to serve and measure ads under Google's advertising policies. You can review or change ad personalisation in My Ad Center.
The game does not use rewarded video to unlock actions. Extra benefits, such as the additional re-roll, are tied to 38-0 membership.
You can clear locally saved data at any time by clearing this site's data in your browser settings or removing the app from your device. If you have created an account, you can delete it from the account screen in the app or use the account deletion instructions to request access, correction or deletion of the data associated with your account, where applicable. When you delete the account, we remove the 38-0 account, trophy room and app-local payment references linked to it from our database. Deleting a 38-0 account does not automatically cancel an active subscription with Apple, Google, Stripe, Asaas, Woovi or another payment provider; cancel it through that provider's subscription tools.
You can also block or clear cookies and site data in your browser settings and use the Google Analytics opt-out browser add-on, where compatible.
Membership subscription rules, cancellation details and acceptable use are covered in the Terms of Use.
Questions about this policy? Get in touch: [email protected].
← Back to the game