What is public
Read this section carefully. Some of what UCA publishes is visible to anyone on the internet, signed in or not. This is the part people are most often surprised by, so it comes first.
- Your player page is public. Your UCA Name is the page title. It also appears in the page's metadata and in an automatically generated share image. Your gamertag is shown on the page as the name you play as.
- Your full gamertag history is public — every past and present gamertag we hold for you, with the dates each was active. Changing your gamertag does not hide the old one.
- Your player page also shows your profile address, the playing positions you choose, player status, platform, current club, career statistics, your last 10 matches, and a "Discord connected" badge.
- Club pages are public — club name, tag, logo, description, colors, the manager's display name and avatar, and the roster.
- Our site search works without an account. Anyone, signed in or not, can search UCA and get back active players along with their gamertags and platforms.
Never public: your email address, your bio, and your Discord handle, Discord ID, global name, and Discord avatar. Those are visible only to you and to staff.
Signing in to browse the full player, team, match, and leaderboard directories does not make individual profiles private — anyone can still open your player page or club page directly, without an account.
If you are not comfortable with a gamertag appearing publicly and permanently, do not use one that identifies you off-platform. We would rather you knew this before signing up than found out afterward.
Information we collect
When you register
Registration asks for exactly three things: a display name (up to 80 characters), an email address, and a password. We do not ask for your date of birth, real name, phone number, postal address, country, platform, or gamertag at sign-up.
If you sign in with Discord
We request only the basic identity and email permissions. We store your Discord user ID, username, global name, avatar address, and the date you linked the account. We do not request access to your servers or your connected accounts.
Your player profile
Your gamertag is not collected at sign-up. It is added later — by you or by staff — as part of joining a club and playing recorded matches, and the gamertag recorded against your performances also comes back with the match data we import from EA. Over time your profile may include past gamertags, your profile address, the playing positions you choose, player status, platform, a bio, an avatar, and your club membership.
Club applications
If you apply to bring a club into UCA, we collect the club name, tag and platform, your Discord username, club status, whether you play in other leagues and which, roster and availability answers, your management experience, why you want to join, and your acknowledgements of the rules and code of conduct. Some of these are free-text boxes — please do not put anything sensitive in them. Your identity comes from your signed-in session; the form never asks for your name or email. Staff may add private reviewer notes, which are never visible to applicants.
Competition data
Fixtures, results, per-player match statistics (including the EA gamertag recorded for a performance and EA's own anti-cheat indicator), who submitted a result and who approved it, standings, and roster history.
Disputes
A dispute is created automatically when two clubs submit conflicting scores for the same fixture. We store the description, staff notes, the outcome, and resolution notes. There is no in-app evidence uploader — any evidence you share with staff is sent through Discord and hosted wherever you host it.
Administrative records
Staff actions are logged: what was changed, the change itself, when, and by whom. For staff actions this log also records the acting administrator's email address. These logs do not record IP addresses or device information — those fields do not exist.
Technical data
Our own code reads the IP address on your connection only to rate-limit sign-in, registration and password-recovery attempts, and a few staff-only tools. We do not save it. It is held in memory for up to 15 minutes to count attempts, then discarded. It is never written to our database or to our own logs. We do not fingerprint devices.
When something on the site breaks, we receive an error report. It includes the address of the page, your browser and device type (the "user-agent" your browser sends with every request), and technical details of the fault. See Sentry under Service providers.
Match recordings
A club manager or tournament captain can upload a screen recording of EA SPORTS FC's post-match Player Performance screens, so UCA can read the match statistics from it instead of someone typing them in.
- What a recording shows. The name each player uses in the game (the "Known As" name set in EA SPORTS FC) and their statistics for that match.
- We keep the file exactly as it was uploaded. Anything else it captured, including sound, is stored with it. Record only the post-match screens.
- Recordings are private. They are never shown publicly, and no one can download the original video. Staff can view the still frames taken from a recording, as can the managers or captains of the club that uploaded it — and, once the statistics are published, those of the opposing club.
- How it is read. Google Cloud reads the frames to extract the statistics. Once published, the statistics — not the recording — appear on public player and club pages.
- How long we keep them. For now we keep recordings, and the frames taken from them, indefinitely. Discarding a recording from a submission stops it being used, but does not delete the file. When automatic deletion starts, we will say so on this page.
Where information comes from
- From you — registration, your profile, club applications, and uploads.
- From Discord — only if you choose Discord sign-in, and only the fields listed above.
- From the EA Pro Clubs API — UCA queries EA's Pro Clubs API from our servers to import match data. Your browser never contacts EA on our behalf; data flows inbound from EA to UCA. Imported results can be inaccurate or incomplete and are subject to administrative review. Staff can turn the import off platform-wide, but this is not a per-player setting — you cannot opt your own matches out of it.
- Automatically — the short-lived IP handling and the error reports described above, and the site measurement and cookies described below.
How we use it
- Create your account and sign you in.
- Run competitions: rosters, fixtures, official results, standings, statistics, and permanent competitive history — including continuity when a club folds, changes owner, or rebrands.
- Publish public player and club profiles.
- Review club applications and make admission decisions.
- Investigate disputes, enforce the rules, and keep an accountable record of administrative decisions.
- Prevent abuse — for example, rate-limiting sign-up attempts.
- Find and fix faults, using error reports.
- Count page visits and measure how fast pages load, in aggregate, to improve the site.
- Communicate with you through our Discord community.
What we do not do
Stated plainly, because it matters:
- We do not sell your data. Not to anyone, in any form.
- No advertising. No ad networks, no ad cookies, no tracking pixels.
- No profiling and no cross-site tracking. We count page visits and measure page speed without identifying you — see Site measurement. Nothing follows you to other sites or builds a profile of you. No Google Analytics, no PostHog, no Plausible.
- No payments. No card processing, no subscriptions, no billing. We collect no financial information.
- No marketing email and no newsletter.
- No third-party tracking cookies, and no data written to your browser's local or session storage by UCA code.
- No session recording or replay of any kind.
Site measurement
We use two Vercel products to see which pages people visit and how fast the site is for them. Neither is used on staff pages.
- Vercel Web Analytics counts page visits. For each visit it records the page address, the site that sent you, your country, and your browser, operating system and device type.
- Vercel Speed Insights measures how quickly pages load and respond. For a page load it records the page address, the speed measurements, which part of the page was slowest, your country, your browser, operating system and device type, and your connection speed.
Before anything is sent, your browser removes everything after "?" or "#" in the page address — search terms, filters, sign-in codes — and replaces the account ID in a profile address with a placeholder. Neither product sets cookies or stores anything in your browser, and neither is linked to your UCA account. To tell visits apart, Vercel uses a code derived from your browser's request that changes every day, so we cannot tell that the same person came back on a later day.
Service providers
These are the only companies that handle UCA data. Each uses its own infrastructure suppliers, and we will update this list if we add a provider.
- Supabase — where your account, the database, uploaded images and uploaded match recordings live. Almost everything UCA stores is stored with them.
- Discord — optional sign-in, and our community and support server.
- EA Pro Clubs API — server-side match data queries.
- Vercel — hosting and infrastructure, and the site measurement described above.
- Sentry — error monitoring. When something on the site fails, an error report goes to Sentry with the page address, your browser and device type, and technical details of the fault. Sign-in cookies and authorization headers are stripped from these reports before they are sent, and we do not add your account details to them. Since 1 October 2026, Sentry does not store IP addresses with them.
- Resend — delivers account emails, such as sign-up confirmation and password-reset links, so it handles your email address.
- Railway — runs our Discord bot, which posts results and fixture reminders and keeps Discord roles in step with club rosters.
- Google Cloud — reads the post-match statistics from the match recordings that managers and captains upload, and relays our match data queries to EA.
Security
- Passwords and sessions are handled by our authentication provider. Signed-in users can change their own password and email address at /profile/settings.
- Password reset is self-service, by email. The "Forgot password?" link on the sign-in page emails a single-use, time-limited reset link to the address on the account. We give the same answer whether or not an account exists for the address you type, so the form cannot be used to find out who has an account. Completing a reset signs every session out.
- Uploaded images are stripped of metadata. Every avatar and club logo is re-encoded, resized, and has its EXIF data — including any location tags your device wrote — removed.
No system is perfectly secure, and we cannot guarantee that a determined attacker will never succeed. If we become aware of a breach affecting your information, we will post notice in our Discord community.
How long we keep information
We want to be accurate here rather than reassuring.
- Competition records are kept indefinitely. Fixtures, results, statistics, disputes, and administrative decisions form the league's permanent competitive history. There is no retention limit on them.
- Nothing is currently deleted automatically. We have an internal policy for expiring older administrative logs, but no automated deletion is running today.
- Match recordings are kept for now. Discarding one does not delete the file — see Match recordings.
- "Deleting" a record in the app hides it rather than erasing it. Removal marks the record as deleted and takes it out of the interface; the underlying record, including any email address it holds, remains in the database.
- Your account record is never deleted. We do not delete the underlying authentication record, so the row holding your email address stays in our database — including after you ask us to close your account.
- If you stop playing, nothing is removed. There is no inactivity clean-up. Your public player page and match history stay online until you ask staff to close the account.
- Backups. Our provider takes daily backups retained for seven days. Information may persist in backups for a period after it is removed from the live system. Backups do not include uploaded files or authentication records.
Closing your account
There is no button for this. Message staff privately in our Discord community and a member of staff will handle it by hand. We cannot tell you how long it will take, and we do not commit to a completion time.
The full detail — including what we are building to improve this — is on Account Deletion. That page is the operational procedure; this policy is the statement of position.
Staff may delay or decline a closure request where your account holds manager, administrative, competition, dispute, or integrity obligations.
Your privacy choices
- Change your password and email address yourself at /profile/settings.
- Ask staff in Discord to correct anything on your profile that is wrong. Gamertag history is part of the competitive record, so we will not remove past gamertags simply because you no longer use them.
- Ask about, or request, closure of your account — see Account Deletion.
Everything other than the password and email change goes through our Discord community — message staff privately, saying what you want changed and which profile it concerns. We do not have an automated export tool, so there is no self-service "download my data" button; ask staff and we will discuss what we can provide.
Children
UCA is for people aged 16 and over. Registration by anyone under 16 is prohibited. We do not ask for your date of birth, so we rely on you being truthful and on reports from the community.
If we learn that an account belongs to someone under 16, we will close it. Because our systems do not currently support complete erasure, closure works as described above — some records, including the underlying account record, will remain in our database and in backups. A parent or guardian who believes a child under 16 has registered should contact us on Discord.
International processing
UCA is operated online, and our providers operate infrastructure in multiple countries. Your information may be processed in countries other than the one you live in, where data protection law may differ. We are confirming the specific hosting regions with our providers and will state them here once verified.
How this policy is accepted
We do not currently ask you to tick a box to accept this policy at sign-up, and we do not keep a record of anyone agreeing to it. We are being explicit about that rather than implying a consent record we do not hold.
Changes to this policy
We will update this page when our practices change, and we update the "last updated" date at the top when we do. If a change materially affects how we handle your information, we will announce it in our Discord community.
Contact
Questions about this policy, your information, or your account go to our official Discord. That is currently our only contact channel — we do not operate a support email address, though establishing one is on our pre-launch list.
Ultimate Clubs Association is an unincorporated organization, not a company. See also the Terms of Service and the Code of Conduct.
UCA is not affiliated with or endorsed by EA SPORTS. EA SPORTS FC is a trademark of Electronic Arts Inc.