Privacy Policy — The XI Games
Last updated: 24 September 2026
The XI Games is a collection of daily puzzles at thexigames.com, and The XI Games app for phones.
This policy covers all of them, however you reach them — whether in the app, at thexigames.com, at a game's own address such as crossword.thexigames.com, or through one of our redirect domains. The games share a sign-in and the same approach to data, so they share one policy rather than six.
We have tried to write it in plain English. If anything is unclear, ask us — the contact details are at the bottom.
1. Who is responsible for your data
Graeme Watkin, trading as The XI Games, is the data controller for all the games at thexigames.com and their associated domains.
- Contact: privacy@thexigames.com
If you need a postal address — for example to make a formal request in writing — email us and we will provide one.
We do not have a Data Protection Officer. We are not required to appoint one, and for a service of this size the contact address above reaches the person who makes these decisions.
2. What we collect
If you just play
You do not need an account to play any of our games. When you play a puzzle we record:
- Which puzzle it was, when you started and finished, and how long you took
- How many answers you got, your score, and how much help you used
- Whether you finished or gave up, and where you had reached
- Which link brought you to the site — for example a shared challenge link, or
a campaign tag on a link posted elsewhere
These records are not linked to you. Each attempt is given a random identifier that is not connected to any earlier or later attempt, to any device, and to no name or address. Two goes by the same person are indistinguishable from two different people. We keep them to understand which puzzles are too hard, which are too easy, and how many people finish.
We also record technical information that any website receives, such as your browser type and approximate country, through our hosting provider.
If you create an account
Accounts are optional. They exist so your results follow you between devices. You sign in with Google, and we receive from Google:
- Your email address
- The name on your Google account
- A Google account identifier
We do not receive your Google password and cannot access anything else in your Google account.
We then store your puzzle results against your account: scores, times, dates played, and the club you have chosen to play as.
If you enter a challenge
Challenge links let someone set a puzzle for a group and compare scores. If you open one you are asked for a name before playing.
That name is shown to everyone else who opens the same challenge link. It appears on the standings table for that challenge. You choose what to type. We would encourage a first name or a nickname rather than a full name, and you should not enter anything you would not want the other people in that group to see.
We store the name you typed, your score, your time and how much help you used.
If you ask for a themed board
If you are signed in and suggest a club or theme, we record which one you asked for, so we can tell you when it arrives.
If you turn on reminders in the app
Reminders are only in The XI Games app, and they are off until you turn them on. If you do, we store a notification token for your phone, your time zone and your reminder choices, so we can send the reminders you asked for. If you are signed in, the token is linked to your account so we can send streak and challenge reminders.
We do not store your name or email for this. Turning reminders off, or not opening the app for 60 days, deletes the token. Notifications are delivered through Google Firebase Cloud Messaging.
3. Why we are allowed to hold it, and on what basis
| What | Why | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Anonymous play records | To see how puzzles play and improve them | Legitimate interests |
| Account details | To give you an account you asked for | Performance of a contract |
| Your saved results | To keep your results across devices | Performance of a contract |
| Challenge names and scores | To show the standings the challenge exists for | Legitimate interests |
| Theme requests | To tell you when your suggestion is published | Legitimate interests |
| Reminder token and choices | To send the app reminders you turned on | Consent — you turn reminders on, and can turn them off at any time |
| Security and abuse prevention | To keep the service working and unabused | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. We think it is not, because the data is minimal, mostly not linked to any person, and used only to run and improve a puzzle game. You can object to this — see section 8.
We do not sell your data. We do not use it for advertising. We do not profile you or make automated decisions about you.
4. Who else sees it
We use a small number of service providers. They process data on our instructions and are not permitted to use it for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts our sites, stores the databases, provides privacy-focused analytics | United States, with data processed at edge locations including the UK and EU |
| Google LLC | Provides sign-in, if you choose to use it. Delivers app reminders through Firebase Cloud Messaging, if you turn them on | United States |
Nobody else receives your data, unless we are legally required to disclose it — for example in response to a valid court order.
Transfers outside the UK. Both providers are US companies. Transfers are made under the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses, or under the UK-US data bridge where that applies. You can ask us for details of the safeguards in place.
5. Cookies and what we store on your device
We use one cookie. Everything else is stored in your browser's own storage, which never leaves your device unless this policy says otherwise.
The one cookie
| Name | Purpose | Consent |
|---|---|---|
cxi_session | Keeps you signed in. Only set if you sign in, and cleared when you sign out. | Not needed — strictly necessary for a service you asked for |
We use no advertising cookies, no third-party cookies and no tracking cookies. We do not use cookies to follow you to other websites, and nobody else can read anything we set.
Stored in your browser
These live in your browser's own storage. Most never leave your device.
| What | Why |
|---|---|
| Appearance and display preferences — light or dark, board size, clue style | So the game looks the way you set it, next time |
| Games in progress | So a half-finished puzzle is still there tomorrow |
| Your own results and scores | So the game can show your history without an account |
| The club you chose to play as | So you are not asked every time |
| Which puzzles you have already seen | So you are not given the same clues repeatedly |
| The name you last typed into a challenge | So a returning player does not retype it |
| An identifier for challenge entries | So a challenge counts one entry per device rather than one per attempt. This is sent to us when you enter a challenge, and is not used for anything else. |
| Which link brought you to the site | So we can tell which shared links and posts bring people in. This one is cleared when you close the tab. |
Under the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, these fall under the exceptions for storage that is strictly necessary for a service you have asked for, and for remembering how you want the service to look. We are telling you about them here because that is required even where consent is not.
How to opt out. Clearing your browser's site data for our games removes all of it. Your browser's private or incognito mode prevents any of it persisting. Doing either costs you saved preferences and any game in progress — nothing else, and the games work fully without them.
Analytics
We use Cloudflare Web Analytics. It sets no cookies, does not fingerprint your device, and cannot follow you to other websites. It tells us how many people visited and which pages they used, and nothing that identifies anyone.
6. Children
Our games are football word puzzles and we recognise they may be used by people under 18.
We have designed them so that a child can play without giving us anything:
- No account is needed to play any puzzle in any of our games
- Play records are not linked to any person
- We ask for no age, no location, no contact details and no photograph
- Public leaderboards show a rank and a score, never a name
- We show no advertising and use no tracking or profiling
The one place a name appears is a challenge standings table, and only for people who open that specific link. It is not indexed, not public, and not searchable. We would still ask that children use a first name or nickname rather than a full name.
Accounts require a Google account, and Google applies its own age restrictions.
If you are a parent or guardian and believe we hold information about your child that you would like removed, contact us and we will remove it.
We take account of children's higher protection matters when we design and change these services, as required by Article 25 of the UK GDPR, and we have regard to the Information Commissioner's Age Appropriate Design Code.
7. How long we keep things
| What | How long |
|---|---|
| Anonymous play records | 24 months, then deleted |
| Account details and results | Until you delete your account, or after 24 months with no sign-in |
| Challenge names and scores | 12 months after the challenge was created (if you delete your account first, your name is replaced with “Deleted player”) |
| Theme requests | Until the board is published, or the request is withdrawn |
| Reminder token and choices | Until you turn reminders off, or 60 days after the app was last opened |
You can delete your account and results yourself at any time: open your account and choose Delete account. It happens at once. What is deleted, and how. Or email us and we will do it.
8. Your rights
Under UK data protection law you have the right to:
- Be told what we hold and why — this policy, and you can ask for more
- Get a copy of the personal data we hold about you
- Correct anything that is wrong
- Have it deleted
- Restrict what we do with it while a question is resolved
- Object to processing we base on legitimate interests
- Take it elsewhere in a portable format
- Withdraw consent where we relied on it, at any time
To use any of these, email privacy@thexigames.com. We will respond within one month. There is no charge.
Two honest limits:
Anonymous play records cannot be found or deleted individually, because there is nothing in them that identifies you — no name, no account, no device identifier. That is a deliberate design choice, and the trade-off is that we cannot single out your rows even if you ask.
A search will be reasonable and proportionate. If a request is very broad we may ask you to narrow it down.
9. Complaints
If you are unhappy with how we have handled your data, tell us first at privacy@thexigames.com. We will acknowledge within five working days and respond properly within one month, explaining what we found and what we intend to do.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office:
- ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
You can go to the ICO without coming to us first, though we would rather have the chance to put it right.
10. Security
Our sites run over HTTPS. Answers are held on the server and are not sent to your browser until you have earned them. Scores are calculated and verified on the server rather than trusted from the browser. Access to the database is limited to the site owner.
No service can promise perfect security. If a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you directly where the risk is high.
11. Changes to this policy
If we change what we collect or why, we will update this page and change the date at the top. Where a change materially affects you, we will say so in the games themselves rather than relying on you noticing.
Adding a new game to The XI Games does not change this policy, provided the new game collects the same things in the same way. If one ever collects something different, we will say so here and name the game.
12. Contact
privacy@thexigames.com
The XI Games and all its puzzles are unofficial and are not affiliated with, endorsed by, or connected to any football club, league or governing body.