Privacy

Who is responsible

Tom Böttger, Luruper Hauptstraße 81, 22547 Hamburg. E-mail: hhtb18@gmail.com

The full provider details are in the Legal notice.

What your browser stores

• Yes/no cookie “ts_session”: a random id of 32 characters, set only when you answer yes or no on a shirt, and kept for one year. It holds no name, no e-mail address and no IP address. Its only purpose is that your answer stays yours and can be changed. Opening pages, searching or following a link to a shop sets no such cookie, and our usage statistics do not use it.
• Anti-forgery token for our forms (“ts_pcsrf”): a random value set on your first pageview, kept 180 days, sent back with the price-alert, contact, problem-report, shop-removal and voting forms so a foreign site cannot submit them in your name. So that one browser cannot submit the forms or query the search API an unlimited number of times per day, the server also keeps a one-way hash of it for 48 hours (see “What the server stores”).
• Your price alerts (“ts_alerts”): the access keys of the price alerts set up in this browser or added to it with a link from one of our e-mails about that alert, at most 20, so that the Alerts page can list them without a login. It holds no e-mail address, is kept for one year and loses a key when you unsubscribe from that alert or delete it in this browser.
• Focus after a filter change (“gtj-refocus” in session storage): which filter you just changed, so that the keyboard focus returns to it on the reloaded page. The next page reads it and deletes it at once.
• gtj-size: the size you chose with “Remember my size”. Stays on your device until you remove it or click “Forget size”; it is never sent to us.
• Guess the Jersey, daily game (“gtj_daily_last”, “gtj_daily_streak” and one “gtj_daily_” entry per edition, in local storage): the number of the last daily edition you finished, how many days in a row you played, and for each edition your answers and the shirts shown, so that a second visit on the same day shows your result instead of a new round. These values stay in your browser and are not sent to us; when you finish a daily game, the server only counts the score and whether the run is 1, 2–6 or 7 or more days (see “What the server stores”). They stay until you clear the site data.
• Dashboard login (“ts_admin”): a signed cookie for the operator only, 30 days.
• Anti-forgery token for the dashboard (“ts_dcsrf”): a random value for the operator only, kept 30 days, checked on every dashboard form that changes something.
• Anti-forgery token for the admin area (“ts_csrf”): a random value for the operator only, kept 8 hours, checked on every form there since that area otherwise relies on Basic Auth alone.
• Your Google Analytics choice (“ts_consent” in local storage, with its time in “ts_consent_at”): “granted” or “denied”, so the banner does not ask on every page. It counts for at most 13 months, then the banner asks again; before that you can change it under “Cookie settings” or delete it with the site data.
• Google Analytics cookies (“_ga” and “_ga_BQH9MC302P”): only after you accept, kept until your consent ends, so for at most 13 months. They hold a random id that lets Google Analytics tell visits of the same browser apart.

What the server stores

• Our own usage statistics, on our server and independent of Google Analytics and of your choice in the banner, without any cookie: only totals per day and language — how many searches, model pages, offer pages, redirects to shops, search-API queries and form submissions there were. For a search without results we also count the filters used (such as club, season, kit or size). The Guess the Jersey game adds the same kind of totals per day, language and game mode: games started and finished (with score and run of days), rounds and correct answers, hints used and results shared. We also count how often each kind of page was opened (for example the home page, a model page or a club page) and how many redirects to shops started from each kind of page. These totals are split in two coarse ways: mobile or desktop (we only check whether your browser's identification contains the word "Mobi"), and where the visit came from, as one of five categories: no previous page, a page of our own site (then only the kind of that page, such as "search"), a search engine, a social network or another website. For these totals, your browser's identification and the address of the previous page are only looked at while your request is answered and are not stored. No session id, no IP address, no time finer than the day and no browser details other than "mobile or desktop" are stored, so a total cannot be traced back to you.
• To improve the search, we also keep a list of the words typed into the search box, with the number of results and the day, for 90 days. The words are stored in lower case and without anything that identifies your visit: no IP address, no browser details, no cookie or session id, no time finer than the day. A search that contains an e-mail address, a phone number, a web address or five or more digits in a row is not stored at all. Our report only shows words that were searched at least three times.
• Redirects to shops: time, offer, shop and the page you came from (the referrer your browser sends); no session id.
• Older statistics and redirects: until September 2026 our statistics were stored per request together with the id from the “ts_session” cookie (time, kind and address of the page, search parameters, number of results and loading time), and redirects to shops also carried that id. Nothing new is written that way, but these old entries still exist. There is no automatic deletion period for them yet.
• Yes/no answers on offers: offer, answer, time and a pseudonym that is computed with a secret key from the id in the “ts_session” cookie. The pseudonym cannot be turned back into the id and cannot be used as a cookie. Offer, answer, time and pseudonym are also copied as a backup into our private code repository at GitHub (GitHub Inc., USA) and can be fetched from a public export address; the id itself is not. For the transfer to the USA, GitHub is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR).
• Limit on forms and the search API: the kind of request, a one-way hash of the “ts_pcsrf” token and the time, deleted automatically after 48 hours.
• Problem reports: the offer or model concerned, the reason, the details you tick or enter, your message, a link you add as a source when you report a counterfeit or a wrong drawing, and the language of the page. We never open that link automatically; the operator only opens it by hand to check the report. The form does not ask for an e-mail address; reports from before that change may still contain the address entered then. So that the same report is not sent again and again, the server also keeps a one-way hash of your IP address, made with a random secret, together with the reason, the offer or model and the time. Your IP address itself is not stored. Entries older than 24 hours are deleted the next time anyone sends a report.
• Contact form: your e-mail address and your message.
• Shop removal requests: the domain, e-mail address and reason entered in the form.
• Price alerts: your e-mail address and the search criteria, confirmed by a double opt-in. Unsubscribing (the link in every alert e-mail) stops the e-mails but keeps the entry; “Delete alert and address” on the Alerts page removes the alert and its address from our database. When the address of a confirmed alert is changed, we send the previous address one notice that names the new address only in shortened form (for example s***@example.com), so that the owner notices if someone else has taken over the alert. The confirmation e-mail, the alert e-mails and this notice are sent through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which processes your e-mail address and the content of the e-mail on our behalf and on our instructions. For the transfer to the USA, Resend is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR). The operator can see the alerts with their addresses in the site’s password-protected admin area, to run the service and to handle support, access and deletion requests.
• Event log: every entry from the forms above (price alerts and their changes, contact messages, problem reports, shop removal requests and yes/no answers) is also written to a log file on our server, from which the database is rebuilt after an update. Changing an answer, changing the address of an alert or deleting an alert adds a new line to this log; the older lines stay, so the e-mail address of a deleted alert, and the old address of a changed one, is still in the log. There is no automatic deletion period for the log yet. When the log file has to be reset during an update, a copy is kept on the server and deleted at the first update after it is 30 days old.
• Backups: since 25 September 2026, before each update of our offer data, a copy of the whole database is stored at Cloudflare R2, the storage service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, in a storage bucket of its own that our image server does not serve. There is one copy per weekday; each is overwritten by the next update on the same weekday, so normally after one week. These copies contain everything the database holds, including the e-mail addresses of price alerts, contact messages and shop removal requests. Until 25 September 2026 these copies were kept in the same bucket as our shirt images; they were deleted on 25 September 2026. For the transfer to the USA, Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR).
• Server logs: Hetzner Online GmbH, Industriestr. 25, 91710 Neumarkt i.d.OPf., Deutschland; Serverstandort Deutschland. The application that answers your requests writes no access log, so opening a page does not record your IP address. Error messages of the application are kept in the system log of the server; if an alert e-mail cannot be sent, the message names only the domain of the address. Until September 2026 the application also logged every request with the IP address, and a failed alert e-mail with the full address; these older entries stay in the system log until it is cleared. The system log has no fixed deletion period yet.

Google Analytics (only with your consent)

If you click “Accept” in the banner, we use Google Analytics 4 to see which pages are visited, where visitors come from and how the site is used. Before that, no script, cookie or request goes to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This choice applies to Google Analytics only; our own usage statistics (see “What the server stores”) do not depend on it.

Google processes the address of the page, the referring page, the time of the visit, browser, operating system, screen size, language and an approximate location (country, region, city) derived from your IP address. Google Analytics 4 does not store IP addresses of visitors from the EU. Google Signals and advertising features are switched off, so the data is not linked to a Google account or used for ads. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR). Google deletes the event data after the retention period set in our account.

Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time with effect for the future: open “Cookie settings” at the bottom of any page and click “Decline”. The tag then stops and the “_ga” cookies are deleted.

Legal bases

• Price alerts, including the confirmation, alert and notice e-mails sent through Resend: Art. 6 (1) (b) GDPR, because you ask us to notify you; the double opt-in shows that the request comes from the owner of the address. The shortened new address in the notice to the previous address: Art. 6 (1) (f) GDPR; the legitimate interest, ours and the previous owner's, is to notice when someone else takes over an alert.
• Contact form and shop removal requests: Art. 6 (1) (f) GDPR, our legitimate interest in answering your message and in handling the request.
• Yes/no answers on offers, the “ts_session” cookie, the backup of the answers at GitHub and the public export: Art. 6 (1) (f) GDPR, our legitimate interest in letting visitors rate offers and in keeping and sharing these ratings; the cookie is strictly necessary for the answering function you use (§ 25 (2) no. 2 TDDDG).
• Problem reports and the IP hash against repeated reports: Art. 6 (1) (f) GDPR, our legitimate interest in correct offer data and in stopping abuse of the form.
• Redirects to shops, and the older statistics and redirects with the “ts_session” id: Art. 6 (1) (f) GDPR, our legitimate interest in knowing which shops and offers are used and in settling commissions with shops.
• Anti-forgery tokens, the limit on forms and the search API, and the error log: Art. 6 (1) (f) GDPR, our legitimate interest in running the site securely and without faults; the tokens are strictly necessary for the forms you use (§ 25 (2) no. 2 TDDDG).
• The “ts_alerts” cookie: § 25 (2) no. 2 TDDDG, strictly necessary for the alerts page you use; your browser sends it with each request so that the page can list your alerts. The values in session and local storage (“gtj-refocus”, “gtj-size”, Guess the Jersey): § 25 (2) no. 2 TDDDG, strictly necessary for the function you use; they are not sent to us.
• Event log and backups: Art. 6 (1) (f) GDPR, our legitimate interest in restoring the data after an update or a fault (see also Art. 32 GDPR).
• Delivery of the shirt images through Cloudflare, which technically processes the IP address of your browser to deliver an image: Art. 6 (1) (f) GDPR, our legitimate interest in delivering the images quickly and reliably.
• Our own usage statistics: to form the totals, the server briefly processes the browser identification and the referring address that your browser sends with each request; Art. 6 (1) (f) GDPR, our legitimate interest in knowing which pages are used and how visitors move through the site, without following individual visitors. The stored totals contain no personal data.
• Search words for improving the search: Art. 6 (1) (f) GDPR, our legitimate interest in finding out which searches find nothing and making the search better. Nothing is read from or stored on your device for this.
• Google Analytics: your consent, see above.

Where we rely on Art. 6 (1) (f) GDPR, you can object to the processing at any time for reasons arising from your particular situation (Art. 21 GDPR).

What we do not do

No advertising network, no external fonts, no trackers and no Google Analytics without your consent: without it this page loads nothing from a third-party domain and uses fonts served from our own server. We do not sell the data listed above and do not pass it on, with one exception: yes/no answers (offer, answer, time and pseudonym, not the id) are backed up at GitHub and can be fetched by anyone from a public export address. Links to shops carry no identifier of yours; the shop only learns that you came from Get the Jersey.

How to delete it

Delete the cookies and the local storage for this site in your browser: the yes/no cookie, the list of your price alerts (the alerts themselves keep running) and the Guess the Jersey results are then gone, and a new answer starts a new, unconnected id. If your yes/no answers on the server should go as well, or older entries from up to September 2026, when our statistics and redirects were still stored with that id, send us the id — you can read it from the “ts_session” cookie in your browser — at hhtb18@gmail.com.

Your rights

Information, correction, deletion, restriction, data portability and objection: hhtb18@gmail.com. You can also complain to a data protection supervisory authority.