Matchbox — Privacy Policy

Effective 28 October 2026.

Matchbox is a wall-mounted LED display that shows live football as ambient decor, and the companion app of the same name. The short version: an account made of an email address and a password (or your Apple or Google sign-in), no ads, no analytics, no tracking, no location. The app exists to carry your preferences to your Matchbox, to mirror what the Matchbox is showing, and to make sure only you can change it.

Who we are

Matchbox is made and run by Tethered Solutions LLC, a company in the United States ("we" in this policy). We decide what happens to the information described here, so in the language of data-protection law we are its controller. Write to us about anything in this policy at the address under Contact.

The account

You can create an account in the app (during setup, or later from Settings) with an email address and a password, or by signing in with Apple or Google. The account does one thing: it ties your Matchbox to you, so only phones signed in as you can change what the Matchbox shows, and a second phone signed in as you shares it. The app needs the account to show live scores and to change what your Matchbox shows. Without one the Matchbox still plays on its own, and you can sign in later.

What we keep for an account:

• your email address and, if you chose one, a one-way hash of your password (PBKDF2-SHA256, 600,000 iterations, per-account salt — we cannot read your password and never send it anywhere)
• sign-in sessions: a random token per signed-in phone, stored as a hash. A session lasts ninety days and renews while you use it; changing or resetting your password signs every other phone out
• the Matchbox you own (its device identifier — see below) and when you claimed it
• if you ask for a password reset by email: a short-lived reset code (thirty minutes, five attempts), stored as a hash.

Signing in with Apple or Google. If you choose one of them, Apple or Google confirms who you are and tells us two things: a stable account identifier (a code that means "this Apple ID" or "this Google account" to our service, and nothing to anyone else) and an email address. With Apple, that address may be a private relay address Apple makes for you. We keep both on your account and use them only to sign you in. We never see your Apple or Google password. Where we can — when our service holds Apple's sign-in key — we also keep a token Apple issues for Sign in with Apple, for one purpose: when you delete your account, we use it to tell Apple to end your Apple sign-in to Matchbox. Where we cannot, deleting your account still removes everything we keep about it, and you can end the link yourself in your Apple ID settings (Sign in with Apple). Nothing else is asked of Apple or Google, and nothing about you is sent to them.

If you sign in with Apple or Google using the email address of an account that has a password, we treat that as proof the address is yours: the password is removed and every phone signed in to that account is signed out. You can set a password again with a password reset.

We do not keep a name, a phone number, a postal address, a payment method, or anything about who you are beyond the email you chose. (Buying a Matchbox, or borrowing one from us, will need a name and an address for the delivery. This policy will say how we keep those before we ask for them.)

Password recovery works two ways. Where the service can send email, a code goes to your address. Everywhere — and on day one — the Matchbox you own is the other proof: pairing reads a secret code the Matchbox keeps (its claim code), and that code (proof you are standing at the wall) resets the password of the account that owns it. No email is needed for that path.

Deleting the account is in the app (Settings, then your Matchbox, or Account if none is paired, then Delete Account, with your password if the account has one), or write to us and we will do it. It removes the account, its sessions and its reset codes, ends its Sign in with Apple link with Apple where we hold Apple's key, releases the Matchbox it owned, and withdraws the settings the service held for that Matchbox. The account is gone from the service at once; its email address can stay in our server logs for up to 14 days and in our backups for about 35 days (see Backups below), and the Matchbox's own 30-day history runs out on its usual schedule. The Matchbox itself keeps playing on what it already has (its other settings until it restarts, and its club until it is factory-reset) until someone pairs it again; your email is free to reuse. The steps are also at https://matchbox.football/delete-account.

What the app touches, and why

The pairing connection, during setup. The app connects to your Matchbox directly, phone to Matchbox, for one job: finding it the first time and handing it your Wi-Fi network name and password so it can get online. That transfer goes straight from your phone to the Matchbox; your Wi-Fi credentials are never sent to us or to any server. The same connection reads the Matchbox's claim code (the proof of possession above). After setup the Matchbox is on its own and the app does not connect to it this way again unless you re-pair. The connection is never used to infer your location (the app declares this to the operating system).

Your display preferences. What you configure in the app — the club and teams you follow, which competitions play as ambience, display style, attention preset, brightness, spoiler delay, quiet hours, a pinned match, whether you have put the display to sleep, how much evening replay and how much other football you want, the matches you keep as great days, the word your household uses for the game (football or soccer), the name you give your Matchbox (if you give it one), the last time you asked it to identify itself or to send a report, and your Matchbox's time zone: a rule such as EST5EDT,M3.2.0,M11.1.0, so the Matchbox's clock follows daylight saving, and, once you have chosen it or your Matchbox already has one, the zone's name, such as America/New_York, which names a region of the world and its main city. All of it is sent to our message service, stored there against your Matchbox's device identifier, and echoed back to any phone signed in as you. Our own server also keeps a copy of it, so that a fault in the message service cannot lose it; the copy goes as soon as the settings are withdrawn (when the account is deleted, or the Matchbox is released or paired by someone else), and it is backed up like the account records (see Backups). This is the app's entire purpose. It says what football you like and which part of the world your Matchbox's clock is in; it carries no name and no address, unless you put one in the name you give your Matchbox.

While the app is open it also tells our service which club and teams you follow, so the service fetches those matches first. That is held in memory for as long as the app is connected and not stored, apart from a line in our server logs naming the club (see logs, below).

Our service's record of which club each Matchbox follows. So that it fetches each club's matches, our service keeps a list of Matchboxes by device identifier with the club each one follows, and forgets a Matchbox a few checks after its settings are gone. The list is part of our nightly backup (kept about 35 days, see Backups) and of a spare server we keep switched off for emergencies, which holds a copy from the last time it was prepared.

What the Matchbox reports. The Matchbox (not the phone) publishes two small operational records to the same service, keyed by the same device identifier:

• Now showing — which screen it has on the panel and why, so the app can mirror it honestly. It includes the settings the Matchbox is using, and a hash of the Matchbox's claim code, so the service can check the code your phone reads from the Matchbox without the Matchbox ever sending the code itself.
• Health — firmware version, which model of circuit board the Matchbox is built on, uptime, reason for its last restart, how many times it has started, Wi-Fi signal strength and channel number, free memory (now and the lowest it has been), connection counters, the coded reason its Wi-Fi or its connection to our service last dropped, which kind of screen it was showing, the state of any software update in progress, which of our update-signing keys its software trusts, and the oldest version of our software it will still accept. When the Matchbox's own software has crashed, the records after the restart also say where in that software it happened: the name of the part of the program that was running, and a list of locations inside the Matchbox's software that only mean something next to our copy of it. If it crashed while handling a message from our service, the records also say what kind of message that was (a match schedule, a club's season status, a match, its own settings, a replayed match, or a software update), how many times in a row it has crashed, whether it has started in a reduced mode that listens only for its own settings and for updates, and which kinds of message it is setting aside for a while because they crashed it more than once; for the public match schedules, which every Matchbox reads alike, it also says which one. It never says which club's status or which match it was, and these records go into the 30-day history below like every other. This exists so we can notice a broken update or a failing unit, and fix what caused it, before you have to. It never carries your network's name or address, your follows, your club, your quiet hours or your pinned match.

The message service keeps only the most recent of each. Our server also keeps a history of both for 30 days: every health record, and each change in what the Matchbox shows (with the settings it was using at the time), so that when you tell us something went wrong we can see what happened rather than guess. After 30 days the history is deleted. It holds nothing beyond the two records described above, the reports described below, and our own service's heartbeat (whether the football data was arriving, which says nothing about you). It is never backed up.

When your Matchbox keeps losing its Wi-Fi. From the now-showing records it already receives, our service also works out how often your Matchbox has lost its connection, so the app can tell you when that keeps happening. It does this in memory and remembers it for a day at most: it is not stored, logged or backed up, it is forgotten whenever the service restarts, and only phones signed in as you are told.

Software updates. The Matchbox checks for firmware updates through the same service and installs them itself. It holds an update while your club's match, or a match you have pinned, is on the wall, for up to four hours. Updates are signed; the Matchbox refuses an unsigned image.

Updates to the app. Besides the app stores, the app can receive updates to its own code from Expo, the service those updates are published through. Each time the app starts it asks Expo whether there is one. That request carries a random identifier the app created for itself when it was installed (it means "this installation" and nothing else, and we never link it to your account) and, like any request over the internet, your phone's IP address.

When you send us a report

If something goes wrong, Send a Report (in the app's Settings tab, and on the screen the app shows if it ever fails) puts together a report for us. Opening it asks your Matchbox, if it is online, for its own report (below), which reaches our service at once and is kept in the 30-day history. Everything else in the report stays on your phone until you send it, and the app shows you all of it first. You choose how it reaches us: the app hands it to your phone's share sheet, so it goes by your own email, or however you pick.

A report holds:

• the app's version and its update, your phone's operating system and version, and whether the app is signed in
• your Matchbox's device identifier and its name (the MBOX-… code on its label), never its claim code
• the app's own recent activity log: technical lines about connecting, pairing and settings, with your Wi-Fi network's name removed
• the error codes the app has shown recently, and, if the app crashed, where in its code that happened
• if you paired recently, the Matchbox's own record of that pairing attempt (the steps it took and how each ended — never your Wi-Fi name or password)
• if your Matchbox is online, its own report, which it sends to the app through our service when you open Send a Report: its recent restarts and why, recent network drops and why, software-update steps, messages it could not read, the matches and scores it last drew (up to eight) and when that data arrived, the spoiler delay it was using (so we can tell a late score from a wrong one), its recent decisions about what to show, and how fast it was drawing. Asking for it also turns on that drawing-speed record for ten minutes. Our server keeps a copy in the 30-day history above.

It never holds your Wi-Fi name or password, your account password, or your location. Your email address reaches us only because the report arrives by email, if you send it that way; mail to our address is forwarded by Namecheap to a mailbox Proton hosts for us. We use a report only to find and fix the problem, and keep it only as long as that takes. The same goes for what we look up while we work on it (your Matchbox's history and our logs about it): those copies are deleted when the problem is closed, and within 30 days at most.

The football data, and the memory register

Match data flows to the app and the Matchbox from a licensed sports data provider. Our service records the raw feed for the matches it follows — scores, events, ball positions, and the names, shirt numbers and match statistics of the players involved, as the provider publishes them — and keeps a finished match's recording so that, if you choose, your Matchbox can re-air your club's day in miniature that evening and on its anniversaries ("great days"). Which matches are kept longer is decided by what the Matchboxes following that club asked for. The recordings are stored with no fixed end date today, because they are also how we test Matchbox against real matches. They are about the football and the people who played it; they contain nothing about you or your household.

The website and its waitlist

The Matchbox website (matchbox.football) has no analytics, no advertising, no tracking pixels and no third-party scripts; its fonts and pictures come from our own server, and it sets no cookies.

The site calls the game "football" or "soccer" depending on where you are. To choose, our server looks up which country the address your request comes from belongs to, in a copy of DB-IP's free country database kept on that same server — the address is not sent anywhere else — and uses the answer for that one choice. Neither the address nor the country is kept or logged.

If you join the waitlist, we keep three things: your email address, the word the page used for the game (which says only whether you were somewhere that says "soccer", not where), and when you joined — not your IP address, not your browser. We use the address for one thing: to email you when Matchbox can be ordered. It is stored on our own server (Amazon Web Services, in the United States), backed up nightly with the account records (backups are kept about 35 days), and never sold or added to anyone else's list. To be taken off it, write to the address under Contact and we will delete it and confirm. Joining twice changes nothing, and the form never says whether an address was already on it.

The server uses the address a request comes from, in memory and briefly, to limit how fast anyone can submit the form; it is not kept.

Who else handles data

We do not sell or rent anything about you, and we do not share it for advertising. A few service providers handle data for us, only to run Matchbox, and only what each one needs:

• Amazon Web Services (AWS), in the United States, runs everything we keep: our servers, the message service the Matchbox and the app talk through, our backups, and the storage software updates are downloaded from.
• Expo delivers updates to the app's code, as described above.
• Namecheap, which registers our domain, forwards mail sent to our address, and Proton, in Switzerland, hosts the mailbox it reaches, including reports sent to us by email.
• ntfy.sh, a notification service, carries our own monitoring alerts to us: when a Matchbox stops reporting or reports a fault, the alert names it by its device identifier and says what our monitoring saw, and nothing else.
• Apple and Google, only if you sign in with them, as described under The account. The app stores deliver the app itself, under their own privacy policies.

The Matchbox also uses some public internet services directly, as most connected devices do: it looks up our service's address through Google Public DNS and Cloudflare's 1.1.1.1 (or your router's own, if those don't answer), and sets its clock from the public time servers of the NTP Pool project and the US National Institute of Standards and Technology (NIST). Those services see your home's public IP address and what the Matchbox asked them for; we send them nothing about you.

Nothing about you flows back to the sports data provider. Our servers, our backups and our mailbox are in the United States. We would also disclose information if the law required us to.

What we do not do

• No advertising, no advertising identifiers.
• No analytics or tracking SDKs in the app or on the website.
• Apart from its update check to Expo (above), the app sends nothing on its own: no usage statistics, no crash reports. It sends our service only what it needs to work: your settings when you change them (and the time zone again when your phone's changes), your follows while it is open, and a report only when you send one.
• No location collection of any kind. (The website's country lookup, above, picks a word for the game and is not kept.)
• No access to contacts, photos, camera, or microphone.
• No sale of any data, to anyone.

Identifiers, logs and retention

The Matchbox's device identifier is assigned to the hardware, not to you. An account links it to your email until you delete the account or claim a different Matchbox. A factory reset on the Matchbox does not break that link: to release a Matchbox, open Settings in the app, tap your Matchbox, then Remove This Matchbox; or delete your account in the app; or write to us and we will release it. Retained messages are overwritten in place by the next message. Apart from the list of which club each Matchbox follows (above), the 30-day history of them is the only copy kept.

Operational server logs are kept for 14 days for debugging, then deleted. They contain the device-scoped records described above; for the account service, the email address of an account when it signs up or signs in (with a password, Apple or Google), claims or releases a Matchbox, changes or resets its password (by email or with its Matchbox), signs out everywhere, or is deleted, and the settings the app sends. When a request to our service fails, our web server's error log records the IP address it came from, the page asked for and the request's headers. The account service itself uses the IP address a request comes from only in memory and briefly, to limit how fast anyone can try passwords or claim Matchboxes, and never logs it. The message service's own connection logs (Amazon Web Services IoT) can hold the public IP address of your home network when the Matchbox connects; they are deleted after 14 days too.

Backups. Account records are backed up nightly so a server failure does not lose your account, and each backup is kept for about 35 days, then deleted. A backup holds the same account records described above: your email address, the hash of your password if you have one, your sessions (as hashes), the Matchbox you own and its settings, the waitlist, and — for an account that signs in with Apple or Google — the Apple or Google account identifier and, where we keep it, Apple's token. So anything you delete is gone from the service at once, from our logs within 14 days and from every backup after about 35 days. A spare server we keep switched off for emergencies holds a copy of the same records from the last time it was prepared; we prepare it again at least every 30 days, so what you delete leaves it within about 35 days as well. If we cannot end the Apple link at once, we keep the means to end it, sealed, for up to 35 days, and our backups keep it up to 35 days more. The list of which club each Matchbox follows is backed up the same way.

A factory reset on the Matchbox (hold both buttons through a power-on) makes it forget your Wi-Fi credentials, the phones it was paired with, its cached season and its claim code, and makes a new claim code. It erases them from the Matchbox's settings, but someone with tools to read its memory chip directly could still recover your old Wi-Fi password, so change that password if it matters to you. Before giving a Matchbox away, factory-reset it and remove it in the app (Settings, your Matchbox, then Remove This Matchbox), or ask us to release it.

Why we use it

We use what is described here to provide the service you asked for (your account, and your Matchbox showing the football you chose), to keep that service working and secure (the health records, history, logs and backups), and, only if you join the waitlist, to email you when Matchbox can be ordered.

Your choices

You can change or remove your settings in the app at any time, sign out, or delete your account (above). Write to us at the address under Contact and we will tell you what we hold for your account and your Matchbox, send you a copy, correct it, or delete it. If you live somewhere a data-protection authority oversees how your information is handled, you can also complain to it.

Children

Matchbox is not directed at children. You must be at least 13 to create an account; in the European Union, the minimum is the age your country sets for this, between 13 and 16, and in the United Kingdom it is 13. Do not create an account for a child under that age. If you believe one has an account, write to us and we will delete it.

Do Not Track

Matchbox does not track you across websites or apps, so there is nothing for a browser's Do Not Track signal to switch off. The website treats every visitor the same whether or not it sends one.

Changes

If the app, the Matchbox or the service ever starts carrying more than what is listed here, this policy will say so before that version ships. Each version carries its effective date at the top of this page.

Contact

Tethered Solutions LLC. Questions about this policy, or about what we hold for your account: support@matchbox.football. Ask for your account to be deleted there if you would rather not do it in the app, and we will confirm when it is done.