PRIVACY POLICY

• Account details — your email and name. If you sign up with a password it is stored hashed (we never see it); if you sign in with Google we receive your name, email and profile picture.
• Pools you host— the pool name and the contestant names and photos you enter. If those contestants are other people, see “If you host a pool” below.
• Participation— which entry you've claimed as “you”, the pools you follow and the emoji reactions you add to matches.
• Photos— any image you upload. Uploaded photos are stored publicly: anyone with the link or the pool's access code can view them.
• Technical data — your IP address is read briefly to rate-limit sign-in and sign-up (anti-abuse) and is not stored. We use essential cookies to keep you signed in and, with your consent, advertising cookies — see Advertising and cookies below.
• Push notifications— if you turn on match alerts, your browser's push subscription is stored so we can send them.

• Running your account and pools (creating pools, the draw, standings, leaderboards, claims, follows, reactions) — our legitimate interests in providing the service you asked for.
• Security and abuse prevention (rate-limiting, hashed passwords) — our legitimate interests in keeping the service safe.
• The weekly digest email — a Monday summary of standings for pools you host, follow or have an entry in. We rely on legitimate interests(it's a service update about pools you're in), and you can turn it off at any time on your account page or via the unsubscribe link in any email.
• Match alerts (push) — your consent, given through your browser's notification prompt. You can withdraw it any time in the app or your browser.
• Advertising — we show ads from Google to keep Sports Sweepstakes free. Personalised ads and the cookies behind them run only with your consent, which you give or decline through the consent banner and can change at any time — see Advertising and cookies.

We do not sell your data, and we make no automated decisions that have legal or similarly significant effects on you.

When you first visit we show a consent banner. If you don't consent, you'll still see ads, but they'll be non-personalised — chosen from general context rather than any profile. You can change or withdraw your choice at any time from the Cookie settings link in the footer.

Google may process this data as an independent controller. To understand how it uses data from sites that show its ads, see Google's advertising and partner-sites notice. For the full list of cookies we and our partner use, see our cookies policy.

• Render — application hosting.
• Cloudflare R2 — photo storage.
• Database hosting — stores your account and pool data, kept within the UK/EU.
• Google — “Sign in with Google”, if you use it.
• Google AdSense — serves the advertising that funds the service and, with your consent, personalises it. For some advertising data Google acts as an independent controller under its own privacy policy.
• Resend — sends the weekly digest email.
• Browser push services (e.g. Google, Apple, Mozilla) — deliver match alerts if you enable them.
• football-data.org — provides match scores and fixtures. It receives no personal data.

Some of these providers are based outside the UK (e.g. in the US). Where data is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or an adequacy decision, as offered by each provider.

• Your account and its data — until you delete your account.
• Pools and contestants — until the host deletes the pool or their account.
• Uploaded photos — deleted when the entry or pool they belong to is deleted.
• Push subscriptions — until you turn alerts off or your browser endpoint expires.
• IP addresses — held momentarily in memory for rate-limiting; never stored.

We may remove accounts and pools that have been dormant for a long time.