Privacy policy

Who we are

KickChance, at kickchance.com, is run by [legal name and address to be added]. Contact for anything in this policy: hello@kickchance.com.

What we collect

• Without an account: nothing that identifies you. Your slip is kept in your own browser and never sent to us. To stop abuse, we count requests per visitor using a one-way, salted hash of your internet address; we do not store the address itself, and the counts expire within an hour.
• With an account: your name, email address, country, a password (stored only as a one-way hash, never in a form we can read), your confirmation that you are 18 or over and when you gave it, whether your email address is confirmed, your saved picks and slips, your saved filters, and your current slip. If you sign in with Google, we receive your name, email address and Google account identifier.
• Sign-in sessions: a session record (when it started and ends, and your browser type). We do not keep your internet address with it.
• Messages you send us: if you email us, your address and what you write.

Why we use it, and the lawful basis

• To provide your account and its features (performance of a contract).
• To keep the site secure and working, including rate limits (legitimate interests, and under the NDPA, legitimate interest).
• To send account emails: confirming your email address (with reminders on day 7 and day 25 while it is unconfirmed), a password reset, or confirming a new address (performance of a contract). Anything beyond these goes only to confirmed addresses.
• To check that account holders are 18 or over (legal obligation and legitimate interests).
• To answer messages you send us (legitimate interests).

We do not sell your data, use it for profiling, or send marketing.

Counting visits (analytics)

We count how the site is used, and how fast its pages load, with Vercel Web Analytics and Speed Insights. Vercel hosts the site, and both are served from this site itself, not by a third-party tracker. They load only after the page has finished loading.

• No cookies, and nothing is stored on your device to recognise you. You are not followed across other websites.
• What is recorded: the page visited (never anything after a "?" in the address), the site you came from, your country, the kind of device, browser and operating system, and how long the page took to load.
• Actions we count: adding a pick to the slip or removing one, copying or sharing a slip, using a filter (and which filter), creating an account, and saving a pick. Only the name of the action is sent, never your email address, your account or the picks you chose.
• Vercel tells visits apart with a code made from the request that changes every day; it cannot be linked to you or your account.
• Why: to see which features help and to keep pages quick on slower connections (legitimate interests).

Cookies and storage on your device

We use only the cookies needed to keep you signed in. None is used for advertising or tracking, so we do not ask for consent for them. If we ever add advertising or any other cookie that is not strictly needed, we will ask first, and refusing will be as easy as accepting.

• better-auth.session_token (cookie): keeps you signed in. Lasts 7 days, renewed while you use the site; removed when you sign out.
• better-auth.session_data (cookie): a short-lived copy of your session so each page doesn't have to ask the database. Lasts 5 minutes.
• better-auth.two_factor and better-auth.trust_device (cookies, admin accounts only): the second step of signing in, and a device trusted for up to 30 days.
• fa_session (cookie, until the site opens to the public): proves you entered the site's preview password. Lasts 30 days.

On secure connections the browser shows these cookie names with "__Secure-" in front.

Your browser also keeps a few things for the site in its own storage, which never leave your device: your slip, your last filters, the colour theme you chose, your answer to any cookie question, and, for this visit only, whether the slip panel and the "Earlier today" section were open. You can clear them at any time in your browser settings.

Who processes it for us

• Vercel: hosts the site and runs the analytics above.
• Supabase: our database, in the United States (Amazon Web Services, North Virginia).
• Upstash: request counts and short-lived working data.
• Resend: sends our account emails, from the European Union (Ireland).
• Cloudflare: runs our domain's name service and forwards email sent to hello@kickchance.com to our mailbox.
• Google: only if you choose to sign in with Google.
• Groq and Cloudflare Workers AI, when AI match summaries are switched on: they receive football statistics only, never personal data.

All are service providers acting on our instructions. Some process data outside the UK and Nigeria, including in the United States. Where they do, we rely on the UK International Data Transfer Agreement or Addendum, or other safeguards recognised under UK GDPR, and on the cross-border transfer provisions of the NDPA.

Football data sources

The picks are built from public football statistics and bookmaker prices. After our data change-over these come from API-Football (api-sports.io): Data provided by API-SPORTS. Before then they come from SoccerPunter, football-data.co.uk and WorldSoccerData, with team badges from FotMob. These sources contain no personal data about you.

How long we keep it

• Account data, saved picks, slips and filters: until you delete your account.
• Accounts whose email address is never confirmed: deleted automatically, with everything saved in them, 30 days after sign-up.
• Sign-in sessions: 7 days after you last use the site, or until you sign out.
• Hashed request counts: about an hour.
• The note that a confirmation reminder was sent (your account's identifier only): 40 days.
• Records of the emails we sent you: kept by Resend for [Resend log period to be confirmed].
• Messages you send us: as long as we need to answer them, then deleted within [period to be confirmed].
• Analytics: counts with nothing that identifies you, kept by Vercel under its own policy.
• Admin actions (for admin accounts only): a record of each action, with the admin account's identifier, kept permanently so the site's record can be checked.

Deleting your account

You can delete your account at any time from Account settings. It removes straight away your account, your sign-in sessions, your saved picks, slips and filters, and your current slip. The slip kept in your browser stays until you clear it. Copies in our database backups are overwritten within [backup period to be confirmed]. Records of emails already sent stay with Resend until they expire (see above).

Your rights

You can ask to see, correct, delete or move your data, object to or restrict how we use it, and withdraw any consent. Under the NDPA you also have the right not to be subject to decisions based only on automated processing; we make none about you. To use any right, email hello@kickchance.com; we reply within one month.

You can complain to the Information Commissioner's Office in the UK (ico.org.uk) or the Nigeria Data Protection Commission (ndpc.gov.ng).

Age

The site is for people aged 18 and over. We do not knowingly hold data about anyone younger, and delete it if we find it.

Changes

We will post any change here with its date. Last updated: [date to be added on approval].