Privacy Policy - The Matchday

1. Who is responsible for your data

The Matchday is operated by Saahil Lakhani as an individual data controller for the purposes of the UK GDPR and the Data Protection Act 2018. Contact: noreply@thematchday.co.uk.

2. What we collect

Email address - to sign you in via a one-time code.
Display name - what other players see on the league table.
Predictions and league activity - the scores you predict, which league you joined, and your results.
Push notification subscription - only if you opt in to push notifications.
Basic technical data - standard server logs (IP address, timestamps, browser) for security and debugging.

We do not collect payment card details. Voluntary donations are handled by a third-party payment provider (e.g. Stripe), which has its own privacy policy.

3. Why we use it

To let you sign in and use the service (legitimate interest, contract).
To show your picks, scores, and league position to other members of your league (legitimate interest).
To send you push notifications if you opt in (consent).
To keep the service secure and debug problems (legitimate interest).

4. Where it is stored

Account and game data are stored in Supabase (Postgres) hosted in the EU. Hosting and edge functions run on Vercel. Transactional emails are sent via Resend. Each of these providers is bound by its own data-processing terms.

5. Who can see your data

Your display name, predictions, and scores are visible to other members of the same private league. Your email address is not visible to other players. We do not sell your data to anyone.

6. How long we keep it

We keep your account and league data while your account exists. If you ask us to delete your account, we will remove your personal data within 30 days, except where we have to keep limited records to comply with legal obligations.

7. Your rights

Under UK GDPR you have the right to:

access a copy of your personal data;
correct data that is inaccurate;
ask for your data to be deleted;
object to or restrict certain processing;
withdraw consent to push notifications at any time;
complain to the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights email noreply@thematchday.co.uk.

8. Cookies

The Matchday uses only essential cookies needed to keep you signed in. No advertising or analytics cookies are set.

9. Changes to this policy

We may update this policy. If we make material changes we will show a notice in the app.