Privacy Policy

What we collect

• Account details: your name, email address, and password (stored as a one-way hash, never in plain text).
• Game data: the predictions, league memberships, boosts, achievements, and customisation choices you make while using the site.
• Payment data: if you choose to support the site, Stripe processes your card details directly. We never see or store your full card number, but we keep a record of the purchase (tier, amount, date) against your account.
• Technical data: basic request data (such as IP address and browser type) is captured automatically by our error-monitoring tool when something goes wrong, so we can fix it.
• Analytics: if you accept our cookie banner, Google Analytics collects anonymised usage data (pages visited, general location, device type) to help us understand how the site is used. If you decline, none of this is collected.

Why we collect it

• To create and run your account, and to operate the game (leagues, predictions, scoring), because it's necessary to provide the service you've signed up for.
• To send you account emails, such as verification, password resets, and league invitations, because it's necessary to provide the service (prediction reminders are sent only if you opt in, and you can turn them off at any time).
• To process supporter payments and unlock the features you paid for, because it's necessary to fulfil that purchase.
• To diagnose and fix bugs, which is in our legitimate interest in keeping the site working properly.
• With your consent, to understand overall site usage and improve it.

Who we share it with

We use a small number of third-party services to run the site, each of which processes data on our behalf:

• Mailgun: sends account and league emails on our behalf.
• Stripe: processes supporter payments. Stripe's own privacy policy covers how they handle your payment details.
• Sentry: error monitoring, so we can see and fix crashes.
• Google Analytics: usage analytics, only if you accept our cookie banner.

We do not sell your data, and we do not share it with anyone for their own marketing purposes.

International transfers

Some of these providers, including Stripe, Sentry, and Google Analytics, are based outside the UK, mainly in the United States, and may process your data there. Where that happens, they do so under a recognised legal safeguard, such as an approved UK data transfer mechanism or standard contractual clauses.

Security

We take reasonable technical and organisational steps to protect your data, including hashing passwords and serving the site over HTTPS. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

Cookies

We use a small number of strictly necessary cookies to keep you logged in and to protect the site against cross-site request forgery. These can't be switched off, as the site can't function without them. We only set analytics cookies (Google Analytics) if you accept them via the cookie banner. You can decline, and can change your mind at any time by clearing your browser's site data for this domain.

How long we keep it

We keep your account data for as long as your account exists. You can delete your account at any time from your profile settings, which permanently removes your personal data from our systems (records we're legally required to keep, such as payment records for tax purposes, are retained only as long as the law requires).

Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (most of this you can edit yourself in your profile).
• Delete your account and personal data.
• Object to or restrict certain processing, including analytics.
• Withdraw consent at any time, wherever we rely on it (for example, analytics cookies).
• Request a copy of your data in a portable format.

To exercise any of these rights, email [email protected]. If you're unhappy with how we've handled your data, you can also complain to the UK Information Commissioner's Office (ico.org.uk).

Children

Bake Off Fantasy is not directed at children, and we ask that you only register an account if you are 13 or older.

Changes to this policy

If we make significant changes to this policy, we'll update the date at the top of this page. Continued use of the site after a change means you accept the updated policy.