Privacy Policy

90 SQUARES PRIVACY POLICY This policy explains what personal data 90 Squares (90squares.com) collects, why, and what your rights are. It applies to everyone who visits the site or creates an account. 1. WHO WE ARE 90 Squares is a free prediction game for Premier League matches. We are the controller of the personal data described here, which means we decide how and why it is used. You can contact us about anything in this policy using the contact form on the site. 2. WHAT DATA WE COLLECT Account data: your email address, and the display name you choose. If you sign in with Google, we also receive basic profile data from Google (your name, email address and profile picture, depending on what your Google account shares). Game data: the boards you create or join, your role on each board, the display name you use on it, the minutes you claim, and the points you earn. Terms acceptance record: your user ID, the version of the terms you accepted and the time you accepted them. Messages you send us: anything you put in the contact form, including your email address. Technical data: your IP address and device and browser information, which our hosting providers and our bot-protection service (Cloudflare Turnstile) process when you visit the site or sign up or sign in, and in server logs kept for security and reliability. Cookies: we use cookies that keep you signed in. See section 9. We do not collect payment card details through the game, and we do not knowingly collect special category data (such as health data or data revealing political opinions). 3. WHY WE USE IT, AND OUR LEGAL BASIS Under UK GDPR we must have a legal basis for using your data. Ours are: To create and run your account, let you sign in, run boards and calculate points: this is necessary to provide the service you asked for (contract). To keep the service secure, prevent abuse and automated sign-ups, fix faults and keep records of consent: this is our legitimate interest in running a safe and reliable service. We keep the terms acceptance record because we need it to show that consent was given. To reply to your messages and requests, including data requests: our legitimate interest in answering you, and our legal obligations where a request concerns your rights. To meet legal obligations that apply to us. We do not sell your personal data. We do not use it for advertising or profiling, and we do not make decisions about you by automated means that have legal or similarly significant effects. 4. WHO WE SHARE IT WITH We use these providers to run the service. They process data for us on our instructions: Supabase: database, authentication and file storage. Vercel: website hosting. Cloudflare: bot protection (Turnstile) and related network services. Our email provider: sends sign-in emails and replies. It processes your email address and the content of those messages. Google: if you choose to sign in with Google, Google receives sign-in information under its own privacy policy. Other members of a board you belong to can see your display name, your claims and your points on that board. Boards are visible only to their members. We may also disclose data if the law requires it, or to protect our rights or the safety of others. 5. HOW LONG WE KEEP IT We keep your account and game data while your account is active. When you ask us to delete your account and data and we have verified the request, we delete it within one month, except for what we must or may lawfully keep. The terms acceptance record is the main exception: we keep it after deletion because we need it to show that consent was given. Messages sent through the contact form are kept for as long as needed to deal with them and for a reasonable period afterwards. Server and security logs are kept by our hosting providers for as long as their own settings provide and are not kept by us for longer. 6. WHERE YOUR DATA IS PROCESSED 90 Squares is developed and hosted in the United States, so your data is stored and processed there, and in other countries where our providers operate. We use providers that commit to appropriate safeguards for personal data, such as data processing agreements and standard contractual clauses (including the UK addendum where it applies), and, where a provider is certified, the UK-US data bridge. The protections described in this policy apply wherever your data is processed. 7. YOUR RIGHTS Under UK GDPR you have the right to: Be told how your data is used (this policy). Access the personal data we hold about you. Have inaccurate data corrected. Have your data deleted, in certain circumstances. Restrict how we use your data, in certain circumstances. Object to us using your data on the basis of our legitimate interests. Receive your data in a portable format, where the data was provided by you and is processed by automated means on the basis of a contract. Withdraw consent at any time, where we rely on consent. To use any of these rights, send us a request through the contact form. We may need to verify your identity first, and we will respond within one month. If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority where you live or work. 8. HOW TO DELETE YOUR ACCOUNT AND DATA There is no self-service deletion for now. Use the contact form on the site, choose the reason for deleting your account and data, and send it from the email address on your account if you can. We verify the request and complete it within one month. Requests that reach us by other channels, such as email, are also honoured. See section 5 for what we keep. 9. COOKIES We use only cookies that are strictly necessary to run the service: they keep you signed in and keep your session secure. Our bot-protection service may also set or read technical data for the same security purpose. We do not use advertising or tracking cookies. These cookies do not need your consent, but you can block them in your browser settings, in which case you will not be able to sign in. 10. CHILDREN You must be at least 16 years old to create an account or use 90 Squares. We do not knowingly collect data from anyone under 16, and if we learn that we have, we will delete it and close the account. We know that users aged 16 and 17 are still children under the ICO Children's Code, so we design the service with them in mind: we collect only the data we need, we default to the most private settings (boards are visible only to their members and there is no public profile), and we do not use nudging or other techniques to encourage young users to share more data or stay longer. 11. CHANGES TO THIS POLICY We may update this policy from time to time. The latest version is always on this page. If we make significant changes, we will take reasonable steps to tell you, for example with a notice on the site. 12. CONTACT Questions about this policy or your data: use the contact form on 90squares.com.