Privacy & Cookies Policy

This policy explains how Twenty Places uses personal data when you create an account and use the football prediction game. Twenty Places is currently operated as an independent beta service. Privacy questions can be sent to joshsegeth@hotmail.co.uk.

We collect only information needed to run the game and protect accounts. This can include your email address, display name, account identifier, Premier League prediction, Cup Calls, prediction lock status, mini-league memberships, score history and account settings.

Our infrastructure providers may also process normal technical and security information such as IP address, browser/device information, request logs and bot-detection signals when you use the site.

We use personal data to create and secure accounts, save predictions, calculate and display scores, operate mini-leagues, prevent copying or abuse, provide password and email-confirmation features, diagnose technical problems, protect the service and respond to privacy or support requests.

We process account and gameplay information because it is necessary to provide the service you ask us to use. We also have legitimate interests in keeping the game secure, preventing abuse, maintaining reliable records and improving the beta service, provided those interests do not override your rights. Where consent is legally required for any future optional processing, we will ask for it separately.

Your email address is not shown to other players. Your display name, locked prediction, Cup Calls and score information may be visible to people who share a mini-league with you, subject to the game's lock/reveal rules. We do not currently provide public profiles, direct messaging or precise-location features.

Twenty Places currently relies on:

• Supabase for authentication and database services.
• Vercel for hosting and delivery of the web application.
• Cloudflare Turnstile for bot and abuse protection on authentication flows.

These providers may process data in countries outside the UK. Where relevant, they are responsible for using appropriate safeguards for international transfers under their own data-processing terms.

Twenty Places currently uses browser storage, cookies or similar technologies that are necessary for authentication, session security and core operation of the service, together with security technology used by Cloudflare Turnstile. We do not currently use advertising cookies or behavioural advertising.

If we later add non-essential analytics, advertising or other optional tracking that requires consent, we will update this policy and add an appropriate consent mechanism before using it.

We retain account and gameplay data while your account remains active and for as long as reasonably necessary to operate the current season, maintain league history, protect the service or meet legal obligations. If you delete your account, associated account data is deleted from the live service, subject to limited data that infrastructure providers may retain temporarily in backups, security logs or records required by law.

You can delete your Twenty Places account from Account settings. Depending on the circumstances, UK data-protection law may also give you rights to access, correct, erase, restrict or object to use of your personal data, and to receive certain data in a portable format.

To exercise a privacy right, email joshsegeth@hotmail.co.uk. You also have the right to complain to the UK Information Commissioner's Office if you believe your data-protection rights have been infringed.

Accounts are intended for users aged 13 or over. Twenty Places is designed to minimise personal-data collection and uses privacy-protective defaults: no public email addresses, no profile photos, no direct messaging, no precise location, and no behavioural advertising. Users under 18 should involve a parent or guardian if they are unsure about these terms or how their information is used.

We use measures including email confirmation, password rules, Cloudflare Turnstile, access controls and database row-level security. No internet service can guarantee absolute security, so please use a unique password and contact us if you suspect account misuse.

We may update this policy when the service or its providers change. The latest version will remain available here and the “Last updated” date will be changed when appropriate.

Privacy and data-protection questions can be sent to joshsegeth@hotmail.co.uk. See also our Terms of Use.