Privacy notice

Past the Post is run by Ash Duffy, who is the data controller for the information described here. For anything on this page — a question, a correction, a copy of your data, or a complaint — email ashleyduffy8@gmail.com.

Everything below is tied to your account.

• Your email address. Used to sign you in and, rarely, to contact you about the league. If you sign in with Google we receive your email address from Google — we do not receive your Google password.
• Your display name. Chosen by you, shown next to your picks so other players know whose they are.
• A phone number, only if you were added from the original spreadsheet before the app existed. You can ask for it to be removed at any time.
• Your picks, predictions and results — every selection you make, what it returned, and your position on each leaderboard. This is the app.
• Notification settings. If you turn on push notifications we store the address your browser gives us for your device, the keys needed to send to it, and which browser it is. Turning notifications off deletes this.
• Small preferences — your racing silk colours, any runners you have noted to watch, and per-competition settings.
• Finlay's Fun Room play. If you play the casino games, your rounds and virtual balance. Virtual chips only — there is no real money anywhere in this app.
• Admin actions, if you are a league admin. Changes to results, picks and participation are logged with who made them, so corrections can be traced.

There is no analytics, no tracking, no advertising and no profiling in this app. We do not sell or share your data with anyone for marketing, because we do not do any marketing. There are no cookies beyond the one that keeps you signed in.

For everything needed to run the league — your account, your picks, the leaderboards — our lawful basis is legitimate interests: you asked to join a competition and it cannot work without recording who picked what.

For push notifications, the basis is consent. You turn them on, and you can turn them off whenever you like without affecting anything else.

Other players in your league can see your display name, your picks once they have locked, and your results. That is the point of a league. Nobody outside your league sees any of it.

We use a small number of companies to actually run the app. They process data on our instructions and nothing more:

• Supabase — the database and sign-in system. Hosted in Ireland (EU).
• Vercel — hosting. The app's server code runs in Dublin (EU).
• Sentry — collects error reports when something breaks, so it can be fixed. Hosted in Germany (EU).
• Google — only if you choose to sign in with a Google account.
• Your browser's notification service (Apple, Google or Mozilla, depending on your device) — only if you turn push notifications on.

Your account and its data are kept for as long as you have an account. Competition results are kept indefinitely — the lifetime leaderboard reaches back through every festival the league has played, and that history is the point of it.

If you delete your account, see the next section for exactly what goes and what stays.

You can do the first two yourself, right now, from your profile:

• Get a copy of your data. Your profile has a Download button that gives you everything we hold about you as a file.
• Delete your account. Also on your profile. Your name, email, phone, sign-in, notifications, settings and Fun Room history are permanently removed.

One honest caveat on deletion. Your past results stay on the leaderboards, shown as Former player and no longer connected to you or to any way of identifying you. We do this because removing them outright would change other players' finishing positions in races that were settled long ago — it would rewrite their history to erase yours. If you would rather those rows were destroyed entirely, email and ask; we will talk it through.

You also have the right to:

• Correct anything wrong. You can edit your display name yourself; email for anything else.
• Object to how we use your data, or ask us to restrict it while a question is resolved.
• Complain to the Information Commissioner's Office at ico.org.uk if you think we have handled your data badly. We would rather you told us first so we can fix it.

If this changes in a way that matters, we will say so in the app rather than quietly editing the page. The date at the top always reflects the current version.