1. Who We Are

Own The League is operated by Own The League LTD, which is the data controller responsible for your personal information under UK data protection law. If you have any questions about this policy, or wish to exercise any of the rights described below, you can reach us through the contact form at owntheleague.co.uk/contact.

2. Information We Collect

We collect information you give us directly, and a limited amount of technical information collected automatically when you use the Service.

Account information: your name, email address and the account identifier we generate for you. Used to operate your account and your participation in leagues.
League activity: the leagues you belong to, your predictions and selections, and your scores. This is the core of what the Service does.
Usage analytics (Google Analytics): how the Service is used — pages viewed and features used. This is not linked to your account, and on the website it is only collected if you consent (see our Cookie Policy).
Usage analytics (PostHog): pages viewed and a small number of specific actions — signing up, creating or joining a league, submitting picks. Once you are signed in, this is linked to your account identifier, so we can tell how many people use the Service and whether they come back. We do not send PostHog your name or your email address; the identifier is a random code that only means something inside our own systems. On the website this is only collected if you consent (see our Cookie Policy).
Diagnostics: crash reports and performance data, collected through Sentry so we can find and fix faults. This is not linked to your account.
Push notification tokens: if you turn on push notifications, a device token issued by Firebase Cloud Messaging so we can deliver them. Turning notifications off removes it.
Technical information: IP address, device type and operating system version, collected automatically as part of serving and securing the Service.

3. How We Use Your Information, and Our Lawful Bases

We only use your information where the law allows. The lawful basis depends on what we are doing:

To manage your account and your league participation — necessary to perform our contract with you.
To send service emails (announcements, results, league updates and selection reminders) — our legitimate interest in operating the Service and providing the features you signed up for.
To send marketing emails — only with your consent, which you can withdraw at any time.
To send push notifications — only with your consent, given when you enable them on your device.
To collect usage analytics through Google Analytics and PostHog — your consent on the website; in our mobile apps analytics are on by default and can be switched off at any time (see our Cookie Policy). One choice governs both providers.
To diagnose crashes and monitor performance — our legitimate interest in keeping the Service working.
To send security alerts and administrative messages, prevent fraud and ensure fair play — our legitimate interest in protecting the Service and its users.

4. Data Sharing and Disclosure

We do not sell your personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf, under contract and only on our instructions:

Supabase — database, authentication and file storage.
Vercel — application hosting and content delivery.
Resend — sending service and marketing email.
Sentry — crash reporting and performance monitoring.
Google Analytics — usage analytics. We do not use it for advertising.
PostHog — product analytics, hosted in the European Union. We do not use it for advertising, and we have session recording switched off.
Firebase Cloud Messaging (Google) — delivering push notifications.
We may also disclose information where we are required to by law, or where we need to protect the rights, property or safety of Own The League or others.

5. Data Storage and Security

Your data is stored securely using industry-standard encryption. We use Supabase for database services, which implements strict security protocols.

We implement standard access controls.
Data is encrypted at rest and in transit.

6. International Data Transfers

Some of our service providers are based outside the United Kingdom, which means your information may be transferred to and processed in other countries, including the United States. Where that happens we rely on appropriate safeguards recognised under UK data protection law — such as UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or a finding of adequacy — so that your information continues to be protected.

7. Data Retention

We keep your information only for as long as we need it:

Account information and league activity: for as long as your account is open. If you delete your account, this data is deleted or anonymised.
Records of email consent and unsubscribe requests: retained after account deletion, because we need them to honour your opt-out and to demonstrate we did.
Diagnostics (crash and performance data): retained for a limited period by our monitoring provider and then deleted automatically.
Usage analytics (Google Analytics): retained according to our Google Analytics retention settings, in aggregate and not linked to your account.
Usage analytics (PostHog): retained according to our PostHog retention settings. If you delete your account, ask us and we will delete the analytics profile held against your account identifier.

8. Your Rights

Under UK data protection law you have the following rights over your personal information. To exercise any of them, contact us through owntheleague.co.uk/contact — we will respond within one month.

Access — obtain a copy of the personal information we hold about you.
Rectification — have inaccurate information corrected.
Erasure — have your personal information deleted. You can do this yourself at any time: go to Account → Delete account, which deletes your account and associated data from within the app.
Restriction — ask us to limit how we use your information.
Objection — object to processing carried out on the basis of our legitimate interests.
Portability — receive the information you gave us in a portable format.
Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting anything done beforehand.
Complain — if you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk. We would ask that you contact us first so we have the chance to put things right.

9. Children's Privacy

Our Service is not intended for anyone under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

10. Cookies

We use cookies and similar technologies to keep you signed in, remember your choices and — only with your consent — understand how the Service is used. Please refer to our Cookie Policy for full details, including how to change your analytics choice at any time.

11. Email Communications & Your Choices

We send two kinds of email. Service (transactional) emails relate to your account and participation — for example announcements, results, league updates and selection reminders — and are sent on the basis of our legitimate interest in operating the Service and providing the features you signed up for. Marketing emails (news, offers and promotions) are only ever sent if you have opted in, and we record the date of that consent. You remain in control of all email at any time:

Service emails are enabled by default for registered users; marketing emails are off by default and require a separate opt-in.
You can turn any email category on or off at any time under Account → Notification Settings.
Every email includes an unsubscribe link in its footer, including one-click unsubscribe supported by your mail provider.
Unsubscribing from email does not affect your in-app notifications, and you can re-enable any category later.
We only send email through our email provider (Resend) and never sell your email address.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date shown at the top of this page, and where the change is significant we will tell you through the Service or by email.