Privacy

What Standing holds

• Your email address

  Needed to sign you in and to send you a deadline reminder. It is held by Supabase, the service that runs the sign-in and the database.

• What Google tells us, if you sign in with Google

  Your email address, your name and your profile picture. Standing asks for nothing beyond that — no contacts, no calendar, no access to anything in your Google account. If you would rather not, sign in with an email link instead.

• The display name you choose

  Whatever you type. It is the name other players in your cup see, so choose something you are happy for them to see.

• How you played

  The cups you are in, the teams you picked each round, the wildcards you used, whether you survived, and whether an organiser has marked you as having paid into the pot.

• Whether you want round emails

  A single on or off switch. Sign-in emails ignore it, because that is how you get back in.

• A scrambled version of your address, briefly

  When you open an invite link before signing up, Standing stores a one-way scramble of the address you then sign up with, so the invite still works if you finish on a different phone. It cannot be turned back into your address, and it deletes itself after a short time.

• A note of the emails sent to you

  Which round email went to you and when, so the same one is never sent twice.

What Standing does not hold

• •No card details, bank details or payment information of any kind. Organisers collect and pay out the pot themselves, off the site.
• •No analytics, no advertising trackers, no third-party scripts watching what you do.
• •No location, no contacts, no address book, no phone number.
• •Nothing is ever sold, rented or handed to an advertiser.

Why it is allowed to hold it

Most of it because you asked to play — you cannot be in a cup without a record of your picks, and the game cannot work without it. The deadline reminders are on because a competition where people forget to pick stops being fun by round four, and they are one switch away from off. That is it; there is no other purpose hiding behind these.

Who else handles it

Four companies, each doing one job, none of them allowed to use your data for anything of their own.

• Supabase

  Runs the database and the sign-in.

• Vercel

  Serves the site to your browser.

• Resend

  Sends the emails.

• Google

  Only if you choose to sign in with Google, and only to confirm it is you.

Nobody else. Not an advertiser, not a data broker, not a football data company.

Where it is kept

The database is hosted in London. The companies above may move some of it — an email in transit, a page being served — through servers elsewhere, under the standard protections their contracts require.

Cookies

Only the ones that keep you signed in. There is no cookie banner because there is nothing to ask you about: no advertising cookies, no analytics cookies, nothing that follows you off the site. Clear them and you are signed out.

How long it is kept

While you have an account. Delete your profile and your account, your picks and your entries go with it. Two things outlive it briefly and on purpose: the scrambled invite record, which expires on its own within days, and the note of which emails were sent, which is what stops a duplicate.

What you can ask for

The law gives you rights over your data, and none of them need a solicitor to use. You can:

• •Delete everything. There is a delete option on your profile — it removes you from every cup, hands your cups to somebody else, and deletes cups nobody else is in.
• •Ask for a copy of what is held about you.
• •Ask for something wrong to be corrected — a display name is editable already.
• •Turn the round emails off, from your profile or from the link at the bottom of any of them.
• •Object to something, and get an answer from a person rather than a form.

Ask by email and you will get a reply. If you are ever unhappy with how it was handled, you can complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.

Age

Standing is not built for children and is not meant for anyone under 16. Where a cup has a stake in it, everyone in that cup must be 18 or over — and it is the person who created or administers the cup who is responsible for making sure of that, because no money passes through Standing and it has no way of checking anyone’s age. The same rule is set out in the terms.

Read the terms

If this changes

This page changes when the product does, and the date at the top moves with it. Anything that meaningfully changes what is held or who sees it will be said in an email rather than quietly edited in here.