Privacy and data protection

Who we are

The Home Games is operated by Scott Eason, who is the data controller for this site: the person answerable for what happens to your information. Where this page says we or us, that is who it means.

For anything to do with your data, email admin@thehomegames.co.uk. That address reaches us directly and it is the right place for requests, questions and complaints alike.

What we collect

Account players. Your email address, the name you choose, your password and a profile picture if you upload one. The password is kept only as a hash, a one way scramble that lets the site check what you type without ever holding the real thing.

Guest players. Guests exist so people without an email address can play, which in practice usually means younger members of a family. A guest record is the first name or nickname the organiser picks and a four digit PIN, and the PIN is kept as a hash too. No email address, no date of birth, nothing else.

Everyone. The predictions you save and a record of each save so scoring arguments can be settled, your season calls and their save record, which groups you are in and what your name is in each of them, any badges you pick up, notifications about your own groups, and when all of it happened.

Security records. When someone tries to sign in, reset a password or join with an invite link, we keep a short lived note of the email address or invite code that was used and the time it happened. That is what lets the site slow down password and PIN guessing. These notes hold no IP address and they are cleared after 24 hours.

Hosting logs. Our hosting provider keeps standard request logs and those do include IP addresses. They are there to keep the service up and to deal with attacks on it. We do not use them for anything else and we do not connect them to your account.

What we never do

The site takes no payment details because it never collects, holds or moves money. There is no advertising, no analytics script, no tracking pixel and no fingerprinting. We do not sell your information, we do not share it for marketing, we do not send marketing emails and there is nothing here for you to unsubscribe from.

Who else sees your information

The people in your group. They see your display name, your profile picture if you have one, the picks you have made once a round has locked, and where you sit in the table. That is the game working as intended.

The public leaderboard. Groups are private unless the owner switches them public. A public group shows its name and its total and average points, and nothing else: no player names, no guest names, no PINs, no personal details of any kind. Switching a group back to private takes it off the leaderboard straight away.

The companies below handle data on our behalf. Each one is bound by a written contract that limits it to acting on our instructions and nothing more.

Vercel Inc., a Delaware corporation registered under number 5857312, of 440 N Barranca Avenue #4133, Covina, California 91723, United States. Vercel hosts the site and runs the code behind it.

Neon, LLC, part of Databricks, Inc. of 160 Spear Street, 15th Floor, San Francisco, California 94105, United States. Neon runs the database where everything is stored.

Resend, the trading name of Plus Five Five, Inc., of 2261 Market Street #5039, San Francisco, California 94114, United States. Resend sends the only emails there are: a password reset you have asked for, and a notification to a group organiser about their own group. It receives the address the email goes to and what the email says, and it keeps a log of having sent it.

Beyond that, nobody. No advertising networks, no analytics providers, no data brokers and no marketing lists.

Cookies

Two cookies, both set by this site, neither one used to follow you anywhere.

thg_session keeps you signed in. It holds nothing but a reference to your session, expires 120 days after you sign in and disappears the moment you sign out. The site cannot work without it, so there is nothing to consent to.

hubGroup remembers which group you were looking at last so the site opens where you left off. It is only set when you switch groups and it lasts 180 days. A preference cookie of this kind does not need consent under the rules as they stand after the 2026 changes, but you are entitled to object to it. Clearing cookies for this site in your browser settings removes it, costs nothing and keeps it gone unless you use the group switcher again.

There is no cookie banner because there is genuinely nothing here to ask you about. No advertising cookies, no analytics, no third party scripts and no fingerprinting. Even the fonts are served from this site rather than a font network, so nobody else sees your address when a page loads.

Why we are allowed to use your information

UK data protection law needs a lawful basis for every use of personal information. Here are ours, and what each one covers.

Running your account and the game. Contract. You have asked to play, and the site cannot do that without your details, your picks and your name in front of the other people in your group.

Emails about your account. Contract. A password reset you asked for, or a notification an organiser needs about their own group. Nothing else gets sent.

Keeping the site secure. Legitimate interests. Slowing down password and PIN guessing, spotting abuse and dealing with anyone trying to break the site. The records involved are small and short lived, and the interest is in the site staying usable for everyone in it.

Keeping past seasons intact. Legitimate interests. When a competition finishes, its final table is frozen with display names and points and nothing else. It stays after someone leaves, because otherwise a group loses its own history the moment a player walks away.

Answering your data protection requests and complaints. Legal obligation.

Passing information to the police or another public authority, or protecting someone under 18 or otherwise at risk. Recognised legitimate interests. This basis was added to UK law in February 2026 and it applies only if we are ever asked for something a public authority needs to do its job, or if a real safeguarding concern comes up. It has not happened.

Defending a legal claim. Legitimate interests.

Where we rely on legitimate interests you can object, and we will stop unless there is a compelling reason not to that outweighs your position.

Where your information lives

All of it sits in the United States. Vercel runs the site's code in its Washington DC region and Neon holds the database in its US East region, so your information does leave the UK.

Email is no different. Resend stores account data, email metadata, logs and API records in the United States whichever sending region is chosen, and its own terms say so plainly.

A transfer like that needs a safeguard recognised by UK law. Every one of those contracts uses the European standard contractual clauses as adapted for the UK by the International Data Transfer Addendum issued by the Information Commissioner. Ask us and we will send you the relevant terms.

Automated decisions

Nothing on the site makes a decision about you automatically and there is no profiling. Scoring is arithmetic applied the same way to everyone's picks.

How your information is protected

Passwords and guest PINs are stored as bcrypt hashes, so the database never holds the real thing. Session and password reset tokens are stored as SHA-256 hashes for the same reason: what sits in the database cannot be used to sign in as you. Everything travels over HTTPS.

How long we keep things

Your account stays until you ask for it to go. There is no delete button yet, so ask by email and it is done by hand: the account, your memberships, your picks and your save history, all of it, inside a month and normally a good deal faster.

Sessions expire 120 days after you sign in and go immediately when you sign out. Signing out other devices clears the rest of them.

Sign in attempt records are cleared after 24 hours.

Password reset links last an hour and work once. Asking for a new one cancels the old one.

Picks and save history belong to the group they were made in. Leave a group, get removed by the organiser, or have the group deleted, and they go with you. That includes the save record behind them, which is deleted outright rather than left lying about.

Profile pictures are stored in the site's own database rather than with an image service, and uploading a new one deletes the old one.

Frozen season tables are the one thing that outlives a player, and they hold a display name and points and nothing more. Deleting the group deletes those too. If you would rather your name did not sit on a past season, ask and we will change it.

Your rights

You can ask us for a copy of the information we hold about you. You can ask us to correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to anything we do on the basis of legitimate interests. None of it costs anything, and we will answer within a month.

If you are unhappy with the way we have handled your information you have two separate rights and you can use either, or both.

Complain to us. Email admin@thehomegames.co.uk and say it is a data protection complaint. Put it however you like: however a complaint reaches us we have to accept it. We will acknowledge it within 30 days and come back to you with the outcome as soon as we reasonably can. This is your right under section 164A of the Data Protection Act 2018, which came into force in June 2026.

Complain to the regulator. You can go to the Information Commissioner's Office at ico.org.uk under section 165 of the same Act. You do not have to come to us first, though we would rather have the chance to put it right.

Children

The guest system exists so younger players can join without handing over personal details. A guest is a first name or nickname and a PIN. No email address, no date of birth, nothing that identifies a child beyond what their own family already calls them.

Accounts need an email address and are for players aged 16 and over. Group organisers add guests, and they should only do it with the agreement of the player or, for a child, a parent or guardian. If you are a parent and you want a child's guest entry taken off the site, ask the organiser or email us and we will remove it.

Changes to this notice

If something here changes, the date at the top changes with it and the new version goes up on this page. Anything that affects how your information is used, or who is responsible for it, will be told to you directly rather than left for you to spot on a later visit.