PRIVACY POLICY

Last Man Standing Planner is run by:

This policy explains:

• what data we collect
• why we collect it
• how we use it
• how long we keep it
• your rights

We use your data to:

• run the platform and games
• manage your account
• enforce game rules
• send essential emails and notifications (game updates, results, account activity)
• improve the product
• monitor performance and fix issues

We rely on:

• contract: to provide the service you signed up for
• legitimate interests: to run, secure and improve the platform
• consent: for analytics and cookies where required

We send emails related to your account and games, such as:

• game updates
• pick confirmations
• results and outcomes

We may send these by:

• email
• in-app notifications
• mobile app push notifications

We use cookies and similar technologies to:

• keep you signed in
• ensure the app works correctly
• understand usage (analytics)

You will be asked to accept or reject non-essential cookies before they are used.

We use trusted third-party providers:

• Stripe (system-browser checkout for organiser activation fees)
• Supabase (database and authentication)
• Vercel (hosting and web analytics where you consent)
• Resend (email delivery)
• Sentry (crash reporting and diagnostics)
• Consent and tag-management tools to manage cookie preferences and analytics
• Apple and Google sign-in providers if you choose those sign-in options
• Expo Push Service (mobile push notification delivery)
• PostHog (web product analytics where you consent)

These providers process data on our behalf.

Eligible web activation payments are processed by Stripe. We do not store card details.

On Google Play Android, paid activation uses Google Play Billing. On App Store iOS, paid activation uses Apple StoreKit In-App Purchase. Neither native store build opens Stripe Checkout or an external payment link. The platform does not hold or move player funds. Players pay organisers directly and off-platform.

We do not sell your personal data.

Some of our service providers operate outside the UK or EU.

Where this happens, we ensure appropriate safeguards are in place to protect your data.

• accounts: kept while active
• inactive accounts: deleted after 24 months of inactivity (with notice before deletion)
• completed games: kept for up to 24 months
• logs and technical data: typically kept for up to 90 days
• account deletion requests: personal data is deleted or anonymised where applicable; limited records may be retained under the criteria in section 11 and the periods above, or where the law requires them to be kept

You have the right to:

• access your data
• correct your data
• request deletion of your personal data
• object to certain processing
• complain to the ICO (UK data regulator)

You can submit an account deletion request at any time through our account deletion page or by emailing [email protected]. We may ask for reasonable information to verify that you own the account.

We review and handle each verified request manually, without undue delay and normally within one calendar month. Account access and personal data are deleted or anonymised where applicable. Limited records may need to remain to protect game integrity and other players' history, meet legal obligations, support fraud or security controls, or remain in backups until they are replaced under the applicable backup schedule.

A request can be made while you own or belong to an active game. Protected records may require separate review before completion. We will not delete another player's account, picks or game history, and we will explain what was deleted, anonymised or retained when the request is complete.

To request anything, contact:

[email protected]

If you have a data protection complaint:

• complain by emailing [email protected]
• we will acknowledge your complaint within 30 days
• we will investigate and keep you informed
• we will tell you the outcome

We may update this policy.

We will update the date at the top when we do.