Privacy Policy

What data SWEEP:WC26 collects, why, and the rights you have over it under UK GDPR and the Data Protection Act 2018.

Last updated: 22 May 2026

Who we are

SWEEP:WC26 is a free, non-commercial tool for running World Cup 2026 office sweepstakes. The site operator is the data controller for any personal data processed here. Questions, requests, or complaints? Email [email protected].

What we collect

We only collect what's strictly needed to run a sweepstake:

• Pool admin email — provided when you create a pool, used to send the admin secret and to recover lost links.
• Player names — free-text strings entered by participants when they draw a team. We treat these as participant-chosen identifiers, not verified identities.
• Team assignments — which name drew which country, and in which round.
• Server access logs — IP address, user-agent, request path and timestamp. Retained for up to 30 days for security and debugging, then rotated out.

We do not use analytics, advertising trackers, fingerprinting, or any third-party marketing tools.

Why we collect it (lawful basis)

• Pool admin email — your consent, given when you submit the create-a-pool form. Withdraw at any time by emailing us to delete the pool.
• Player names + team assignments — legitimate interests in providing the sweepstake feature you've signed up for. These can't be removed without effectively deleting the pool.
• Server logs — legitimate interests in keeping the service secure and operational.

How long we keep it

Pool data (admin email, player names, team assignments) is retained for as long as the pool exists. When a pool is deleted — by you or by us — all associated data is permanently removed within 7 days, including from encrypted off-site backups in the next rotation cycle.

Server access logs are retained for up to 30 days, then automatically rotated.

Who we share it with

Nobody, by default. If the site operator has configured an SMTP email provider (e.g. Mailgun, SendGrid) for sending welcome and recovery emails, that provider acts as a processor and receives only the email content needed to deliver the message. We never sell or trade personal data.

If you ever spot a security issue, error reports (sanitised of personal data) may be sent to Sentry for triage — but only if the site operator has opted into Sentry. Check with whoever deployed your instance.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data (e.g. fix a misspelled name).
• Erase your data — for pool admins, this means deleting the pool.
• Restrict or object to processing.
• Withdraw consent at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email [email protected] with the pool ID. We aim to respond within 14 days.

Cookies and local storage

SWEEP:WC26 does not set any cookies. We do use your browser's localStorage to remember which pools you've joined or created on this device. See the Cookie Notice for the full breakdown and how to clear it.

Changes to this policy

Material changes will be reflected here with a new "last updated" date. We won't email you about minor wording tweaks, but significant changes to data handling will trigger a notice when you next open the site.